feat: sign in to a session, and end it at the canister

[sea-snake]

signIn() asks for a session rather than a long-lived delegation. What comes back is restricted to Internet Identity, so a copy of it is worth nothing against an application's own canisters and the only thing it can do is mint.

• maxTimeToLive keeps meaning the longest the thing being granted may live. targets goes: what an application may call is decided by the delegations minted from the session, not by the session itself.
• It mints inside the ceremony the user is already waiting through, so the first request afterwards does not wait. That mint is also where the account's key comes from — the session chain is rooted at the session's own key, and only a mint reports the key an application's canisters see. A page load takes it from the stored app credential instead, and mints where there is none, which such a load owes anyway.
• signOut() ends the session at the canister, so access stops within one delegation lifetime instead of running to the session's expiry. The revoke and the wipe run together: a slow or failing call must not hold up a sign-out the user asked for, and only the wipe may fail it — the idle callback reloads on success alone, and a reload after a failed wipe would restore the session it just tried to end.
• identityProvider becomes two values. A ceremony is rendered at a URL and delegations are minted by a canister, and they are not the same address.

Teardown covers both slots. This is the layer where a second credential exists, and it is the layer where signOut() starts removing it: an app delegation left behind is minted under a sign-in that has ended and can still be adopted on the next page load. Both removals are attempted whatever either does, and the first failure is reported once neither is left behind.

A ceremony writes to its own slot. The first mint goes to app-pending and is promoted once the session and state are stored, so the slot every tab of the origin acts with is never emptied — a sign-in that fails costs the other tabs nothing, and an abandoned redirect leaves a spent five-minute record instead of having wiped the live one. That makes both halves of a ceremony symmetric with session-pending.

Sign-out is here rather than in its own PR because it is a revoke call, a lock steal and an ordering rule, and it reads better beside the sign-in it undoes. #160 is closed for that reason.

Read hardest: #openSession, shared by sign-in and hydration, and the ordering in signOut.

[Copilot]

Pull request overview

This PR refactors AuthClient to authenticate via Internet Identity sessions (ii_session_delegation) and mint short-lived (5-minute) app delegations from that session, while splitting persistence into two stores: an async IdentityStorage for the session signing key and a synchronous/observable SessionStorage for the session delegation chain.

Changes:

• Replace long-lived delegation sign-in with a session-based flow and mint app delegations during the sign-in ceremony.
• Split persisted state into identityStorage (key material, async) and sessionStorage (session chain + account key, sync + subscribable), removing the legacy combined storage (storage.ts).
• Update tests and documentation to reflect the new session-based behavior and configuration options.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/client/storage.test.ts	Removes tests for legacy IdbStorage/combined storage that is deleted.
tests/client/auth-client.test.ts	Updates/expands AuthClient tests for session sign-in, minting, session restore, subscriptions, and returnTo handling.
tests/client/auth-client-redirect.test.ts	Updates redirect-flow tests for session delegation + identity persistence across redirects, including returnTo journaling/navigation.
src/client/storage.ts	Removes legacy combined storage abstractions (AuthClientStorage, IdbStorage, LocalStorage, key constants).
src/client/session-delegation.ts	Adds ii_session_delegation JSON-RPC request/response handling to build a DelegationChain from the signer response.
src/client/index.ts	Removes exports for deleted legacy storage APIs.
src/client/auth-client.ts	Implements session sign-in + minting, introduces identity/session storage split, subscription-based reconciliation, and updated identity provider configuration.
docs/src/content/docs/quick-start.md	Updates Quick Start to new identityProvider object + agent options for local development.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.