Verification matrix
A library whose rule is to report only what the provider proves should say the same of itself. This page says what has been exercised, how, and what has not. See testing to write your own tests over the same mock, and writing an adapter for the conformance suite every client adapter passes.
How each layer is tested
| Layer | How it is tested | What that does not cover |
|---|---|---|
| Core | Behavior files over the mock adapter (lifecycle, identity, tokens, endings, diagnostics, containment, hints), the eight race invariants and the specification's twenty-five scenarios as named tests, a seeded fast-check sweep of 300 interleavings, and a React Native test with an AbortSignal that has only aborted and no crypto. | Real timers under load, and Hermes itself: the React Native test runs in Node. |
| Types | A consumer-view tests/types/public-api.ts against the built package, and a *.contracts.ts beside the core, every binding and every adapter; an adapter's contracts file assigns the real SDK to its structural type. | TypeScript versions other than the one this repository pins. |
| Adapters | Conformance through a real Anchor, a fake modelled on a named SDK version, a contracts file against the real SDK's types, and a real-SDK test where the SDK runs in Node or jsdom, against in-process provider endpoints. | The providers' own servers, and native SDKs nothing here can run. |
| Bindings | Real framework testing libraries in jsdom: a hook outside its provider, passivity (nothing started or read), the state followed, selector stability, no listener left after unmount, Strict Mode or a remount starting and disposing nothing, a server render with no window, and hydration of the server's markup without a mismatch. | A real browser, React Native's renderer, and the meta-frameworks: Next.js, Nuxt, SolidStart, SvelteKit. |
| Devtools | A real shadow root in jsdom, queried by role, over a real Anchor on the mock: live listeners counted, no provider demand from mounting, opening, filtering, pausing or unmounting, no token, cookie or provider error anywhere in the markup with values shown, each wrapper through its own binding, and a server render of each. | The panel's own tests ran in jsdom only, and hydrating the Solid wrapper's server host was not tested. |
| Hints | jsdom against a real Anchor over the mock. crossTab() against a fake modelled on the HTML BroadcastChannel and once against Node's real one; appState() against a fake modelled on React Native's AppState since 0.65, and typechecked against React Native 0.86.3's own. | A device, and a real browser's tab lifecycle. |
| Server reads | An in-process fake server adapter, including request isolation with reads settled in reverse order, and testServerSessionAdapter over every server adapter. | A deployed server, a CDN in front of it, and the providers' own servers. |
| Mutation | scripts/mutate.mjs breaks sixteen rules on purpose, from the commit rule to an adapter that ends another user's session or a tab that tells another who is signed in, and requires the tests to fail for each. | Rules outside the curated sixteen. |
| Docs | verify:snippets typechecks every TypeScript fence of these pages and of every package README against the built packages, except the fences marked as fragments; verify:docs checks the built site's links, anchors, headings, descriptions, llms.txt and a page for every package. | Whether an example's comment matches what it would print, and code on the Silo and Simulcast pages. |
| Examples | Vitest drives the Session Lab through its buttons; pnpm test:examples builds the examples and drives them in Chromium through Playwright, the devtools in their shadow root included, outside pnpm check. | Other browsers, and every real provider SDK, since the lab simulates them. |
Client adapters
Every client adapter passes testSessionAdapter over its fake. Its fake is modelled on the version named here, and its contracts file typechecks the real SDK's types named here.
| Adapter | Fake and contracts | Real SDK test | Never run |
|---|---|---|---|
| firebase | firebase 12.19.0; Auth and User | the SDK in Node, with in-memory persistence and no user | a sign-in against Firebase's servers or an emulator |
| firebase-react-native | @react-native-firebase/auth 26.4.0; Auth, User and getAuth, the fake's members pinned to theirs | its JavaScript in Node over the module it registers for platforms without the native SDKs, driving the Firebase JS SDK 12.17.1 against in-process Identity Toolkit and Secure Token endpoints: a restore, an anonymous sign-in, forced tokens, a token minted after a native switch refused, an ending after a native sign-out | the iOS and Android modules, the native Firebase SDKs and their restoration, the order a device delivers native events, native provider sign-in, a real project |
| supabase | supabase-js 2.117.1; SupabaseClient and User | the client in Node with no stored session | a sign-in against a Supabase project |
| auth0 | auth0-spa-js 2.27.0; Auth0Client and IdToken | the client in jsdom with an empty memory cache | a login against an Auth0 tenant |
| auth0-react-native | react-native-auth0 5.11.1; Auth0, User and parseIdToken, the fake's members pinned to theirs | its own ESM build in Node over a replaced native module answering with its iOS bridge's codes: initialization, stored credentials named by the real parseIdToken, both profiles, refused renewals with the iOS and Android codes as INTERACTION_REQUIRED, ending | Auth0.swift 2.25.0 and Auth0.Android 3.21.0 themselves, webAuth in a browser, a real tenant |
| better-auth | better-auth 1.7.6; the React and vanilla clients with the organization, anonymous and admin plugins | the client in Node against a real Better Auth server on a memory database; the real React client with the real Expo plugin against a real server with the expo() plugin, only the native modules replaced: a sign-up, a restart from secure storage, an offline restart, a restart on a network that never answers with and without a confirmation timeout, an offline ending; a minted session token authenticating as a bearer token against the real server until the session ends | a device |
| clerk | clerk-js 6.32.1; the Clerk class and UserResource | clerk-js 6.32.1 in jsdom, loaded headless as Clerk Expo loads it, against an in-process Frontend API: loading, an organization and an actor, a switch through setActive(), a pending session, cached, forced and template tokens, endings | the standard browser load with its cookies, Clerk's components, a real Clerk instance; Clerk Expo is not installed |
| msal | msal-browser 5.22.0; PublicClientApplication, IPublicClientApplication and AccountInfo | MSAL.js in jsdom against an in-process token endpoint: an encrypted localStorage restore, a read before initialize(), an account made active, refresh, interaction_required, an ending, a second client's broadcast | the login redirect and popup, the hidden iframe renewal, the platform broker, a real Microsoft Entra tenant |
| amplify | aws-amplify 6.20.0; aws-amplify/auth, its three functions alone, Hub and AuthUser | Amplify in Node against in-process Cognito endpoints: a password sign-in, both profiles, a forced refresh, a refused refresh, an ending through RevokeToken, an Amplify without a user pool | the hosted UI, SRP and custom challenges, identity pool credentials, React Native with @aws-amplify/react-native, a real user pool |
| workos | authkit-js 0.20.2; the client createClient() returns and its User | authkit-js 0.20.2 in jsdom against an in-process WorkOS API: a sign-in through its callback, an organization switch, stored and forced tokens, refused and failed refreshes, an ending without navigation | production's cookie mode, the hosted sign-in pages, a real WorkOS environment |
| authjs | next-auth 4.24.15's next-auth/react; the module and its Session | the client in jsdom against the real next-auth 4.24.15 server, answered in-process with a credentials provider and JWT sessions: sign-in, a refused session without an id, ending, another tab's broadcast, a refused CSRF check, a failed request | database sessions, OAuth providers, Next.js itself |
| oidc | oidc-client-ts 3.5.0; UserManager and IdTokenClaims | the UserManager in Node against an in-process token endpoint: a password grant, a forced renewal, invalid_grant, the end-session page signoutRedirect() opens, callbacks removed | redirect and popup sign-in, the silent iframe, the session monitor, a real provider |
| keycloak | keycloak-js 26.2.4; Keycloak and KeycloakTokenParsed | keycloak-js in jsdom against an in-process token endpoint: a start before init(), refresh, a 400 as INTERACTION_REQUIRED, the real logout page, callbacks restored | the login redirect, the check-login iframe, the silent check-SSO page, a real Keycloak server |
| okta | okta-auth-js 8.0.1; OktaAuth and UserClaims | okta-auth-js in Node against in-process Okta endpoints: stored tokens, a forced renewal, an invalid_grant renewal signing out, revocation and the sign-out page | redirect and popup sign-in, the auto-renew and storage sync services, signature verification, a real Okta org |
| http | an in-process fake backend client; no SDK, so no contract | not applicable | a request over a network |
Server adapters
Every server adapter passes testServerSessionAdapter from @priemskiyyy/anchor-server/testing.
| Adapter | Fake and contracts | Real SDK test | Never run |
|---|---|---|---|
| better-auth-node | better-auth 1.7.6's auth.api.getSession; a real server instance with its plugins | conformance against a real Better Auth server on a memory database, two users read concurrently, a signed-out cookie, a refused refresh whose cookie deletions reach the response, and a parity test with the client adapter | a deployed Better Auth server |
| firebase-node | firebase-admin 14.4.0's verifySessionCookie() and verifyIdToken(), throwing its own FirebaseAuthError; Auth, TenantAwareAuth and DecodedIdToken | conformance over the real firebase-admin Auth in emulator mode, with a stand-in for the emulator's user lookup on loopback: session cookies and bearer tokens read concurrently, every kind of refusal as signed-out, a failed lookup and a failed key fetch as unavailable; a parity test runs the real Firebase JS SDK and firebase-admin in-process against the same stand-in | credentials signed by Google, a real Auth Emulator, a Firebase project |
| supabase-node | a @supabase/ssr 0.12.7 server client over supabase-js 2.117.1; createServerClient, its cookie methods and User | conformance over the real createServerClient against an in-process fake of Supabase Auth's REST API: two users concurrently, refresh-token rotation, the rotated cookies kept when Supabase Auth then fails the read, chunked cookies, a session ended elsewhere; a parity test runs the real createBrowserClient and the server client in-process | a real Supabase Auth server, getClaims(), asymmetric signing keys, the PKCE code exchange |
| clerk-node | @clerk/backend 3.18.1's authenticateRequest() and users.getUser(); ClerkClient and User | conformance over the real createClerkClient() with RS256 tokens signed by a local key and an in-process Backend API: an organization and an actor, a pending session, refused tokens, the handshake of a navigation and its redirect back, a form post, the cross-domain handshake, a failed user lookup; a parity test runs the real clerk-js and @clerk/backend in-process, in jsdom | Clerk's own Frontend and Backend APIs, the refresh-cookie flow, satellite domains, a failing key fetch, Clerk's middleware |
| workos-node | @workos-inc/node 10.13.0's loadSealedSession(), authenticate() and refresh(); WorkOS, CookieSession and User | conformance over the real WorkOS client, its own sealing and verification, against an in-process fake of WorkOS's API: two users concurrently, a refresh whose sealed cookie the next request reads, that cookie kept when a later step fails, a foreign password, a refused refresh deleting the cookie, network and key-set failures; a parity test runs the real authkit-js and @workos-inc/node in-process, in jsdom | WorkOS's own API, AuthKit's hosted sign-in, cookie attributes beyond WorkOS's guide |
What none of this proves
- No adapter has run against its provider's real servers from this repository: no Firebase project or emulator, Supabase project, Auth0 tenant, Clerk instance, Microsoft Entra tenant, Cognito user pool, WorkOS environment, Okta org, Keycloak server or other OpenID Connect provider. The in-process endpoints stand in for them, modelled on the SDKs' own requests.
- Nothing has run on an iOS or Android device, in a simulator, in Hermes or in Expo Go. Every React Native claim rests on a fake typechecked against the real SDK's declarations, and on the SDK's JavaScript run in Node with its native modules replaced.
- Browser flows that need a real browser were not run: redirects, popups, hidden iframes, hosted pages and cross-tab storage events outside jsdom.
- No binding has run inside its meta-framework: Next.js, Nuxt, SolidStart or SvelteKit.
- The HTTP adapter has never sent a request over a real network.
- The Silo and Simulcast recipes were written from those libraries' sources and neither typechecked nor run here.
Checking it yourself
sh
pnpm install --frozen-lockfile
pnpm check
pnpm check:release
pnpm test:examplespnpm check builds the packages and runs TypeScript, ESLint, the lint-rule probes, the inferred-any scan, Prettier and the unit tests. pnpm check:release adds the documentation checks, the package and release metadata checks, the example builds and mutation testing. pnpm test:examples builds the examples and runs their browser tests in Chromium through Playwright.