@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/client/core/types.d.ts

@@ -1,7 +1,157 @@
-import { FunctionReference } from "convex/server";
 import { ConvexError, Value } from "convex/values";
+import { FunctionReference } from "convex/server";
 
 //#region src/client/core/types.d.ts
+/**
+ * Structural interface for any Convex client.
+ * Satisfied by `ConvexClient` (`convex/browser`),
+ * `ConvexReactClient` (`convex/react`), and similar transports.
+ *
+ * `clearAuth` is present on `ConvexReactClient` and `BaseConvexClient`
+ * but not on the simplified `ConvexClient`. When available we call it
+ * during sign-out for a clean deauthentication.
+ */
+interface ConvexTransport {
+  action(action: unknown, args: unknown): Promise<unknown>;
+  setAuth(fetchToken: (args: {
+    forceRefreshToken: boolean;
+  }) => Promise<string | null | undefined>, onChange?: (isAuthenticated: boolean) => void): void;
+  clearAuth?(): void;
+}
+/** Minimal action-only transport used for unauthenticated auth flows. */
+interface ActionTransport {
+  action(action: unknown, args: unknown): Promise<unknown>;
+}
+type SignInApiRef = {
+  signIn: AuthApiRefs["signIn"];
+};
+/** Pluggable key-value storage supplied by the host runtime. */
+interface Storage {
+  getItem(key: string): string | null | undefined | Promise<string | null | undefined>;
+  setItem(key: string, value: string): void | Promise<void>;
+  removeItem(key: string): void | Promise<void>;
+}
+/** Platform-neutral location/navigation hooks. */
+interface LocationRuntime {
+  get(): URL | null;
+  replace(relativeUrl: string): void | Promise<void>;
+  redirect(url: URL): void | Promise<void>;
+}
+/** Cross-context synchronization hooks, such as browser storage events. */
+interface SyncRuntime {
+  subscribe(key: string, callback: (value: string | null) => void | Promise<void>): (() => void) | null;
+}
+/** Cross-context mutex/locking primitive. */
+interface MutexRuntime {
+  withKey<T>(key: string, callback: () => Promise<T>): Promise<T>;
+}
+/** Proxy request execution supplied by the host runtime. */
+interface ProxyRuntime {
+  fetch(body: Record<string, unknown>, proxyPath: string): Promise<Response>;
+}
+/**
+ * Platform-neutral client runtime dependencies.
+ *
+ * The core `client` package should depend only on these interfaces, while the
+ * browser package can provide concrete implementations backed by DOM APIs.
+ */
+interface ClientRuntime {
+  environment?: "client" | "server";
+  storage?: Storage | null;
+  location?: LocationRuntime;
+  sync?: SyncRuntime;
+  mutex?: MutexRuntime;
+  proxy?: ProxyRuntime;
+}
+/** Platform-specific factor adapters injected by entrypoints like `browser`. */
+interface ClientAdapters {
+  passkey?: PasskeyClient;
+  totp?: TotpClient;
+  device?: DeviceClient;
+}
+interface ClientAdapterDeps {
+  proxy: string | undefined;
+  convex: ConvexTransport;
+  requireApiRefs: () => SignInApiRef;
+  proxyFetch: (body: Record<string, unknown>) => Promise<unknown>;
+  setTokenAndMaybeWait: (args: {
+    shouldStore: true;
+    tokens: AuthSession | null;
+    waitForHandshake: boolean;
+    context: {
+      provider?: string;
+      flow: string;
+    };
+  } | {
+    shouldStore: false;
+    tokens: {
+      token: string;
+    } | null;
+    waitForHandshake: boolean;
+    context: {
+      provider?: string;
+      flow: string;
+    };
+  }) => Promise<boolean>;
+}
+interface ClientAdapterFactories {
+  passkey?: (deps: ClientAdapterDeps) => PasskeyClient;
+}
+type AuthSession = {
+  token: string;
+  refreshToken: string;
+};
+/**
+ * Device code response returned when signing in with the `"device"` provider.
+ *
+ * The device displays the `userCode` (or `verificationUriComplete`) and
+ * polls via `auth.device.poll()` until the user authorizes.
+ */
+type DeviceCodeResult = {
+  /** High-entropy device code used for polling (keep secret). */deviceCode: string; /** Short human-readable code the user enters (e.g. "WDJB-MJHT"). */
+  userCode: string; /** Base verification URL (e.g. "https://myapp.com/device"). */
+  verificationUri: string; /** Verification URL with user code pre-filled as `?code=XXXX-XXXX`. */
+  verificationUriComplete: string; /** Lifetime of the codes in seconds. */
+  expiresIn: number; /** Minimum polling interval in seconds. */
+  interval: number;
+};
+/**
+ * Result of a `signIn` call.
+ *
+ * - `kind: "signedIn"` — credentials were accepted and the user is authenticated.
+ * - `kind: "redirect"` — OAuth flow initiated; redirect the user to `redirect.toString()`.
+ * - `kind: "totpRequired"` — credentials valid but 2FA is needed; call `auth.totp.verify()`.
+ * - `kind: "deviceCode"` — device flow initiated; display the code and poll via `auth.device.poll()`.
+ * - `kind: "started"` — a non-immediate flow started (for example email/phone verification).
+ *
+ * @see {@link AuthState}
+ */
+type SignInResult = {
+  kind: "signedIn";
+} | {
+  kind: "redirect";
+  redirect: URL;
+  verifier: string;
+} | {
+  kind: "totpRequired";
+  verifier: string;
+} | {
+  kind: "deviceCode";
+  deviceCode: DeviceCodeResult;
+} | {
+  kind: "started";
+};
+/**
+ * Reactive auth state snapshot returned by `auth.state` and `auth.onChange`.
+ *
+ * @see {@link SignInResult}
+ */
+type AuthState = {
+  /** High-level auth phase for deterministic UI state handling. */phase: "loading" | "handshake" | "authenticated" | "unauthenticated"; /** `true` during initial hydration before the first token is resolved. */
+  isLoading: boolean; /** `true` only after Convex confirms authentication with the backend. */
+  isAuthenticated: boolean; /** The raw JWT string, or `null` when not authenticated. */
+  token: string | null;
+};
 /**
  * Typed Convex API references for the auth functions.
  * Pass these from your generated `api` object.
@@ -11,10 +161,307 @@ import { ConvexError, Value } from "convex/values";
  * @typeParam HasDevice - Whether the device provider is configured.
  */
 type AuthApiRefs<HasPasskey extends boolean = boolean, HasTotp extends boolean = boolean, HasDevice extends boolean = boolean> = {
-  signIn: FunctionReference<"action", "public", any, any>;
-  signOut: FunctionReference<"action", "public", any, any>;
-  store: FunctionReference<"mutation", "public", any, any>;
+  signIn: FunctionReference<"action", "public", Record<string, Value>, unknown>;
+  signOut: FunctionReference<"action", "public", Record<string, Value>, unknown>;
+  store: FunctionReference<"mutation", "public", Record<string, Value>, unknown>;
+};
+/**
+ * Passkey (WebAuthn) client-side helpers.
+ *
+ * @see {@link TotpClient}
+ * @see {@link DeviceClient}
+ */
+interface PasskeyClient {
+  /**
+   * Check whether the current runtime exposes WebAuthn passkey APIs.
+   *
+   * @returns `true` when `navigator.credentials` is available.
+   *
+   * @example
+   * ```ts
+   * if (auth.passkey.isSupported()) {
+   *   // Show passkey registration button
+   * }
+   * ```
+   */
+  isSupported(): boolean;
+  /**
+   * Check whether conditional mediation (autofill-style passkeys) is available.
+   *
+   * @returns `true` when the browser supports `PublicKeyCredential.isConditionalMediationAvailable`.
+   *
+   * @example
+   * ```ts
+   * if (await auth.passkey.isAutofillSupported()) {
+   *   await auth.passkey.authenticate({ autofill: true });
+   * }
+   * ```
+   */
+  isAutofillSupported(): Promise<boolean>;
+  /**
+   * Start a passkey registration flow and complete the WebAuthn ceremony.
+   *
+   * Creates a new credential bound to the current user's account.
+   *
+   * @param opts - Optional registration hints.
+   * @param opts.name - Human-readable name for the passkey (e.g. `"MacBook Pro"`).
+   * @param opts.email - Email hint for discoverable credentials.
+   * @param opts.userName - WebAuthn `user.name` override.
+   * @param opts.userDisplayName - WebAuthn `user.displayName` override.
+   * @returns A {@link SignInResult} — typically `{ kind: "signedIn" }` on success.
+   *
+   * @example
+   * ```ts
+   * const result = await auth.passkey.register({ name: "My laptop" });
+   * ```
+   */
+  register(opts?: Record<string, unknown>): Promise<SignInResult>;
+  /**
+   * Authenticate with an existing passkey and complete the WebAuthn ceremony.
+   *
+   * @param opts - Optional authentication hints.
+   * @param opts.email - Email hint to filter discoverable credentials.
+   * @param opts.autofill - Set to `true` for conditional UI (autofill) mode.
+   * @returns A {@link SignInResult} — typically `{ kind: "signedIn" }` on success.
+   *
+   * @example
+   * ```ts
+   * const result = await auth.passkey.authenticate();
+   * ```
+   */
+  authenticate(opts?: Record<string, unknown>): Promise<SignInResult>;
+}
+/**
+ * TOTP two-factor authentication client-side helpers.
+ *
+ * @see {@link PasskeyClient}
+ * @see {@link DeviceClient}
+ */
+interface TotpClient {
+  /**
+   * Start TOTP enrollment and return the setup URI, secret, verifier, and factor ID.
+   *
+   * The returned `uri` is an `otpauth://` URL that can be rendered as a QR code
+   * for the user to scan with their authenticator app.
+   *
+   * @param opts - Optional setup hints.
+   * @param opts.name - Issuer name shown in the authenticator app.
+   * @param opts.accountName - Account label in the authenticator app.
+   * @returns An object with `{ uri, secret, verifier, totpId }`.
+   *
+   * @example
+   * ```ts
+   * const { uri, secret, verifier, totpId } = await auth.totp.setup();
+   * // Render `uri` as a QR code, then confirm:
+   * await auth.totp.confirm({ code: userCode, verifier, totpId });
+   * ```
+   */
+  setup(opts?: Record<string, unknown>): Promise<Record<string, unknown>>;
+  /**
+   * Confirm a newly created TOTP factor with the first authenticator code.
+   *
+   * Call this after the user scans the QR code and enters the first OTP.
+   *
+   * @param opts - Confirmation parameters.
+   * @param opts.code - The 6-digit TOTP code from the authenticator app.
+   * @param opts.verifier - The verifier string returned by {@link TotpClient.setup}.
+   * @param opts.totpId - The factor ID returned by {@link TotpClient.setup}.
+   *
+   * @example
+   * ```ts
+   * await auth.totp.confirm({ code: "123456", verifier, totpId });
+   * ```
+   */
+  confirm(opts: Record<string, unknown>): Promise<void>;
+  /**
+   * Complete a sign-in that is waiting on TOTP verification.
+   *
+   * Called when `signIn()` returns `{ kind: "totpRequired" }`.
+   *
+   * @param opts - Verification parameters.
+   * @param opts.code - The 6-digit TOTP code from the authenticator app.
+   * @param opts.verifier - The verifier string from the `totpRequired` result.
+   *
+   * @example
+   * ```ts
+   * const result = await auth.signIn("password", { email, password });
+   * if (result.kind === "totpRequired") {
+   *   await auth.totp.verify({ code: totpCode, verifier: result.verifier });
+   * }
+   * ```
+   */
+  verify(opts: Record<string, unknown>): Promise<void>;
+}
+/**
+ * Device authorization (RFC 8628) client-side helpers.
+ *
+ * @see {@link PasskeyClient}
+ * @see {@link TotpClient}
+ */
+interface DeviceClient {
+  /**
+   * Poll until a device flow is approved or expires.
+   *
+   * Polls the server at the interval specified in the {@link DeviceCodeResult}
+   * until the user authorizes the device or the code expires.
+   *
+   * @param opts - Poll options.
+   * @param opts.code - The {@link DeviceCodeResult} returned from `signIn("device")`.
+   * @throws `ConvexError({ code: "DEVICE_CODE_EXPIRED" })` when the code expires before authorization.
+   *
+   * @example
+   * ```ts
+   * const result = await auth.signIn("device");
+   * if (result.kind === "deviceCode") {
+   *   // Display result.deviceCode.userCode to the user
+   *   await auth.device.poll({ code: result.deviceCode });
+   *   console.log("Device authorized!");
+   * }
+   * ```
+   */
+  poll(opts: {
+    code: DeviceCodeResult;
+  }): Promise<void>;
+  /**
+   * Approve a device flow from the verification page using the displayed user code.
+   *
+   * Call this on the authorization page where the user enters the short code
+   * shown on the device screen.
+   *
+   * @param opts - Verification options.
+   * @param opts.code - The user code string (e.g. `"WDJB-MJHT"`).
+   * @throws `ConvexError({ code: "DEVICE_AUTHORIZATION_FAILED" })` when verification fails.
+   *
+   * @example
+   * ```ts
+   * await auth.device.verify({ code: "WDJB-MJHT" });
+   * ```
+   */
+  verify(opts: {
+    code: string;
+  }): Promise<void>;
+}
+/**
+ * Extract capability flags from an AuthApiRefs type.
+ *
+ * @typeParam Api - An AuthApiRefs type to extract capability flags from.
+ */
+type InferCaps<Api extends AuthApiRefs<boolean, boolean, boolean>> = Api extends AuthApiRefs<infer P, infer T, infer D> ? {
+  passkey: P;
+  totp: T;
+  device: D;
+} : {
+  passkey: boolean;
+  totp: boolean;
+  device: boolean;
+};
+/** Pending invite detected from URL or recovered from storage after redirect. */
+interface PendingInvite {
+  /**
+   * Raw one-time invite token. Pass to your invite acceptance mutation.
+   * @readonly
+   */
+  readonly token: string;
+  /**
+   * Invite email from the URL or stored redirect state, if available.
+   * @readonly
+   */
+  readonly email: string | null;
+  /**
+   * Consume the invite: clears storage/URL params and returns the token.
+   *
+   * @returns The invite token.
+   * @throws When there is no pending invite to accept.
+   */
+  accept(): Promise<{
+    token: string;
+  }>;
+}
+/** Base auth client — always present. */
+interface AuthClientBase {
+  /**
+   * Reactive auth state snapshot.
+   * @readonly
+   */
+  readonly state: AuthState;
+  /** SSR-safe query-param reader. */
+  param: (name: string) => string | null;
+  /**
+   * Pending invite recovered from the URL or storage, if present.
+   * @readonly
+   */
+  readonly invite: PendingInvite | null;
+  /** Start a sign-in flow for a provider. */
+  signIn: (provider: string, params?: Record<string, unknown>) => Promise<SignInResult>;
+  /** Sign out and clear local auth state. */
+  signOut: () => Promise<void>;
+  /** Subscribe to auth state changes. Returns an unsubscribe function. */
+  onChange: (callback: (state: AuthState) => void) => () => void;
+  /** Tear down listeners and reject in-flight handshakes. */
+  destroy: () => void;
+}
+/**
+ * Framework-agnostic auth client return type.
+ *
+ * Conditionally includes `totp` and `device` helpers based on the
+ * capabilities in the `AuthApiRefs` type. Browser-only `passkey` helpers are
+ * added by {@link BrowserAuthClient}.
+ *
+ * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.
+ */
+type AuthClient<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> = AuthClientBase & (InferCaps<Api>["totp"] extends true ? {
+  totp: TotpClient;
+} : {}) & (InferCaps<Api>["device"] extends true ? {
+  device: DeviceClient;
+} : {});
+/**
+ * Browser auth client return type.
+ *
+ * Extends {@link AuthClient} with conditional passkey helpers when the
+ * generated auth API exposes passkey capabilities.
+ *
+ * @typeParam Api - An AuthApiRefs type that determines which factor helpers are included.
+ */
+type BrowserAuthClient<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> = AuthClient<Api> & (InferCaps<Api>["passkey"] extends true ? {
+  passkey: PasskeyClient;
+} : {});
+/**
+ * Options for {@link client}.
+ *
+ * @typeParam Api - An AuthApiRefs type.
+ */
+type ClientOptions<Api extends AuthApiRefs<boolean, boolean, boolean> = AuthApiRefs> = {
+  /** Any Convex client implementation used to run auth actions. */convex: ConvexTransport; /** Platform runtime implementation used by the client core. */
+  runtime?: ClientRuntime; /** Platform-specific factor adapters supplied by higher-level entrypoints. */
+  adapters?: ClientAdapters; /** Platform-specific adapter factories supplied by higher-level entrypoints. */
+  adapterFactories?: ClientAdapterFactories;
+  /**
+   * Typed auth function refs from your generated `api` object.
+   * Required outside proxy mode.
+   */
+  api?: Api; /** Explicit Convex deployment URL when it cannot be inferred from the client. */
+  url?: string;
+  /**
+   * Optional action-only transport for direct code exchange outside proxy mode.
+   * Required in non-browser runtimes when `proxyPath` is not set.
+   */
+  httpClient?: ActionTransport | null;
+  /**
+   * Storage backend for persisted tokens.
+   *
+   * Defaults to `runtime.storage` when provided, otherwise `null`.
+   */
+  storage?: Storage | null; /** Override how OAuth code cleanup updates the current URL. */
+  replaceUrl?: (relativeUrl: string) => void | Promise<void>;
+  /**
+   * Proxy endpoint used instead of direct Convex auth calls.
+   * When set, provide `runtime.proxy` and omit direct `api`/`httpClient`
+   * transport requirements.
+   */
+  proxyPath?: string; /** Server-provided JWT seed used for flash-free SSR hydration. */
+  tokenSeed?: string | null; /** SSR-safe URL source for reading query parameters. */
+  location?: URL | (() => URL | null);
 };
 //#endregion
-export { AuthApiRefs };
+export { AuthApiRefs, AuthClient, AuthState, BrowserAuthClient, ClientOptions, ClientRuntime, DeviceClient, DeviceCodeResult, PasskeyClient, PendingInvite, SignInResult, Storage, TotpClient };
 //# sourceMappingURL=types.d.ts.map

package/dist/client/core/types.js

@@ -0,0 +1,17 @@
+//#region src/client/core/types.ts
+function createDeferred() {
+	let resolve;
+	let reject;
+	return {
+		promise: new Promise((res, rej) => {
+			resolve = res;
+			reject = rej;
+		}),
+		resolve,
+		reject
+	};
+}
+
+//#endregion
+export { createDeferred };
+//# sourceMappingURL=types.js.map

package/dist/client/errors.js

@@ -0,0 +1,19 @@
+import { ConvexError } from "convex/values";
+
+//#region src/client/errors.ts
+const HANDSHAKE_ERROR_MESSAGES = {
+	AUTH_HANDSHAKE_TIMEOUT: "Sign-in succeeded but authentication confirmation timed out.",
+	AUTH_HANDSHAKE_REJECTED: "Authentication was rejected while confirming the session."
+};
+/** @internal */
+const createHandshakeError = (code, context) => {
+	return new ConvexError({
+		code,
+		message: HANDSHAKE_ERROR_MESSAGES[code],
+		...context
+	});
+};
+
+//#endregion
+export { createHandshakeError };
+//# sourceMappingURL=errors.js.map

package/dist/client/factors/device.js

@@ -0,0 +1,94 @@
+import { ConvexError } from "convex/values";
+
+//#region src/client/factors/device.ts
+function isSignedInResult(result) {
+	return result.kind === "signedIn";
+}
+/** @internal */
+function createDeviceClient(deps) {
+	const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;
+	const requestDeviceSignIn = async (params) => {
+		return proxy ? await proxyFetch({
+			action: "auth:signIn",
+			args: {
+				provider: "device",
+				params
+			}
+		}) : await convex.action(requireApiRefs().signIn, {
+			provider: "device",
+			params
+		});
+	};
+	return {
+		poll: async (opts) => {
+			const { code } = opts;
+			const intervalMs = code.interval * 1e3;
+			const expiresAt = Date.now() + code.expiresIn * 1e3;
+			while (Date.now() < expiresAt) {
+				await new Promise((resolve) => setTimeout(resolve, intervalMs));
+				const params = {
+					flow: "poll",
+					deviceCode: code.deviceCode
+				};
+				let pollResult;
+				try {
+					pollResult = await requestDeviceSignIn(params);
+				} catch (error) {
+					if (error instanceof ConvexError) {
+						const errorCode = error.data?.code;
+						if (errorCode === "DEVICE_AUTHORIZATION_PENDING") continue;
+						if (errorCode === "DEVICE_SLOW_DOWN") {
+							await new Promise((resolve) => setTimeout(resolve, intervalMs));
+							continue;
+						}
+					}
+					throw error;
+				}
+				if (pollResult === null) continue;
+				if (isSignedInResult(pollResult) && pollResult.tokens) {
+					if (proxy) await setTokenAndMaybeWait({
+						shouldStore: false,
+						tokens: pollResult.tokens === null ? null : { token: pollResult.tokens.token },
+						waitForHandshake: true,
+						context: {
+							provider: "device",
+							flow: "poll"
+						}
+					});
+					else await setTokenAndMaybeWait({
+						shouldStore: true,
+						tokens: pollResult.tokens ?? null,
+						waitForHandshake: true,
+						context: {
+							provider: "device",
+							flow: "poll"
+						}
+					});
+					return;
+				}
+			}
+			throw new ConvexError({
+				code: "DEVICE_CODE_EXPIRED",
+				message: "Device code expired before authorization was completed."
+			});
+		},
+		verify: async (opts) => {
+			const params = {
+				flow: "verify",
+				userCode: opts.code
+			};
+			try {
+				await requestDeviceSignIn(params);
+			} catch (error) {
+				throw new ConvexError({
+					code: "DEVICE_AUTHORIZATION_FAILED",
+					message: error instanceof Error ? error.message : "Invalid or expired code."
+				});
+			}
+		}
+	};
+}
+
+//#endregion
+export { createDeviceClient };
+//# sourceMappingURL=device.js.map

package/dist/{factors → client/factors}/totp.js

@@ -1,4 +1,10 @@
 //#region src/client/factors/totp.ts
+function isSignedInResult(result) {
+	return result.kind === "signedIn";
+}
+function isTotpSetupResult(result) {
+	return result.kind === "totpSetup";
+}
 /** @internal */
 function createTotpClient(deps) {
 	const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;
@@ -15,6 +21,7 @@ function createTotpClient(deps) {
 						params
 					}
 				});
+				if (!isTotpSetupResult(result$1)) throw new Error("Server did not return TOTP setup data.");
 				return {
 					uri: result$1.totpSetup.uri,
 					secret: result$1.totpSetup.secret,
@@ -26,6 +33,7 @@ function createTotpClient(deps) {
 				provider: "totp",
 				params
 			});
+			if (!isTotpSetupResult(result)) throw new Error("Server did not return TOTP setup data.");
 			return {
 				uri: result.totpSetup.uri,
 				secret: result.totpSetup.secret,
@@ -48,7 +56,7 @@ function createTotpClient(deps) {
 						verifier: opts.verifier
 					}
 				});
-				if (result$1.tokens) await setTokenAndMaybeWait({
+				if (isSignedInResult(result$1) && result$1.tokens) await setTokenAndMaybeWait({
 					shouldStore: false,
 					tokens: result$1.tokens === null ? null : { token: result$1.tokens.token },
 					waitForHandshake: true,
@@ -64,7 +72,7 @@ function createTotpClient(deps) {
 				params,
 				verifier: opts.verifier
 			});
-			if (result.tokens) await setTokenAndMaybeWait({
+			if (isSignedInResult(result) && result.tokens) await setTokenAndMaybeWait({
 				shouldStore: true,
 				tokens: result.tokens ?? null,
 				waitForHandshake: true,
@@ -88,7 +96,7 @@ function createTotpClient(deps) {
 						verifier: opts.verifier
 					}
 				});
-				if (result$1.tokens) await setTokenAndMaybeWait({
+				if (isSignedInResult(result$1) && result$1.tokens) await setTokenAndMaybeWait({
 					shouldStore: false,
 					tokens: result$1.tokens === null ? null : { token: result$1.tokens.token },
 					waitForHandshake: true,
@@ -104,7 +112,7 @@ function createTotpClient(deps) {
 				params,
 				verifier: opts.verifier
 			});
-			if (result.tokens) await setTokenAndMaybeWait({
+			if (isSignedInResult(result) && result.tokens) await setTokenAndMaybeWait({
 				shouldStore: true,
 				tokens: result.tokens ?? null,
 				waitForHandshake: true,