kitcn 0.33.5 → 0.33.7

package/dist/react/index.js

@@ -1,5 +1,5 @@
 'use client';
-import { A as CRPCClientError, C as decodeJwtExp, M as isCRPCClientError, O as writeAuthSessionFallbackData, S as useSafeConvexAuth, T as clearAuthSessionFallback, _ as useConvexAuthBridge, a as ConvexAuthRecoveryError, b as useIsAuth, c as MaybeAuthenticated, d as isSessionSyncGraceActive, f as useAuth, g as useAuthValue, h as useAuthStore, i as ConvexAuthBridge, j as defaultIsUnauthorized, k as writeAuthSessionFallbackToken, l as MaybeUnauthenticated, m as useAuthState, n as AuthProvider, o as ConvexProviderWithAuth, p as useAuthGuard, r as Authenticated, s as FetchAccessTokenContext, t as AUTH_SESSION_SYNC_GRACE_MS, u as Unauthenticated, v as useConvexAuthRecovery, w as decodeJwtIdentity, x as useMaybeAuth, y as useFetchAccessToken } from "../auth-store-x3_wvhTR.js";
+import { A as useAuthState, B as decodeJwtIdentity, C as FetchAccessTokenContext, D as isSessionSyncGraceActive, E as Unauthenticated, F as useFetchAccessToken, G as writeAuthSessionFallbackToken, I as useIsAuth, J as isCRPCClientError, K as CRPCClientError, L as useMaybeAuth, M as useAuthValue, N as useConvexAuthBridge, O as useAuth, P as useConvexAuthRecovery, R as useSafeConvexAuth, S as ConvexProviderWithAuth, T as MaybeUnauthenticated, V as clearAuthSessionFallback, W as writeAuthSessionFallbackData, _ as AUTH_SESSION_SYNC_GRACE_MS, b as ConvexAuthBridge, i as publishToken, j as useAuthStore, k as useAuthGuard, l as isDocumentTripped, q as defaultIsUnauthorized, r as publishAuthenticated, t as admitStoreToken, v as AuthProvider, w as MaybeAuthenticated, x as ConvexAuthRecoveryError, y as Authenticated, z as decodeJwtExp } from "../token-gate-CEzbXArg.js";
 import { ConvexProvider, ConvexReactClient, ConvexReactClient as ConvexReactClient$1, useAction, useConvex, useMutation } from "convex/react";
 import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState } from "react";
 import { jsx } from "react/jsx-runtime";
@@ -9,122 +9,6 @@ import { hashKey } from "@tanstack/query-core";
 import { convexToJson } from "convex/values";
 import { ConvexHttpClient } from "convex/browser";
 
-//#region src/shared/meta-utils.ts
-const metaCache = /* @__PURE__ */ new WeakMap();
-const nonMetaLeafKeys = new Set(["functionRef", "ref"]);
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null;
-}
-function isFunctionType(value) {
-	return value === "query" || value === "mutation" || value === "action";
-}
-function isMetaScalar(value) {
-	return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
-}
-function extractLeafMeta(value) {
-	const type = value.type;
-	if (!isFunctionType(type)) return;
-	const result = { type };
-	for (const [key, entry] of Object.entries(value)) {
-		if (key === "type" || nonMetaLeafKeys.has(key) || key.startsWith("_")) continue;
-		if (entry === void 0) continue;
-		if (isMetaScalar(entry)) result[key] = entry;
-	}
-	return result;
-}
-function getHttpRoutes(api) {
-	const routes = api._http;
-	if (!isRecord$1(routes)) return;
-	const normalized = {};
-	for (const [routeKey, routeValue] of Object.entries(routes)) {
-		if (!isRecord$1(routeValue)) continue;
-		const routePath = routeValue.path;
-		const routeMethod = routeValue.method;
-		if (typeof routePath === "string" && typeof routeMethod === "string") normalized[routeKey] = {
-			path: routePath,
-			method: routeMethod
-		};
-	}
-	return normalized;
-}
-/**
-* Build a metadata index from merged API leaves.
-* Supports both generated `api` objects and plain metadata fixtures.
-*/
-function buildMetaIndex(api) {
-	const cached = metaCache.get(api);
-	if (cached) return cached;
-	const meta = {};
-	const httpRoutes = getHttpRoutes(api);
-	if (httpRoutes) meta._http = httpRoutes;
-	const walk = (node, path) => {
-		for (const [key, value] of Object.entries(node)) {
-			if (key.startsWith("_")) continue;
-			if (!isRecord$1(value)) continue;
-			const leafMeta = extractLeafMeta(value);
-			if (leafMeta) {
-				if (path.length === 0) continue;
-				const namespace = path.join("/");
-				meta[namespace] ??= {};
-				meta[namespace][key] = leafMeta;
-				continue;
-			}
-			walk(value, [...path, key]);
-		}
-	};
-	walk(api, []);
-	metaCache.set(api, meta);
-	return meta;
-}
-/**
-* Get a function reference from the API object by traversing the path.
-*/
-function getFuncRef(api, path) {
-	let current = api;
-	for (const key of path) if (current && typeof current === "object") {
-		const next = current[key];
-		if (next === void 0) throw new Error(`Invalid path: ${path.join(".")}`);
-		current = next;
-	} else throw new Error(`Invalid path: ${path.join(".")}`);
-	if (current && typeof current === "object") {
-		const maybeFunctionRef = current.functionRef;
-		if (maybeFunctionRef && typeof maybeFunctionRef === "object") return maybeFunctionRef;
-	}
-	if (!current || typeof current !== "object") throw new Error(`Invalid function reference at path: ${path.join(".")}`);
-	return current;
-}
-/**
-* Get function type from meta using path.
-* Supports nested paths like ['items', 'queries', 'list'] → namespace='items/queries', fn='list'
-*
-* @param path - Path segments like ['todos', 'create'] or ['items', 'queries', 'list']
-* @param meta - The meta object from codegen
-* @returns Function type or 'query' as default
-*/
-function getFunctionType(path, source) {
-	if (path.length < 2) return "query";
-	const meta = buildMetaIndex(source);
-	const fnName = path.at(-1);
-	const fnType = meta[path.slice(0, -1).join("/")]?.[fnName]?.type;
-	if (fnType === "query" || fnType === "mutation" || fnType === "action") return fnType;
-	return "query";
-}
-/**
-* Get function metadata from meta using path.
-* Supports nested paths like ['items', 'queries', 'list'] → namespace='items/queries', fn='list'
-*
-* @param path - Path segments like ['todos', 'create'] or ['items', 'queries', 'list']
-* @param meta - The meta object from codegen
-* @returns Function metadata or undefined
-*/
-function getFunctionMeta(path, source) {
-	if (path.length < 2) return;
-	const meta = buildMetaIndex(source);
-	const fnName = path.at(-1);
-	return meta[path.slice(0, -1).join("/")]?.[fnName];
-}
-
-//#endregion
 //#region src/crpc/http-types.ts
 /**
 * Build the exact cache key for an HTTP route.
@@ -209,6 +93,8 @@ function buildSearchParams(query) {
 	else if (value !== void 0 && value !== null) params.append(key, value);
 	return params;
 }
+const RECHECK_AUTHORIZATION = Symbol.for("kitcn.http.recheckAuthorization");
+const withAuthorizationRecheck = (headers, recheck) => Object.defineProperty(headers, RECHECK_AUTHORIZATION, { value: recheck });
 /**
 * Hono-style HTTP request executor.
 * Processes args in the same way as Hono's ClientRequestImpl.fetch().
@@ -247,6 +133,8 @@ async function executeHttpRequest(opts) {
 		for (const [key, value] of Object.entries(resolvedBaseHeaders)) if (value !== void 0) finalHeaders[key] = value;
 	}
 	Object.assign(finalHeaders, headerValues);
+	const recheck = resolvedBaseHeaders?.[RECHECK_AUTHORIZATION];
+	const sendHeaders = recheck && finalHeaders.Authorization === resolvedBaseHeaders?.Authorization && !recheck() ? Object.fromEntries(Object.entries(finalHeaders).filter(([key]) => key !== "Authorization")) : finalHeaders;
 	let url = opts.convexSiteUrl + path;
 	if (args.params) url = opts.convexSiteUrl + replaceUrlParam(path, args.params);
 	if (args.searchParams) {
@@ -258,7 +146,7 @@ async function executeHttpRequest(opts) {
 	const response = await (mergedClientOpts.fetch ?? opts.baseFetch ?? globalThis.fetch)(url, {
 		body: setBody ? rBody : void 0,
 		method: methodUpperCase,
-		headers: finalHeaders,
+		headers: sendHeaders,
 		...mergedClientOpts.init
 	});
 	if (!response.ok) {
@@ -280,6 +168,122 @@ async function executeHttpRequest(opts) {
 	return response.text();
 }
 
+//#endregion
+//#region src/shared/meta-utils.ts
+const metaCache = /* @__PURE__ */ new WeakMap();
+const nonMetaLeafKeys = new Set(["functionRef", "ref"]);
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null;
+}
+function isFunctionType(value) {
+	return value === "query" || value === "mutation" || value === "action";
+}
+function isMetaScalar(value) {
+	return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function extractLeafMeta(value) {
+	const type = value.type;
+	if (!isFunctionType(type)) return;
+	const result = { type };
+	for (const [key, entry] of Object.entries(value)) {
+		if (key === "type" || nonMetaLeafKeys.has(key) || key.startsWith("_")) continue;
+		if (entry === void 0) continue;
+		if (isMetaScalar(entry)) result[key] = entry;
+	}
+	return result;
+}
+function getHttpRoutes(api) {
+	const routes = api._http;
+	if (!isRecord$1(routes)) return;
+	const normalized = {};
+	for (const [routeKey, routeValue] of Object.entries(routes)) {
+		if (!isRecord$1(routeValue)) continue;
+		const routePath = routeValue.path;
+		const routeMethod = routeValue.method;
+		if (typeof routePath === "string" && typeof routeMethod === "string") normalized[routeKey] = {
+			path: routePath,
+			method: routeMethod
+		};
+	}
+	return normalized;
+}
+/**
+* Build a metadata index from merged API leaves.
+* Supports both generated `api` objects and plain metadata fixtures.
+*/
+function buildMetaIndex(api) {
+	const cached = metaCache.get(api);
+	if (cached) return cached;
+	const meta = {};
+	const httpRoutes = getHttpRoutes(api);
+	if (httpRoutes) meta._http = httpRoutes;
+	const walk = (node, path) => {
+		for (const [key, value] of Object.entries(node)) {
+			if (key.startsWith("_")) continue;
+			if (!isRecord$1(value)) continue;
+			const leafMeta = extractLeafMeta(value);
+			if (leafMeta) {
+				if (path.length === 0) continue;
+				const namespace = path.join("/");
+				meta[namespace] ??= {};
+				meta[namespace][key] = leafMeta;
+				continue;
+			}
+			walk(value, [...path, key]);
+		}
+	};
+	walk(api, []);
+	metaCache.set(api, meta);
+	return meta;
+}
+/**
+* Get a function reference from the API object by traversing the path.
+*/
+function getFuncRef(api, path) {
+	let current = api;
+	for (const key of path) if (current && typeof current === "object") {
+		const next = current[key];
+		if (next === void 0) throw new Error(`Invalid path: ${path.join(".")}`);
+		current = next;
+	} else throw new Error(`Invalid path: ${path.join(".")}`);
+	if (current && typeof current === "object") {
+		const maybeFunctionRef = current.functionRef;
+		if (maybeFunctionRef && typeof maybeFunctionRef === "object") return maybeFunctionRef;
+	}
+	if (!current || typeof current !== "object") throw new Error(`Invalid function reference at path: ${path.join(".")}`);
+	return current;
+}
+/**
+* Get function type from meta using path.
+* Supports nested paths like ['items', 'queries', 'list'] → namespace='items/queries', fn='list'
+*
+* @param path - Path segments like ['todos', 'create'] or ['items', 'queries', 'list']
+* @param meta - The meta object from codegen
+* @returns Function type or 'query' as default
+*/
+function getFunctionType(path, source) {
+	if (path.length < 2) return "query";
+	const meta = buildMetaIndex(source);
+	const fnName = path.at(-1);
+	const fnType = meta[path.slice(0, -1).join("/")]?.[fnName]?.type;
+	if (fnType === "query" || fnType === "mutation" || fnType === "action") return fnType;
+	return "query";
+}
+/**
+* Get function metadata from meta using path.
+* Supports nested paths like ['items', 'queries', 'list'] → namespace='items/queries', fn='list'
+*
+* @param path - Path segments like ['todos', 'create'] or ['items', 'queries', 'list']
+* @param meta - The meta object from codegen
+* @returns Function metadata or undefined
+*/
+function getFunctionMeta(path, source) {
+	if (path.length < 2) return;
+	const meta = buildMetaIndex(source);
+	const fnName = path.at(-1);
+	return meta[path.slice(0, -1).join("/")]?.[fnName];
+}
+
 //#endregion
 //#region src/crpc/transformer.ts
 const isPlainObject = (value) => {
@@ -1155,10 +1159,12 @@ function useConvexMutationOptions(mutation, options, transformer) {
 	const name = getFunctionName(mutation);
 	const [namespace, fnName] = name.split(":");
 	const authType = getMeta(namespace, fnName)?.auth;
-	const convexMutation = useMutation(mutation);
+	const { optimisticUpdate, ...mutationOptions } = options ?? {};
+	const reactMutation = useMutation(mutation);
+	const convexMutation = optimisticUpdate ? reactMutation.withOptimisticUpdate(optimisticUpdate) : reactMutation;
 	const resolvedTransformer = getTransformer(transformer);
 	return {
-		...options,
+		...mutationOptions,
 		mutationFn: async (args) => {
 			if (authType === "required" && guard()) throw new CRPCClientError({
 				code: "UNAUTHORIZED",
@@ -1496,21 +1502,16 @@ function createCRPCContext(options) {
 				convexSiteUrl: httpOptions.convexSiteUrl,
 				routes: meta._http,
 				headers: async () => {
-					const token = authStore.get("token");
 					const expiresAt = authStore.get("expiresAt");
 					const timeRemaining = expiresAt ? expiresAt - Date.now() : 0;
-					if (token && expiresAt && timeRemaining >= 6e4) return {
-						...typeof httpOptions.headers === "function" ? await httpOptions.headers() : httpOptions.headers,
+					const heldToken = authStore.get("token");
+					const token = fetchAccessToken ? await fetchAccessToken({ forceRefreshToken: !!expiresAt && timeRemaining < 6e4 }) : heldToken && expiresAt && timeRemaining >= 6e4 ? heldToken : null;
+					const userHeaders = typeof httpOptions.headers === "function" ? await httpOptions.headers() : httpOptions.headers;
+					const admit = () => !!token && admitStoreToken(authStore, token, { use: "handout" });
+					return admit() ? withAuthorizationRecheck({
+						...userHeaders,
 						Authorization: `Bearer ${token}`
-					};
-					if (fetchAccessToken) {
-						const newToken = await fetchAccessToken({ forceRefreshToken: !!expiresAt });
-						if (newToken) return {
-							...typeof httpOptions.headers === "function" ? await httpOptions.headers() : httpOptions.headers,
-							Authorization: `Bearer ${newToken}`
-						};
-					}
-					return { ...typeof httpOptions.headers === "function" ? await httpOptions.headers() : httpOptions.headers };
+					}, admit) : { ...userHeaders };
 				},
 				fetch: httpOptions.fetch,
 				onError: httpOptions.onError,
@@ -1643,10 +1644,19 @@ function isAuthMutationError(error) {
 
 //#endregion
 //#region src/react/auth-mutations.ts
-/** Poll until JWT token exists (auth complete) (max 5s) */
+const tokenIdentityChangedError = () => new AuthMutationError({
+	code: "TOKEN_IDENTITY_CHANGED",
+	message: "This page switched accounts. Reload it to sign in.",
+	status: 401,
+	statusText: "UNAUTHORIZED"
+});
+const assertDocumentNotTripped = () => {
+	if (isDocumentTripped()) throw tokenIdentityChangedError();
+};
 const waitForAuth = async (store, timeout = 5e3) => {
 	const start = Date.now();
 	while (Date.now() - start < timeout) {
+		assertDocumentNotTripped();
 		if (store.get("token")) return true;
 		await new Promise((r) => setTimeout(r, 50));
 	}
@@ -1671,9 +1681,10 @@ const readReturnedToken = (value) => {
 const seedReturnedToken = (store, value) => {
 	const token = readReturnedToken(value);
 	if (!token) return;
-	store.set("token", token);
-	store.set("expiresAt", decodeJwtExp(token));
-	store.set("sessionSyncGraceUntil", Date.now() + AUTH_SESSION_SYNC_GRACE_MS);
+	if (!publishToken(store, token, {
+		announce: true,
+		sessionSyncGraceUntil: Date.now() + AUTH_SESSION_SYNC_GRACE_MS
+	})) throw tokenIdentityChangedError();
 	if (decodeJwtExp(token) === null) writeAuthSessionFallbackToken(token);
 };
 const toAuthMutationError = (error) => new AuthMutationError({
@@ -1748,12 +1759,13 @@ function createAuthMutations(authClient) {
 			mutationFn: async (args) => {
 				const signInSocial = authClient.signIn?.social;
 				if (typeof signInSocial !== "function") throw new Error("Auth client does not expose signIn.social");
+				assertDocumentNotTripped();
 				const res = await callAuthMethod(signInSocial, withDisabledSessionSignal(args));
 				if (res?.error) throw toAuthMutationError(res.error);
 				seedReturnedToken(authStoreApi, res);
 				await hydrateReturnedSession(authClient, res);
 				await ensureAuth(authStoreApi);
-				authStoreApi.set("isAuthenticated", true);
+				if (!publishAuthenticated(authStoreApi)) throw tokenIdentityChangedError();
 				return res;
 			}
 		};
@@ -1766,12 +1778,13 @@ function createAuthMutations(authClient) {
 			mutationFn: async (args) => {
 				const signIn = authClient.signIn?.[signInMethod];
 				if (typeof signIn !== "function") throw new Error(`Auth client does not expose signIn.${signInMethod}`);
+				assertDocumentNotTripped();
 				const res = await callAuthMethod(signIn, withDisabledSessionSignal(args));
 				if (res?.error) throw toAuthMutationError(res.error);
 				seedReturnedToken(authStoreApi, res);
 				await hydrateReturnedSession(authClient, res);
 				await ensureAuth(authStoreApi);
-				authStoreApi.set("isAuthenticated", true);
+				if (!publishAuthenticated(authStoreApi)) throw tokenIdentityChangedError();
 				return res;
 			}
 		};
@@ -1783,12 +1796,13 @@ function createAuthMutations(authClient) {
 			mutationFn: async (args) => {
 				const signUpEmail = authClient.signUp?.email;
 				if (typeof signUpEmail !== "function") throw new Error("Auth client does not expose signUp.email");
+				assertDocumentNotTripped();
 				const res = await callAuthMethod(signUpEmail, withDisabledSessionSignal(args));
 				if (res?.error) throw toAuthMutationError(res.error);
 				seedReturnedToken(authStoreApi, res);
 				await hydrateReturnedSession(authClient, res);
 				await ensureAuth(authStoreApi);
-				authStoreApi.set("isAuthenticated", true);
+				if (!publishAuthenticated(authStoreApi)) throw tokenIdentityChangedError();
 				return res;
 			}
 		};
@@ -2105,7 +2119,10 @@ var ConvexQueryClient = class {
 			this._queryClient = options.queryClient;
 			this.unsubscribe = this.subscribeInner(options.queryClient.getQueryCache());
 		}
-		if (isServer) this.serverHttpClient = new ConvexHttpClient(this.convexClient.url, { fetch: options.serverFetch });
+		if (isServer) this.serverHttpClient = new ConvexHttpClient(this.convexClient.url, {
+			fetch: options.serverFetch,
+			logger: this.convexClient.logger
+		});
 	}
 	/**
 	* Connect to TanStack QueryClient.

package/dist/rsc/index.d.ts

@@ -1,8 +1,10 @@
 import { n as DeepPartial, o as Simplify, r as DistributiveOmit } from "../types-Bqi_ivSd.js";
 import { L as DataTransformerOptions, _ as CRPCHttpRouter, c as HttpQueryKey, k as HttpProcedure, o as HttpMutationKey, y as HttpRouterRecord } from "../http-types-BhhPZtwa.js";
 import { g as UnsetMarker } from "../types-Bkeicpo6.js";
-import { A as HttpInputArgs, C as ReservedMutationOptions$1, S as ReservedInfiniteQueryOptions, T as StaticQueryOptsParam, _ as IsPaginated, b as PaginatedFnMeta, c as ConvexMutationKey, d as ConvexQueryMeta, f as EmptyObject, g as InfiniteQueryInput, l as ConvexQueryHookOptions, m as FUNC_REF_SYMBOL, o as ConvexActionKey, p as ExtractPaginatedItem, s as ConvexInfiniteQueryMeta, u as ConvexQueryKey, w as ReservedQueryOptions$1, y as MutationVariables } from "../types-C7JkpfeY.js";
+import { A as HttpInputArgs, C as ReservedMutationOptions$1, S as ReservedInfiniteQueryOptions, T as StaticQueryOptsParam, _ as IsPaginated, b as PaginatedFnMeta, c as ConvexMutationKey, d as ConvexQueryMeta, f as EmptyObject, g as InfiniteQueryInput, l as ConvexQueryHookOptions, m as FUNC_REF_SYMBOL, o as ConvexActionKey, p as ExtractPaginatedItem, s as ConvexInfiniteQueryMeta, u as ConvexQueryKey, w as ReservedQueryOptions$1, y as MutationVariables } from "../types-Bb0kwteA.js";
+import { Value } from "convex/values";
 import { FunctionArgs, FunctionReference, FunctionReturnType } from "convex/server";
+import { OptimisticUpdate } from "convex/browser";
 import { z } from "zod";
 import { DefaultError, QueryFilters, SkipToken, UseMutationOptions, UseQueryOptions } from "@tanstack/react-query";
 
@@ -70,11 +72,19 @@ type DecorateInfiniteQuery<T extends FunctionReference<'query'>> = {
   infiniteQueryKey: (args?: DeepPartial<InfiniteQueryInput<FunctionArgs<T>>>) => ConvexQueryKey<T>; /** Function metadata from server (auth, limit, rateLimit, role, type) */
   meta: PaginatedFnMeta;
 };
+/**
+ * Convex-native optimistic update for a cRPC mutation. It edits Convex's local
+ * query store, which the query client reads, so Convex rolls it back when the
+ * mutation fails. Args and query values are in their wire shape.
+ */
+type ConvexOptimisticUpdateOption<Args extends Record<string, Value>> = {
+  optimisticUpdate?: OptimisticUpdate<Args>;
+};
 /**
  * Decorated mutation procedure with mutationOptions and mutationKey methods.
  */
 type DecorateMutation<T extends FunctionReference<'mutation'>> = {
-  mutationOptions: (opts?: DistributiveOmit<UseMutationOptions<FunctionReturnType<T>, DefaultError, MutationVariables<T>>, ReservedMutationOptions$1>) => UseMutationOptions<FunctionReturnType<T>, DefaultError, MutationVariables<T>>; /** Get mutation key for QueryClient methods */
+  mutationOptions: (opts?: DistributiveOmit<UseMutationOptions<FunctionReturnType<T>, DefaultError, MutationVariables<T>>, ReservedMutationOptions$1> & ConvexOptimisticUpdateOption<FunctionArgs<T>>) => UseMutationOptions<FunctionReturnType<T>, DefaultError, MutationVariables<T>>; /** Get mutation key for QueryClient methods */
   mutationKey: () => ConvexMutationKey;
 };
 /**

package/dist/rsc/index.js

@@ -1,7 +1,7 @@
 import { n as defaultIsUnauthorized } from "../error-CLgc9khF.js";
 import { n as getFuncRef, r as getFunctionMeta, t as buildMetaIndex } from "../meta-utils-Cc7neQOB.js";
 import { o as encodeWire, s as getTransformer } from "../transformer-C8lVwHNT.js";
-import { c as HTTP_DEFAULT_STALE_TIME, n as convexInfiniteQueryOptions, o as executeHttpRequest, r as convexQuery, u as buildHttpQueryKey } from "../query-options-DGG93--5.js";
+import { f as buildHttpQueryKey, n as convexInfiniteQueryOptions, r as convexQuery, s as executeHttpRequest, u as HTTP_DEFAULT_STALE_TIME } from "../query-options-YkFvau71.js";
 import { convexToJson } from "convex/values";
 import { getFunctionName } from "convex/server";
 import { fetchAction, fetchQuery } from "convex/nextjs";

package/dist/solid/index.js

@@ -525,6 +525,7 @@ function buildSearchParams(query) {
 	else if (value !== void 0 && value !== null) params.append(key, value);
 	return params;
 }
+const RECHECK_AUTHORIZATION = Symbol.for("kitcn.http.recheckAuthorization");
 /**
 * Hono-style HTTP request executor.
 * Processes args in the same way as Hono's ClientRequestImpl.fetch().
@@ -563,6 +564,8 @@ async function executeHttpRequest(opts) {
 		for (const [key, value] of Object.entries(resolvedBaseHeaders)) if (value !== void 0) finalHeaders[key] = value;
 	}
 	Object.assign(finalHeaders, headerValues);
+	const recheck = resolvedBaseHeaders?.[RECHECK_AUTHORIZATION];
+	const sendHeaders = recheck && finalHeaders.Authorization === resolvedBaseHeaders?.Authorization && !recheck() ? Object.fromEntries(Object.entries(finalHeaders).filter(([key]) => key !== "Authorization")) : finalHeaders;
 	let url = opts.convexSiteUrl + path;
 	if (args.params) url = opts.convexSiteUrl + replaceUrlParam(path, args.params);
 	if (args.searchParams) {
@@ -574,7 +577,7 @@ async function executeHttpRequest(opts) {
 	const response = await (mergedClientOpts.fetch ?? opts.baseFetch ?? globalThis.fetch)(url, {
 		body: setBody ? rBody : void 0,
 		method: methodUpperCase,
-		headers: finalHeaders,
+		headers: sendHeaders,
 		...mergedClientOpts.init
 	});
 	if (!response.ok) {

package/dist/{auth-store-x3_wvhTR.js → token-gate-CEzbXArg.js}

@@ -470,4 +470,181 @@ function Unauthenticated({ children }) {
 }
 
 //#endregion
-export { CRPCClientError as A, decodeJwtExp as C, readAuthSessionFallbackToken as D, readAuthSessionFallbackData as E, isCRPCClientError as M, writeAuthSessionFallbackData as O, useSafeConvexAuth as S, clearAuthSessionFallback as T, useConvexAuthBridge as _, ConvexAuthRecoveryError as a, useIsAuth as b, MaybeAuthenticated as c, isSessionSyncGraceActive as d, useAuth as f, useAuthValue as g, useAuthStore as h, ConvexAuthBridge as i, defaultIsUnauthorized as j, writeAuthSessionFallbackToken as k, MaybeUnauthenticated as l, useAuthState as m, AuthProvider as n, ConvexProviderWithAuth$1 as o, useAuthGuard as p, Authenticated as r, FetchAccessTokenContext as s, AUTH_SESSION_SYNC_GRACE_MS as t, Unauthenticated as u, useConvexAuthRecovery as v, decodeJwtIdentity as w, useMaybeAuth as x, useFetchAccessToken as y };
+//#region src/react/identity-guard-registry.ts
+const REGISTRY_KEY = Symbol.for("kitcn.identityGuard.v2");
+const createRegistry = () => ({
+	documentIdentity: null,
+	guards: /* @__PURE__ */ new Set(),
+	settledClients: /* @__PURE__ */ new WeakSet(),
+	settlementListeners: /* @__PURE__ */ new WeakMap(),
+	storeGuards: /* @__PURE__ */ new WeakMap(),
+	tripListeners: /* @__PURE__ */ new Set(),
+	tripped: false,
+	watchedClients: /* @__PURE__ */ new WeakSet()
+});
+const isRegistry = (value) => {
+	const candidate = value;
+	return typeof candidate === "object" && candidate !== null && typeof candidate.tripped === "boolean" && (candidate.documentIdentity === null || typeof candidate.documentIdentity === "string") && candidate.tripListeners instanceof Set && candidate.guards instanceof Set && candidate.storeGuards instanceof WeakMap && candidate.settledClients instanceof WeakSet && candidate.settlementListeners instanceof WeakMap && candidate.watchedClients instanceof WeakSet;
+};
+let incompatibleStandIn;
+const pageRegistry = () => {
+	if (typeof window === "undefined") return null;
+	const scope = globalThis;
+	scope[REGISTRY_KEY] ??= createRegistry();
+	const found = scope[REGISTRY_KEY];
+	if (isRegistry(found)) return found;
+	if (!incompatibleStandIn) {
+		console.warn("[kitcn] identity guard state of another kitcn revision is on this page; guarded providers hand out no token until the page reloads.");
+		incompatibleStandIn = {
+			...createRegistry(),
+			incompatible: true
+		};
+	}
+	return incompatibleStandIn;
+};
+const isDocumentTripped = () => pageRegistry()?.tripped ?? false;
+const tripDocument = () => {
+	const registry = pageRegistry();
+	if (!registry || registry.tripped) return;
+	registry.tripped = true;
+	for (const listener of [...registry.tripListeners]) try {
+		listener();
+	} catch (error) {
+		console.error("[kitcn] identity guard trip listener threw", error);
+	}
+};
+const subscribeDocumentTrip = (listener) => {
+	const registry = pageRegistry();
+	if (!registry) return () => {};
+	registry.tripListeners.add(listener);
+	return () => {
+		registry.tripListeners.delete(listener);
+	};
+};
+const attachStoreGuard = (store, guard) => {
+	if (store) pageRegistry()?.storeGuards.set(store, guard);
+};
+const storeGuard = (store) => store ? pageRegistry()?.storeGuards.get(store) : void 0;
+const mountGuard = (guard) => {
+	const registry = pageRegistry();
+	if (!registry) return () => {};
+	registry.guards.add(guard);
+	joinPage(guard);
+	return () => {
+		registry.guards.delete(guard);
+	};
+};
+const joinPage = (guard) => {
+	const registry = pageRegistry();
+	if (!registry) return;
+	if (guard.guarded && guard.identity) registry.documentIdentity ??= guard.identity;
+	for (const mounted of [...registry.guards]) {
+		const held = mounted.heldToken();
+		if (held && isJwt(held) && !isTokenAdmissible(held, mounted, "hold")) {
+			tripDocument();
+			break;
+		}
+	}
+};
+const guardedProviderMounted = () => [...pageRegistry()?.guards ?? []].some((mounted) => mounted.guarded);
+const boundIdentities = (guard) => {
+	const registry = pageRegistry();
+	const bound = [registry?.documentIdentity ?? null];
+	if (guard?.guarded) bound.push(guard.identity, guard.baseline());
+	for (const mounted of registry?.guards ?? []) if (mounted.hasGetter) bound.push(mounted.baseline());
+	return bound.filter((identity) => identity !== null);
+};
+const identityGuardInPlay = (guard) => !!guard?.guarded || boundIdentities(guard).length > 0 || guardedProviderMounted();
+const isTokenAdmissible = (token, guard, use) => {
+	if (isDocumentTripped() || guard?.tripped) return false;
+	if (guard?.guarded && pageRegistry()?.incompatible) return false;
+	const bound = boundIdentities(guard);
+	if (!isJwt(token)) {
+		if (use === "hold") return true;
+		if (use === "restore") return bound.length === 0;
+		return !identityGuardInPlay(guard);
+	}
+	const identity = decodeTokenSubjectSessionIdentity(token);
+	return identity === null ? bound.length === 0 : bound.every((known) => known === identity);
+};
+const admitToken = (token, { announce = false, guard, use }) => {
+	if (!isTokenAdmissible(token, guard, use)) {
+		if (isJwt(token)) {
+			if (guard) guard.tripped = true;
+			tripDocument();
+		}
+		return false;
+	}
+	const identity = isJwt(token) ? decodeTokenSubjectSessionIdentity(token) : null;
+	if (identity !== null && (guard?.guarded || guardedProviderMounted())) {
+		if (guard?.guarded) guard.identity = identity;
+		const registry = pageRegistry();
+		if (registry) registry.documentIdentity ??= identity;
+	}
+	if (announce && guard?.guarded && isJwt(token)) {
+		guard.onAdmitted(token);
+		return admitToken(token, {
+			guard,
+			use
+		});
+	}
+	return !isDocumentTripped() && !guard?.tripped;
+};
+function decodeJwtClaims(token) {
+	const segments = token.split(".");
+	if (segments.length !== 3 || !segments[1]) return null;
+	try {
+		const payload = JSON.parse(atob(segments[1].replaceAll("-", "+").replaceAll("_", "/")));
+		return typeof payload === "object" && payload !== null && !Array.isArray(payload) ? payload : null;
+	} catch {
+		return null;
+	}
+}
+const isJwt = (token) => decodeJwtClaims(token) !== null;
+/**
+* The user and session a Better Auth Convex JWT speaks for (`sub` and
+* `sessionId`), or null. Other claims (name, email, updatedAt) may change
+* within one session and do not count.
+*/
+function decodeTokenSubjectSessionIdentity(token) {
+	const claims = token ? decodeJwtClaims(token) : null;
+	if (!claims || typeof claims.sub !== "string") return null;
+	const sessionId = typeof claims.sessionId === "string" ? claims.sessionId : "";
+	return `${claims.sub}|${sessionId}`;
+}
+
+//#endregion
+//#region src/react/token-gate.ts
+const admitStoreToken = (authStore, token, options) => admitToken(token, {
+	...options,
+	guard: storeGuard(authStore.store)
+});
+const publishToken = (authStore, token, { announce, sessionSyncGraceUntil, use = "hold" }) => {
+	if (!admitStoreToken(authStore, token, {
+		announce,
+		use
+	})) return false;
+	authStore.set("token", token);
+	authStore.set("expiresAt", decodeJwtExp(token));
+	if (sessionSyncGraceUntil !== void 0) authStore.set("sessionSyncGraceUntil", sessionSyncGraceUntil);
+	return true;
+};
+const publishAuthenticated = (authStore) => {
+	const token = authStore.get("token");
+	if (isDocumentTripped() || token && !admitStoreToken(authStore, token, { use: "hold" })) return false;
+	authStore.set("isAuthenticated", true);
+	return true;
+};
+const publishAuthState = (authStore, state) => {
+	const tripped = isDocumentTripped();
+	authStore.set("isLoading", tripped ? false : state.isLoading);
+	if (!state.isAuthenticated || tripped) {
+		authStore.set("isAuthenticated", false);
+		return;
+	}
+	const token = authStore.get("token");
+	authStore.set("isAuthenticated", !isDocumentTripped() && !(token && !admitStoreToken(authStore, token, { use: "hold" })));
+};
+
+//#endregion
+export { useAuthState as A, decodeJwtIdentity as B, FetchAccessTokenContext as C, isSessionSyncGraceActive as D, Unauthenticated as E, useFetchAccessToken as F, writeAuthSessionFallbackToken as G, readAuthSessionFallbackData as H, useIsAuth as I, isCRPCClientError as J, CRPCClientError as K, useMaybeAuth as L, useAuthValue as M, useConvexAuthBridge as N, useAuth as O, useConvexAuthRecovery as P, useSafeConvexAuth as R, ConvexProviderWithAuth$1 as S, MaybeUnauthenticated as T, readAuthSessionFallbackToken as U, clearAuthSessionFallback as V, writeAuthSessionFallbackData as W, AUTH_SESSION_SYNC_GRACE_MS as _, admitToken as a, ConvexAuthBridge as b, identityGuardInPlay as c, isTokenAdmissible as d, joinPage as f, tripDocument as g, subscribeDocumentTrip as h, publishToken as i, useAuthStore as j, useAuthGuard as k, isDocumentTripped as l, pageRegistry as m, publishAuthState as n, attachStoreGuard as o, mountGuard as p, defaultIsUnauthorized as q, publishAuthenticated as r, decodeTokenSubjectSessionIdentity as s, admitStoreToken as t, isJwt as u, AuthProvider as v, MaybeAuthenticated as w, ConvexAuthRecoveryError as x, Authenticated as y, decodeJwtExp as z };