State

Read the client's state outside React, follow its changes, and know what each field holds.

auth.state holds what useAuth reads in components. Outside React, read it once with get, or follow it with subscribe:

src/status-log.ts

import {  } from "./auth.js";

/** Logs each change of status. Returns a function that stops it. */
export function () {
  let  = ..().;
  const {  } = ..(({  }) => {
    if ( === ) return;
     = ;
    .(`Auth is ${}`);
  });
  return ;
}

subscribe reports later changes, not the current value. A listener that throws doesn't interrupt auth: its error is rethrown asynchronously, where error reporting can catch it.

Field	Holds
`status`	Where the session stands. How it works lists each one.
`user`	The signed-in user, or `null`. Checking `status` narrows it.
`sessionId`	New on every sign-in, and stable across refreshes and profile updates.
`error`	The latest failure, as an `AuthError`, or `null`.
`version`	Changes when guards must run again. `connectAuth` and `useAuthRevalidation` watch it.

Two habits follow from these fields:

Scope private cached data to sessionId, such as TanStack Query results, so one account never sees another's.
Check status, not user, to know whether access is usable. A locked session keeps its user.

// State