fix(auth-client): keep the redirect flow batched and its derivation origin stable

[sea-snake]

Bumps @icp-sdk/signer to ^5.6.0 and fixes two UrlTransport redirect-flow issues. Both only surface with real network / keygen timing, so the e2e mocks passed while a deployed 1-click SSO + attributes flow hit both.

1. Batch the delegation with a concurrent request

Promise.all([signIn(), requestAttributes()]) should produce one redirect carrying [delegation, attributes]. It instead split into two — and the second (a lone icrc34_delegation) failed on the provider.

Cause: the transport coalesces concurrently-issued requests by flushing on a setTimeout(0) macrotask once no memoize producer is in flight. requestAttributes buffers its request after a quick nonce memoize, but signIn only buffers its delegation after openChannel and an IndexedDB key restore/generate — work the flush didn't wait for. So the flush fired with only the attributes request buffered.

Fix: signIn now (a) starts session-key acquisition before openChannel (so the memoize registers in the same tick), and (b) acquires the key inside a memoize producer, capturing it in a closure so there's no post-producer storage read. The in-flight count stays raised across the keygen, holding the flush until the delegation is buffered too.

2. Preserve the derivation origin across the redirect

The return load reconstructs AuthClient from a query-less callback URL, so options.derivationOrigin (like the identity provider) is gone. A re-issued request would drop it.

Fix: journal it — derivationOrigin: this.#urlTransport.memoize(() => options.derivationOrigin?.toString()). This relies on 5.6.0's memoize returning synchronously for a sync producer, so it's usable directly in the constructor. On replay the original value comes back from the journal. The memoize is unconditional (calling it only when set would desync the call-order journal between the fresh and return loads). The window flow is unaffected — it passes derivationOrigin directly.

Tests

tests/client/auth-client-redirect.test.ts: added a derivation-origin-survives-redirect test; updated the journal-shape assertions for the new slots. The fake transport now mirrors 5.6.0's polymorphic memoize. Full suite green (81), tsc + biome clean.

Requires

@icp-sdk/signer@5.6.0 (the polymorphic memoize + redirect-target persistence).

[Copilot]

Pull request overview

This PR updates the auth client’s redirect-mode behavior to keep concurrently-issued requests batched into a single redirect and to persist derivationOrigin across the redirect replay, aligned with the updated @icp-sdk/signer behavior.

Changes:

• Bump @icp-sdk/signer from ^5.5.0 to ^5.6.0 (lockfile updated accordingly).
• Adjust AuthClient redirect flow to (a) hold batching across async session-key acquisition and (b) journal derivationOrigin so it replays after returning to a query-less callback URL.
• Update redirect-flow tests and the fake URL transport to reflect polymorphic memoize behavior and new journal slots.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/client/auth-client.ts	Reworks redirect flow timing + journals derivation origin; updates memoize API shape.
tests/client/fake-url-transport.ts	Updates fake transport memoize to be polymorphic (sync/async) like the real transport.
tests/client/auth-client-redirect.test.ts	Adds derivation-origin-survives-redirect coverage; updates journal shape assertions.
package.json	Bumps @icp-sdk/signer dependency range to ^5.6.0.
pnpm-lock.yaml	Locks @icp-sdk/signer to 5.6.0 and updates snapshot entries.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.