[monarcode]

Summary

Release 0.1.0-alpha.8. App code written against a client (createAuthFetch, Auth.layer, effetch's sessionBearer) now runs on the server against one request's cookie session. The JSDoc on every entry point is rewritten for app developers.

Added

• serverAuth.forRequest(jar) (/server) returns RequestAuth, one request's session with a client's read side: getSession, signOut, credentials, isCurrent and state. With it, createAuthFetch sends the cookie's token and saves a renewed one after a 401.
  • A read-only jar can't renew. There, a 401 rejects with REFRESH_FAILED, unless the same request's writable jar already renewed the token.
• Auth.layer (/effect) also accepts a RequestAuth. Auth.session, Auth.credentials, Auth.renew, Auth.signOut and sessionBearer then work in server functions, actions and route handlers.
  • Provide the layer per request.
  • Auth.signIn and Auth.updateUser die on the server. Call serverAuth.signIn(jar, …) and serverAuth.updateUser(jar, …) instead.
• AuthFetch (/http) is the type createAuthFetch returns. Use it to type props, contexts and test fakes.
• The Effect guide's "On the server" section covers a runtime for what belongs to no user, building the session and API client per request, signing in through serverAuth, and queries.

Fixed

• A request view now follows the writable jar for good, and renews from it on a read-only jar.
• A read-only jar whose access token had expired left state at initializing. It is now unavailable, with the session ID.
• A request view's version stays the same through refreshes, and its state is stable when there is no secret.

Changed

• The JSDoc on every entry point is rewritten. Each hover says what the export does first, then its errors and platform differences, with shorter examples. AGENTS.md now sets this style.
• Statements that had drifted from the code are corrected in the JSDoc, the README and the guides:
  • when the early refresh runs
  • which jar nextJar returns
  • which options createServerAuth accepts
• The Effect examples refresh with a client method (client.post) instead of binding an endpoint on every call.
• Dependencies get patch and minor bumps.