kitcn 0.33.6 → 0.33.8

package/dist/react/index.js

@@ -1,5 +1,5 @@
 'use client';
-import { A as CRPCClientError, C as decodeJwtExp, M as isCRPCClientError, O as writeAuthSessionFallbackData, S as useSafeConvexAuth, T as clearAuthSessionFallback, _ as useConvexAuthBridge, a as ConvexAuthRecoveryError, b as useIsAuth, c as MaybeAuthenticated, d as isSessionSyncGraceActive, f as useAuth, g as useAuthValue, h as useAuthStore, i as ConvexAuthBridge, j as defaultIsUnauthorized, k as writeAuthSessionFallbackToken, l as MaybeUnauthenticated, m as useAuthState, n as AuthProvider, o as ConvexProviderWithAuth, p as useAuthGuard, r as Authenticated, s as FetchAccessTokenContext, t as AUTH_SESSION_SYNC_GRACE_MS, u as Unauthenticated, v as useConvexAuthRecovery, w as decodeJwtIdentity, x as useMaybeAuth, y as useFetchAccessToken } from "../auth-store-x3_wvhTR.js";
+import { A as useAuthState, B as decodeJwtIdentity, C as FetchAccessTokenContext, D as isSessionSyncGraceActive, E as Unauthenticated, F as useFetchAccessToken, G as writeAuthSessionFallbackToken, I as useIsAuth, J as isCRPCClientError, K as CRPCClientError, L as useMaybeAuth, M as useAuthValue, N as useConvexAuthBridge, O as useAuth, P as useConvexAuthRecovery, R as useSafeConvexAuth, S as ConvexProviderWithAuth, T as MaybeUnauthenticated, V as clearAuthSessionFallback, W as writeAuthSessionFallbackData, _ as AUTH_SESSION_SYNC_GRACE_MS, b as ConvexAuthBridge, i as publishToken, j as useAuthStore, k as useAuthGuard, l as isDocumentTripped, q as defaultIsUnauthorized, r as publishAuthenticated, t as admitStoreToken, v as AuthProvider, w as MaybeAuthenticated, x as ConvexAuthRecoveryError, y as Authenticated, z as decodeJwtExp } from "../token-gate-CEzbXArg.js";
 import { ConvexProvider, ConvexReactClient, ConvexReactClient as ConvexReactClient$1, useAction, useConvex, useMutation } from "convex/react";
 import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState } from "react";
 import { jsx } from "react/jsx-runtime";
@@ -9,122 +9,6 @@ import { hashKey } from "@tanstack/query-core";
 import { convexToJson } from "convex/values";
 import { ConvexHttpClient } from "convex/browser";
 
-//#region src/shared/meta-utils.ts
-const metaCache = /* @__PURE__ */ new WeakMap();
-const nonMetaLeafKeys = new Set(["functionRef", "ref"]);
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null;
-}
-function isFunctionType(value) {
-	return value === "query" || value === "mutation" || value === "action";
-}
-function isMetaScalar(value) {
-	return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
-}
-function extractLeafMeta(value) {
-	const type = value.type;
-	if (!isFunctionType(type)) return;
-	const result = { type };
-	for (const [key, entry] of Object.entries(value)) {
-		if (key === "type" || nonMetaLeafKeys.has(key) || key.startsWith("_")) continue;
-		if (entry === void 0) continue;
-		if (isMetaScalar(entry)) result[key] = entry;
-	}
-	return result;
-}
-function getHttpRoutes(api) {
-	const routes = api._http;
-	if (!isRecord$1(routes)) return;
-	const normalized = {};
-	for (const [routeKey, routeValue] of Object.entries(routes)) {
-		if (!isRecord$1(routeValue)) continue;
-		const routePath = routeValue.path;
-		const routeMethod = routeValue.method;
-		if (typeof routePath === "string" && typeof routeMethod === "string") normalized[routeKey] = {
-			path: routePath,
-			method: routeMethod
-		};
-	}
-	return normalized;
-}
-/**
-* Build a metadata index from merged API leaves.
-* Supports both generated `api` objects and plain metadata fixtures.
-*/
-function buildMetaIndex(api) {
-	const cached = metaCache.get(api);
-	if (cached) return cached;
-	const meta = {};
-	const httpRoutes = getHttpRoutes(api);
-	if (httpRoutes) meta._http = httpRoutes;
-	const walk = (node, path) => {
-		for (const [key, value] of Object.entries(node)) {
-			if (key.startsWith("_")) continue;
-			if (!isRecord$1(value)) continue;
-			const leafMeta = extractLeafMeta(value);
-			if (leafMeta) {
-				if (path.length === 0) continue;
-				const namespace = path.join("/");
-				meta[namespace] ??= {};
-				meta[namespace][key] = leafMeta;
-				continue;
-			}
-			walk(value, [...path, key]);
-		}
-	};
-	walk(api, []);
-	metaCache.set(api, meta);
-	return meta;
-}
-/**
-* Get a function reference from the API object by traversing the path.
-*/
-function getFuncRef(api, path) {
-	let current = api;
-	for (const key of path) if (current && typeof current === "object") {
-		const next = current[key];
-		if (next === void 0) throw new Error(`Invalid path: ${path.join(".")}`);
-		current = next;
-	} else throw new Error(`Invalid path: ${path.join(".")}`);
-	if (current && typeof current === "object") {
-		const maybeFunctionRef = current.functionRef;
-		if (maybeFunctionRef && typeof maybeFunctionRef === "object") return maybeFunctionRef;
-	}
-	if (!current || typeof current !== "object") throw new Error(`Invalid function reference at path: ${path.join(".")}`);
-	return current;
-}
-/**
-* Get function type from meta using path.
-* Supports nested paths like ['items', 'queries', 'list'] → namespace='items/queries', fn='list'
-*
-* @param path - Path segments like ['todos', 'create'] or ['items', 'queries', 'list']
-* @param meta - The meta object from codegen
-* @returns Function type or 'query' as default
-*/
-function getFunctionType(path, source) {
-	if (path.length < 2) return "query";
-	const meta = buildMetaIndex(source);
-	const fnName = path.at(-1);
-	const fnType = meta[path.slice(0, -1).join("/")]?.[fnName]?.type;
-	if (fnType === "query" || fnType === "mutation" || fnType === "action") return fnType;
-	return "query";
-}
-/**
-* Get function metadata from meta using path.
-* Supports nested paths like ['items', 'queries', 'list'] → namespace='items/queries', fn='list'
-*
-* @param path - Path segments like ['todos', 'create'] or ['items', 'queries', 'list']
-* @param meta - The meta object from codegen
-* @returns Function metadata or undefined
-*/
-function getFunctionMeta(path, source) {
-	if (path.length < 2) return;
-	const meta = buildMetaIndex(source);
-	const fnName = path.at(-1);
-	return meta[path.slice(0, -1).join("/")]?.[fnName];
-}
-
-//#endregion
 //#region src/crpc/http-types.ts
 /**
 * Build the exact cache key for an HTTP route.
@@ -209,6 +93,8 @@ function buildSearchParams(query) {
 	else if (value !== void 0 && value !== null) params.append(key, value);
 	return params;
 }
+const RECHECK_AUTHORIZATION = Symbol.for("kitcn.http.recheckAuthorization");
+const withAuthorizationRecheck = (headers, recheck) => Object.defineProperty(headers, RECHECK_AUTHORIZATION, { value: recheck });
 /**
 * Hono-style HTTP request executor.
 * Processes args in the same way as Hono's ClientRequestImpl.fetch().
@@ -247,6 +133,8 @@ async function executeHttpRequest(opts) {
 		for (const [key, value] of Object.entries(resolvedBaseHeaders)) if (value !== void 0) finalHeaders[key] = value;
 	}
 	Object.assign(finalHeaders, headerValues);
+	const recheck = resolvedBaseHeaders?.[RECHECK_AUTHORIZATION];
+	const sendHeaders = recheck && finalHeaders.Authorization === resolvedBaseHeaders?.Authorization && !recheck() ? Object.fromEntries(Object.entries(finalHeaders).filter(([key]) => key !== "Authorization")) : finalHeaders;
 	let url = opts.convexSiteUrl + path;
 	if (args.params) url = opts.convexSiteUrl + replaceUrlParam(path, args.params);
 	if (args.searchParams) {
@@ -258,7 +146,7 @@ async function executeHttpRequest(opts) {
 	const response = await (mergedClientOpts.fetch ?? opts.baseFetch ?? globalThis.fetch)(url, {
 		body: setBody ? rBody : void 0,
 		method: methodUpperCase,
-		headers: finalHeaders,
+		headers: sendHeaders,
 		...mergedClientOpts.init
 	});
 	if (!response.ok) {
@@ -280,6 +168,122 @@ async function executeHttpRequest(opts) {
 	return response.text();
 }
 
+//#endregion
+//#region src/shared/meta-utils.ts
+const metaCache = /* @__PURE__ */ new WeakMap();
+const nonMetaLeafKeys = new Set(["functionRef", "ref"]);
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null;
+}
+function isFunctionType(value) {
+	return value === "query" || value === "mutation" || value === "action";
+}
+function isMetaScalar(value) {
+	return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function extractLeafMeta(value) {
+	const type = value.type;
+	if (!isFunctionType(type)) return;
+	const result = { type };
+	for (const [key, entry] of Object.entries(value)) {
+		if (key === "type" || nonMetaLeafKeys.has(key) || key.startsWith("_")) continue;
+		if (entry === void 0) continue;
+		if (isMetaScalar(entry)) result[key] = entry;
+	}
+	return result;
+}
+function getHttpRoutes(api) {
+	const routes = api._http;
+	if (!isRecord$1(routes)) return;
+	const normalized = {};
+	for (const [routeKey, routeValue] of Object.entries(routes)) {
+		if (!isRecord$1(routeValue)) continue;
+		const routePath = routeValue.path;
+		const routeMethod = routeValue.method;
+		if (typeof routePath === "string" && typeof routeMethod === "string") normalized[routeKey] = {
+			path: routePath,
+			method: routeMethod
+		};
+	}
+	return normalized;
+}
+/**
+* Build a metadata index from merged API leaves.
+* Supports both generated `api` objects and plain metadata fixtures.
+*/
+function buildMetaIndex(api) {
+	const cached = metaCache.get(api);
+	if (cached) return cached;
+	const meta = {};
+	const httpRoutes = getHttpRoutes(api);
+	if (httpRoutes) meta._http = httpRoutes;
+	const walk = (node, path) => {
+		for (const [key, value] of Object.entries(node)) {
+			if (key.startsWith("_")) continue;
+			if (!isRecord$1(value)) continue;
+			const leafMeta = extractLeafMeta(value);
+			if (leafMeta) {
+				if (path.length === 0) continue;
+				const namespace = path.join("/");
+				meta[namespace] ??= {};
+				meta[namespace][key] = leafMeta;
+				continue;
+			}
+			walk(value, [...path, key]);
+		}
+	};
+	walk(api, []);
+	metaCache.set(api, meta);
+	return meta;
+}
+/**
+* Get a function reference from the API object by traversing the path.
+*/
+function getFuncRef(api, path) {
+	let current = api;
+	for (const key of path) if (current && typeof current === "object") {
+		const next = current[key];
+		if (next === void 0) throw new Error(`Invalid path: ${path.join(".")}`);
+		current = next;
+	} else throw new Error(`Invalid path: ${path.join(".")}`);
+	if (current && typeof current === "object") {
+		const maybeFunctionRef = current.functionRef;
+		if (maybeFunctionRef && typeof maybeFunctionRef === "object") return maybeFunctionRef;
+	}
+	if (!current || typeof current !== "object") throw new Error(`Invalid function reference at path: ${path.join(".")}`);
+	return current;
+}
+/**
+* Get function type from meta using path.
+* Supports nested paths like ['items', 'queries', 'list'] → namespace='items/queries', fn='list'
+*
+* @param path - Path segments like ['todos', 'create'] or ['items', 'queries', 'list']
+* @param meta - The meta object from codegen
+* @returns Function type or 'query' as default
+*/
+function getFunctionType(path, source) {
+	if (path.length < 2) return "query";
+	const meta = buildMetaIndex(source);
+	const fnName = path.at(-1);
+	const fnType = meta[path.slice(0, -1).join("/")]?.[fnName]?.type;
+	if (fnType === "query" || fnType === "mutation" || fnType === "action") return fnType;
+	return "query";
+}
+/**
+* Get function metadata from meta using path.
+* Supports nested paths like ['items', 'queries', 'list'] → namespace='items/queries', fn='list'
+*
+* @param path - Path segments like ['todos', 'create'] or ['items', 'queries', 'list']
+* @param meta - The meta object from codegen
+* @returns Function metadata or undefined
+*/
+function getFunctionMeta(path, source) {
+	if (path.length < 2) return;
+	const meta = buildMetaIndex(source);
+	const fnName = path.at(-1);
+	return meta[path.slice(0, -1).join("/")]?.[fnName];
+}
+
 //#endregion
 //#region src/crpc/transformer.ts
 const isPlainObject = (value) => {
@@ -1498,24 +1502,16 @@ function createCRPCContext(options) {
 				convexSiteUrl: httpOptions.convexSiteUrl,
 				routes: meta._http,
 				headers: async () => {
-					if (fetchAccessToken) {
-						const expiresAt = authStore.get("expiresAt");
-						const timeRemaining = expiresAt ? expiresAt - Date.now() : 0;
-						const guardedToken = await fetchAccessToken({ forceRefreshToken: !!expiresAt && timeRemaining < 6e4 });
-						const userHeaders = typeof httpOptions.headers === "function" ? await httpOptions.headers() : httpOptions.headers;
-						return guardedToken ? {
-							...userHeaders,
-							Authorization: `Bearer ${guardedToken}`
-						} : { ...userHeaders };
-					}
-					const token = authStore.get("token");
 					const expiresAt = authStore.get("expiresAt");
 					const timeRemaining = expiresAt ? expiresAt - Date.now() : 0;
-					if (token && expiresAt && timeRemaining >= 6e4) return {
-						...typeof httpOptions.headers === "function" ? await httpOptions.headers() : httpOptions.headers,
+					const heldToken = authStore.get("token");
+					const token = fetchAccessToken ? await fetchAccessToken({ forceRefreshToken: !!expiresAt && timeRemaining < 6e4 }) : heldToken && expiresAt && timeRemaining >= 6e4 ? heldToken : null;
+					const userHeaders = typeof httpOptions.headers === "function" ? await httpOptions.headers() : httpOptions.headers;
+					const admit = () => !!token && admitStoreToken(authStore, token, { use: "handout" });
+					return admit() ? withAuthorizationRecheck({
+						...userHeaders,
 						Authorization: `Bearer ${token}`
-					};
-					return { ...typeof httpOptions.headers === "function" ? await httpOptions.headers() : httpOptions.headers };
+					}, admit) : { ...userHeaders };
 				},
 				fetch: httpOptions.fetch,
 				onError: httpOptions.onError,
@@ -1648,10 +1644,19 @@ function isAuthMutationError(error) {
 
 //#endregion
 //#region src/react/auth-mutations.ts
-/** Poll until JWT token exists (auth complete) (max 5s) */
+const tokenIdentityChangedError = () => new AuthMutationError({
+	code: "TOKEN_IDENTITY_CHANGED",
+	message: "This page switched accounts. Reload it to sign in.",
+	status: 401,
+	statusText: "UNAUTHORIZED"
+});
+const assertDocumentNotTripped = () => {
+	if (isDocumentTripped()) throw tokenIdentityChangedError();
+};
 const waitForAuth = async (store, timeout = 5e3) => {
 	const start = Date.now();
 	while (Date.now() - start < timeout) {
+		assertDocumentNotTripped();
 		if (store.get("token")) return true;
 		await new Promise((r) => setTimeout(r, 50));
 	}
@@ -1676,9 +1681,10 @@ const readReturnedToken = (value) => {
 const seedReturnedToken = (store, value) => {
 	const token = readReturnedToken(value);
 	if (!token) return;
-	store.set("token", token);
-	store.set("expiresAt", decodeJwtExp(token));
-	store.set("sessionSyncGraceUntil", Date.now() + AUTH_SESSION_SYNC_GRACE_MS);
+	if (!publishToken(store, token, {
+		announce: true,
+		sessionSyncGraceUntil: Date.now() + AUTH_SESSION_SYNC_GRACE_MS
+	})) throw tokenIdentityChangedError();
 	if (decodeJwtExp(token) === null) writeAuthSessionFallbackToken(token);
 };
 const toAuthMutationError = (error) => new AuthMutationError({
@@ -1753,12 +1759,13 @@ function createAuthMutations(authClient) {
 			mutationFn: async (args) => {
 				const signInSocial = authClient.signIn?.social;
 				if (typeof signInSocial !== "function") throw new Error("Auth client does not expose signIn.social");
+				assertDocumentNotTripped();
 				const res = await callAuthMethod(signInSocial, withDisabledSessionSignal(args));
 				if (res?.error) throw toAuthMutationError(res.error);
 				seedReturnedToken(authStoreApi, res);
 				await hydrateReturnedSession(authClient, res);
 				await ensureAuth(authStoreApi);
-				authStoreApi.set("isAuthenticated", true);
+				if (!publishAuthenticated(authStoreApi)) throw tokenIdentityChangedError();
 				return res;
 			}
 		};
@@ -1771,12 +1778,13 @@ function createAuthMutations(authClient) {
 			mutationFn: async (args) => {
 				const signIn = authClient.signIn?.[signInMethod];
 				if (typeof signIn !== "function") throw new Error(`Auth client does not expose signIn.${signInMethod}`);
+				assertDocumentNotTripped();
 				const res = await callAuthMethod(signIn, withDisabledSessionSignal(args));
 				if (res?.error) throw toAuthMutationError(res.error);
 				seedReturnedToken(authStoreApi, res);
 				await hydrateReturnedSession(authClient, res);
 				await ensureAuth(authStoreApi);
-				authStoreApi.set("isAuthenticated", true);
+				if (!publishAuthenticated(authStoreApi)) throw tokenIdentityChangedError();
 				return res;
 			}
 		};
@@ -1788,12 +1796,13 @@ function createAuthMutations(authClient) {
 			mutationFn: async (args) => {
 				const signUpEmail = authClient.signUp?.email;
 				if (typeof signUpEmail !== "function") throw new Error("Auth client does not expose signUp.email");
+				assertDocumentNotTripped();
 				const res = await callAuthMethod(signUpEmail, withDisabledSessionSignal(args));
 				if (res?.error) throw toAuthMutationError(res.error);
 				seedReturnedToken(authStoreApi, res);
 				await hydrateReturnedSession(authClient, res);
 				await ensureAuth(authStoreApi);
-				authStoreApi.set("isAuthenticated", true);
+				if (!publishAuthenticated(authStoreApi)) throw tokenIdentityChangedError();
 				return res;
 			}
 		};

package/dist/rsc/index.d.ts

@@ -1,7 +1,7 @@
 import { n as DeepPartial, o as Simplify, r as DistributiveOmit } from "../types-Bqi_ivSd.js";
 import { L as DataTransformerOptions, _ as CRPCHttpRouter, c as HttpQueryKey, k as HttpProcedure, o as HttpMutationKey, y as HttpRouterRecord } from "../http-types-BhhPZtwa.js";
 import { g as UnsetMarker } from "../types-Bkeicpo6.js";
-import { A as HttpInputArgs, C as ReservedMutationOptions$1, S as ReservedInfiniteQueryOptions, T as StaticQueryOptsParam, _ as IsPaginated, b as PaginatedFnMeta, c as ConvexMutationKey, d as ConvexQueryMeta, f as EmptyObject, g as InfiniteQueryInput, l as ConvexQueryHookOptions, m as FUNC_REF_SYMBOL, o as ConvexActionKey, p as ExtractPaginatedItem, s as ConvexInfiniteQueryMeta, u as ConvexQueryKey, w as ReservedQueryOptions$1, y as MutationVariables } from "../types-C7JkpfeY.js";
+import { A as HttpInputArgs, C as ReservedMutationOptions$1, S as ReservedInfiniteQueryOptions, T as StaticQueryOptsParam, _ as IsPaginated, b as PaginatedFnMeta, c as ConvexMutationKey, d as ConvexQueryMeta, f as EmptyObject, g as InfiniteQueryInput, l as ConvexQueryHookOptions, m as FUNC_REF_SYMBOL, o as ConvexActionKey, p as ExtractPaginatedItem, s as ConvexInfiniteQueryMeta, u as ConvexQueryKey, w as ReservedQueryOptions$1, y as MutationVariables } from "../types-Bb0kwteA.js";
 import { Value } from "convex/values";
 import { FunctionArgs, FunctionReference, FunctionReturnType } from "convex/server";
 import { OptimisticUpdate } from "convex/browser";

package/dist/rsc/index.js

@@ -1,7 +1,7 @@
 import { n as defaultIsUnauthorized } from "../error-CLgc9khF.js";
 import { n as getFuncRef, r as getFunctionMeta, t as buildMetaIndex } from "../meta-utils-Cc7neQOB.js";
 import { o as encodeWire, s as getTransformer } from "../transformer-C8lVwHNT.js";
-import { c as HTTP_DEFAULT_STALE_TIME, n as convexInfiniteQueryOptions, o as executeHttpRequest, r as convexQuery, u as buildHttpQueryKey } from "../query-options-DGG93--5.js";
+import { f as buildHttpQueryKey, n as convexInfiniteQueryOptions, r as convexQuery, s as executeHttpRequest, u as HTTP_DEFAULT_STALE_TIME } from "../query-options-YkFvau71.js";
 import { convexToJson } from "convex/values";
 import { getFunctionName } from "convex/server";
 import { fetchAction, fetchQuery } from "convex/nextjs";

package/dist/solid/index.js

@@ -525,6 +525,7 @@ function buildSearchParams(query) {
 	else if (value !== void 0 && value !== null) params.append(key, value);
 	return params;
 }
+const RECHECK_AUTHORIZATION = Symbol.for("kitcn.http.recheckAuthorization");
 /**
 * Hono-style HTTP request executor.
 * Processes args in the same way as Hono's ClientRequestImpl.fetch().
@@ -563,6 +564,8 @@ async function executeHttpRequest(opts) {
 		for (const [key, value] of Object.entries(resolvedBaseHeaders)) if (value !== void 0) finalHeaders[key] = value;
 	}
 	Object.assign(finalHeaders, headerValues);
+	const recheck = resolvedBaseHeaders?.[RECHECK_AUTHORIZATION];
+	const sendHeaders = recheck && finalHeaders.Authorization === resolvedBaseHeaders?.Authorization && !recheck() ? Object.fromEntries(Object.entries(finalHeaders).filter(([key]) => key !== "Authorization")) : finalHeaders;
 	let url = opts.convexSiteUrl + path;
 	if (args.params) url = opts.convexSiteUrl + replaceUrlParam(path, args.params);
 	if (args.searchParams) {
@@ -574,7 +577,7 @@ async function executeHttpRequest(opts) {
 	const response = await (mergedClientOpts.fetch ?? opts.baseFetch ?? globalThis.fetch)(url, {
 		body: setBody ? rBody : void 0,
 		method: methodUpperCase,
-		headers: finalHeaders,
+		headers: sendHeaders,
 		...mergedClientOpts.init
 	});
 	if (!response.ok) {

package/dist/{token-tlbNKQS0.d.ts → token-COZD00dG.d.ts}

@@ -6,7 +6,8 @@ type GetTokenOptions = {
   jwtCache?: {
     enabled: boolean;
     expirationToleranceSeconds?: number;
-    isAuthError: (error: unknown) => boolean;
+    isAuthError: (error: unknown) => boolean; /** Current Unix time in seconds. Defaults to the system clock. */
+    now?: () => number | Promise<number>;
   };
 };
 //#endregion

package/dist/{token-CgIvcEZX.js → token-CZbuEcTL.js}

@@ -32,14 +32,23 @@ const getToken = async (siteUrl, headers, opts) => {
 		cookiePrefix: opts?.cookiePrefix
 	});
 	if (!token) return await fetchToken();
+	let claims;
 	try {
-		if (!isTokenExpired(jose.decodeJwt(token)?.exp, opts?.jwtCache?.expirationToleranceSeconds ?? 60)) return {
-			isFresh: false,
-			token
-		};
+		claims = jose.decodeJwt(token);
 	} catch (error) {
 		console.error("Error decoding JWT", error);
+		return await fetchToken();
+	}
+	if (!claims.exp) return await fetchToken();
+	let now;
+	if (opts.jwtCache.now) {
+		now = await opts.jwtCache.now();
+		if (!Number.isFinite(now)) throw new RangeError("JWT cache now must return finite Unix time in seconds");
 	}
+	if (!isTokenExpired(claims.exp, opts.jwtCache.expirationToleranceSeconds ?? 60, now)) return {
+		isFresh: false,
+		token
+	};
 	return await fetchToken();
 };
 

package/dist/{auth-store-x3_wvhTR.js → token-gate-CEzbXArg.js}

@@ -470,4 +470,181 @@ function Unauthenticated({ children }) {
 }
 
 //#endregion
-export { CRPCClientError as A, decodeJwtExp as C, readAuthSessionFallbackToken as D, readAuthSessionFallbackData as E, isCRPCClientError as M, writeAuthSessionFallbackData as O, useSafeConvexAuth as S, clearAuthSessionFallback as T, useConvexAuthBridge as _, ConvexAuthRecoveryError as a, useIsAuth as b, MaybeAuthenticated as c, isSessionSyncGraceActive as d, useAuth as f, useAuthValue as g, useAuthStore as h, ConvexAuthBridge as i, defaultIsUnauthorized as j, writeAuthSessionFallbackToken as k, MaybeUnauthenticated as l, useAuthState as m, AuthProvider as n, ConvexProviderWithAuth$1 as o, useAuthGuard as p, Authenticated as r, FetchAccessTokenContext as s, AUTH_SESSION_SYNC_GRACE_MS as t, Unauthenticated as u, useConvexAuthRecovery as v, decodeJwtIdentity as w, useMaybeAuth as x, useFetchAccessToken as y };
+//#region src/react/identity-guard-registry.ts
+const REGISTRY_KEY = Symbol.for("kitcn.identityGuard.v2");
+const createRegistry = () => ({
+	documentIdentity: null,
+	guards: /* @__PURE__ */ new Set(),
+	settledClients: /* @__PURE__ */ new WeakSet(),
+	settlementListeners: /* @__PURE__ */ new WeakMap(),
+	storeGuards: /* @__PURE__ */ new WeakMap(),
+	tripListeners: /* @__PURE__ */ new Set(),
+	tripped: false,
+	watchedClients: /* @__PURE__ */ new WeakSet()
+});
+const isRegistry = (value) => {
+	const candidate = value;
+	return typeof candidate === "object" && candidate !== null && typeof candidate.tripped === "boolean" && (candidate.documentIdentity === null || typeof candidate.documentIdentity === "string") && candidate.tripListeners instanceof Set && candidate.guards instanceof Set && candidate.storeGuards instanceof WeakMap && candidate.settledClients instanceof WeakSet && candidate.settlementListeners instanceof WeakMap && candidate.watchedClients instanceof WeakSet;
+};
+let incompatibleStandIn;
+const pageRegistry = () => {
+	if (typeof window === "undefined") return null;
+	const scope = globalThis;
+	scope[REGISTRY_KEY] ??= createRegistry();
+	const found = scope[REGISTRY_KEY];
+	if (isRegistry(found)) return found;
+	if (!incompatibleStandIn) {
+		console.warn("[kitcn] identity guard state of another kitcn revision is on this page; guarded providers hand out no token until the page reloads.");
+		incompatibleStandIn = {
+			...createRegistry(),
+			incompatible: true
+		};
+	}
+	return incompatibleStandIn;
+};
+const isDocumentTripped = () => pageRegistry()?.tripped ?? false;
+const tripDocument = () => {
+	const registry = pageRegistry();
+	if (!registry || registry.tripped) return;
+	registry.tripped = true;
+	for (const listener of [...registry.tripListeners]) try {
+		listener();
+	} catch (error) {
+		console.error("[kitcn] identity guard trip listener threw", error);
+	}
+};
+const subscribeDocumentTrip = (listener) => {
+	const registry = pageRegistry();
+	if (!registry) return () => {};
+	registry.tripListeners.add(listener);
+	return () => {
+		registry.tripListeners.delete(listener);
+	};
+};
+const attachStoreGuard = (store, guard) => {
+	if (store) pageRegistry()?.storeGuards.set(store, guard);
+};
+const storeGuard = (store) => store ? pageRegistry()?.storeGuards.get(store) : void 0;
+const mountGuard = (guard) => {
+	const registry = pageRegistry();
+	if (!registry) return () => {};
+	registry.guards.add(guard);
+	joinPage(guard);
+	return () => {
+		registry.guards.delete(guard);
+	};
+};
+const joinPage = (guard) => {
+	const registry = pageRegistry();
+	if (!registry) return;
+	if (guard.guarded && guard.identity) registry.documentIdentity ??= guard.identity;
+	for (const mounted of [...registry.guards]) {
+		const held = mounted.heldToken();
+		if (held && isJwt(held) && !isTokenAdmissible(held, mounted, "hold")) {
+			tripDocument();
+			break;
+		}
+	}
+};
+const guardedProviderMounted = () => [...pageRegistry()?.guards ?? []].some((mounted) => mounted.guarded);
+const boundIdentities = (guard) => {
+	const registry = pageRegistry();
+	const bound = [registry?.documentIdentity ?? null];
+	if (guard?.guarded) bound.push(guard.identity, guard.baseline());
+	for (const mounted of registry?.guards ?? []) if (mounted.hasGetter) bound.push(mounted.baseline());
+	return bound.filter((identity) => identity !== null);
+};
+const identityGuardInPlay = (guard) => !!guard?.guarded || boundIdentities(guard).length > 0 || guardedProviderMounted();
+const isTokenAdmissible = (token, guard, use) => {
+	if (isDocumentTripped() || guard?.tripped) return false;
+	if (guard?.guarded && pageRegistry()?.incompatible) return false;
+	const bound = boundIdentities(guard);
+	if (!isJwt(token)) {
+		if (use === "hold") return true;
+		if (use === "restore") return bound.length === 0;
+		return !identityGuardInPlay(guard);
+	}
+	const identity = decodeTokenSubjectSessionIdentity(token);
+	return identity === null ? bound.length === 0 : bound.every((known) => known === identity);
+};
+const admitToken = (token, { announce = false, guard, use }) => {
+	if (!isTokenAdmissible(token, guard, use)) {
+		if (isJwt(token)) {
+			if (guard) guard.tripped = true;
+			tripDocument();
+		}
+		return false;
+	}
+	const identity = isJwt(token) ? decodeTokenSubjectSessionIdentity(token) : null;
+	if (identity !== null && (guard?.guarded || guardedProviderMounted())) {
+		if (guard?.guarded) guard.identity = identity;
+		const registry = pageRegistry();
+		if (registry) registry.documentIdentity ??= identity;
+	}
+	if (announce && guard?.guarded && isJwt(token)) {
+		guard.onAdmitted(token);
+		return admitToken(token, {
+			guard,
+			use
+		});
+	}
+	return !isDocumentTripped() && !guard?.tripped;
+};
+function decodeJwtClaims(token) {
+	const segments = token.split(".");
+	if (segments.length !== 3 || !segments[1]) return null;
+	try {
+		const payload = JSON.parse(atob(segments[1].replaceAll("-", "+").replaceAll("_", "/")));
+		return typeof payload === "object" && payload !== null && !Array.isArray(payload) ? payload : null;
+	} catch {
+		return null;
+	}
+}
+const isJwt = (token) => decodeJwtClaims(token) !== null;
+/**
+* The user and session a Better Auth Convex JWT speaks for (`sub` and
+* `sessionId`), or null. Other claims (name, email, updatedAt) may change
+* within one session and do not count.
+*/
+function decodeTokenSubjectSessionIdentity(token) {
+	const claims = token ? decodeJwtClaims(token) : null;
+	if (!claims || typeof claims.sub !== "string") return null;
+	const sessionId = typeof claims.sessionId === "string" ? claims.sessionId : "";
+	return `${claims.sub}|${sessionId}`;
+}
+
+//#endregion
+//#region src/react/token-gate.ts
+const admitStoreToken = (authStore, token, options) => admitToken(token, {
+	...options,
+	guard: storeGuard(authStore.store)
+});
+const publishToken = (authStore, token, { announce, sessionSyncGraceUntil, use = "hold" }) => {
+	if (!admitStoreToken(authStore, token, {
+		announce,
+		use
+	})) return false;
+	authStore.set("token", token);
+	authStore.set("expiresAt", decodeJwtExp(token));
+	if (sessionSyncGraceUntil !== void 0) authStore.set("sessionSyncGraceUntil", sessionSyncGraceUntil);
+	return true;
+};
+const publishAuthenticated = (authStore) => {
+	const token = authStore.get("token");
+	if (isDocumentTripped() || token && !admitStoreToken(authStore, token, { use: "hold" })) return false;
+	authStore.set("isAuthenticated", true);
+	return true;
+};
+const publishAuthState = (authStore, state) => {
+	const tripped = isDocumentTripped();
+	authStore.set("isLoading", tripped ? false : state.isLoading);
+	if (!state.isAuthenticated || tripped) {
+		authStore.set("isAuthenticated", false);
+		return;
+	}
+	const token = authStore.get("token");
+	authStore.set("isAuthenticated", !isDocumentTripped() && !(token && !admitStoreToken(authStore, token, { use: "hold" })));
+};
+
+//#endregion
+export { useAuthState as A, decodeJwtIdentity as B, FetchAccessTokenContext as C, isSessionSyncGraceActive as D, Unauthenticated as E, useFetchAccessToken as F, writeAuthSessionFallbackToken as G, readAuthSessionFallbackData as H, useIsAuth as I, isCRPCClientError as J, CRPCClientError as K, useMaybeAuth as L, useAuthValue as M, useConvexAuthBridge as N, useAuth as O, useConvexAuthRecovery as P, useSafeConvexAuth as R, ConvexProviderWithAuth$1 as S, MaybeUnauthenticated as T, readAuthSessionFallbackToken as U, clearAuthSessionFallback as V, writeAuthSessionFallbackData as W, AUTH_SESSION_SYNC_GRACE_MS as _, admitToken as a, ConvexAuthBridge as b, identityGuardInPlay as c, isTokenAdmissible as d, joinPage as f, tripDocument as g, subscribeDocumentTrip as h, publishToken as i, useAuthStore as j, useAuthGuard as k, isDocumentTripped as l, pageRegistry as m, publishAuthState as n, attachStoreGuard as o, mountGuard as p, defaultIsUnauthorized as q, publishAuthenticated as r, decodeTokenSubjectSessionIdentity as s, admitStoreToken as t, isJwt as u, AuthProvider as v, MaybeAuthenticated as w, ConvexAuthRecoveryError as x, Authenticated as y, decodeJwtExp as z };