feat: share a sign-in across sibling subdomains

[sea-snake]

A cookie is the only thing that crosses between origins, so putting the state in one is what lets chat.example.com and hr.example.com share a sign-in, and what lets a sign-out on either end it for both.

• It carries no chain and no key. A sibling reads who is signed in and until when, and asks the identity provider to re-issue for itself rather than treating what it read as proof.
• Nothing raises an event when a cookie changes and no BroadcastChannel crosses origins, so a sibling's change is seen by looking: the Cookie Store API where the browser has it, and otherwise a re-check when the page is shown or the window regains focus.
• A domain the browser would refuse is refused here instead, naming both sides. A malformed cookie belonging to something else is skipped rather than allowed to break every read.

This is where held earns its keep. A cookie cannot carry a per-origin fact — every sibling reads the same bytes — so the store composes a localStorage companion and reports held by comparing its principal against the cookie's. Comparing rather than counting matters because an expired record is kept on purpose: a sibling signing in as someone else then publishes a cookie this origin has no credential for, and asking only whether some local record exists would read that as held.

Two behaviour fixes the cookie makes reachable:

• onSessionGone used to clear the state along with the credentials. Across origins that means retracting the record a sibling's ceremony just wrote, telling the sibling that did sign in that its session is gone and taking both down. It now discards this origin's claim and leaves the record standing. #hydrate gets the same correction: credentials rooted at an account the state no longer names are dropped, not ended, for the same reason.
• getIdentity() refuses rather than handing back an anonymous identity when the record names an account this origin holds nothing for. Anonymous there is the dangerous answer: calls would go out unauthenticated while the record says someone is signed in. SessionNotHeldError is where a silent re-issue belongs.

Read hardest: CookieStateStorage.get() composing held, and the getIdentity() guard.

[Copilot]

Pull request overview

Adds a new CookieSessionStorage implementation to let sibling subdomains share sign-in awareness via a domain-scoped hint cookie, while keeping the actual delegation chain per-origin in localStorage.

Changes:

• Introduces CookieSessionStorage that composes LocalSessionStorage and maintains a cross-subdomain hint cookie (principal + expiry).
• Exports the new storage and types from the client entrypoint.
• Adds a dedicated test suite covering cookie gating, hint derivation, and cross-source subscription notifications.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
tests/client/cookie-session-storage.test.ts	New tests validating hint semantics, cookie gating behavior, and subscription notifications.
src/client/index.ts	Re-exports CookieSessionStorage and related types from the public client API.
src/client/cookie-session-storage.ts	New SessionStorage implementation that adds a domain-scoped hint cookie and unified change notifications.
src/client/auth-client.ts	Documentation updates referencing CookieSessionStorage as an option for sibling subdomains.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.