feat(internet-identity): target @icp-sdk/auth v9

evaluations/internet-identity.json

@@ -9,14 +9,17 @@
         "All await calls are inside async functions — no bare top-level await at module scope",
         "Does NOT recommend changing build.target to 'esnext' or 'es2022' in Vite config",
         "Uses AuthClient from '@icp-sdk/auth/client' (submodule import, not root '@icp-sdk/auth')",
-        "Shows an initialization pattern like async function init() or equivalent lifecycle hook"
+        "Shows an initialization pattern like async function init() or equivalent lifecycle hook",
+        "Constructs the client with no identityProvider, or with the { authorizeUrl, canisterId } pair — never a bare URL string"
       ]
     },
     {
       "name": "Local II URL",
-      "prompt": "My Internet Identity login works on mainnet but fails locally — the popup never opens. What URL should I use for the local identityProvider? Just the URL and a one-line explanation.",
+      "prompt": "My Internet Identity login works on mainnet but fails locally — the popup never opens. What do I pass as identityProvider for a local Internet Identity? Just the value and a one-line explanation.",
       "expected_behaviors": [
-        "Local URL uses the well-known II canister ID: http://id.ai.localhost:8000",
+        "identityProvider is an object with both authorizeUrl and canisterId, not a bare URL string (9.x throws a TypeError on a string)",
+        "Local authorizeUrl uses the well-known II frontend alias: http://id.ai.localhost:8000/authorize",
+        "canisterId is the well-known II backend canister, rdmx6-jaaaa-aaaaa-aaadq-cai, which is the same locally as on mainnet",
         "Does NOT suggest dynamic lookup via ic_env cookie, environment variables, or dfx commands for the II canister ID — it is a well-known, hardcoded ID"
       ]
     },
@@ -46,8 +49,9 @@
       "expected_behaviors": [
         "Identifies 2vxsx-fae as the anonymous principal",
         "Explains that authentication silently failed or the identity was not properly extracted",
-        "Suggests checking the identityProvider URL passed to the AuthClient constructor",
-        "Suggests checking that authClient.signIn() did not reject (use try/catch around the awaited promise) and that the identity from await authClient.getIdentity() is passed to HttpAgent"
+        "Suggests checking the authorizeUrl passed to the AuthClient constructor (including the /authorize path)",
+        "Suggests checking that authClient.signIn() did not reject, with try/catch around the awaited promise",
+        "Suggests checking that the identity from await authClient.getIdentity() is the one passed to HttpAgent"
       ]
     },
     {
@@ -187,6 +191,69 @@
         "Says exceeding the cap invalidates the ENTIRE list — every alternative origin stops authenticating, not just the entries past the limit",
         "Does NOT describe the over-cap behavior as truncation, ignoring the extras, or only the excess entries failing"
       ]
+    },
+    {
+      "name": "Session bounds are the session's, not a delegation's",
+      "prompt": "How long does a sign-in last with @icp-sdk/auth, and how do I make it shorter for a banking app? Just the answer and one code snippet, no setup or deploy steps.",
+      "expected_behaviors": [
+        "Says the bounds are passed to signIn() as maxTimeToIdle and/or maxTimeToLive",
+        "Does NOT present maxTimeToLive as the lifetime of the delegation the frontend signs calls with",
+        "Does NOT recommend the v8 default of 8 hours (BigInt(8) * BigInt(3_600_000_000_000)) as the value to set",
+        "States that leaving them unset means Internet Identity's own defaults rather than a library default"
+      ]
+    },
+    {
+      "name": "Disposing a client a component owns",
+      "prompt": "I create an AuthClient inside a component that mounts and unmounts a lot. Is there anything I need to do when it unmounts? Answer in two sentences, no code.",
+      "expected_behaviors": [
+        "Says to call dispose() on the client when the component unmounts",
+        "Does NOT claim the application must keep a single shared AuthClient instance",
+        "Does NOT describe dispose() as signing the user out or ending the session"
+      ]
+    },
+    {
+      "name": "Shared sign-in across sibling subdomains",
+      "prompt": "Two apps, chat.example.com and hr.example.com: a user who signs in on one should be signed in on the other with @icp-sdk/auth. Show five things and nothing else: the shared client options, the well-known documents this needs and which origin serves each, the /reauth route, the check every page runs on load, and what happens if the status changes while a page is already open. Code with short comments, no prose sections, no backend, no deploy steps.",
+      "expected_behaviors": [
+        "Requires one shared derivationOrigin across both apps, listed in that origin's /.well-known/ii-alternative-origins, and does not present a shared cookie as sufficient on its own",
+        "Uses CookieStateStorage with the parent domain (example.com) as stateStorage on both apps",
+        "Acquires a credential on the origin that reads signed-in-elsewhere, with a second AuthClient built with prompt: 'none'",
+        "Passes hint set to the principal the shared record names on that silent request",
+        "Uses transport: 'redirect' for the silent request rather than the default window transport",
+        "Does NOT pass resumable explicitly, since CookieStateStorage already asks for a resumable session",
+        "Every page, not only protected ones, checks getStatus() on load and redirects signed-in-elsewhere to the re-auth route, passing the current path as a next parameter it returns to",
+        "Handles the status turning signed-in-elsewhere after load through subscribe() by prompting the user with a button that runs the redirect, rather than redirecting the open page automatically",
+        "Serves /.well-known/ii-auth-callbacks on each app origin listing that origin's own /reauth URL, as the prerequisite for the redirect transport, rather than only the alternative-origins document on the derivation origin"
+      ]
+    },
+    {
+      "name": "Adversarial: shared cookie but different principals per subdomain",
+      "prompt": "I set CookieStateStorage with domain 'example.com' on both my subdomains, but each one still signs the user in as a different principal, and my re-auth page keeps bouncing them back. What is wrong and what do I do? Three sentences, no code.",
+      "expected_behaviors": [
+        "Identifies that principals are derived per origin and that one shared derivationOrigin across both subdomains is what makes them the same",
+        "Says that derivation origin has to authorize the subdomains by listing them in its alternative-origins document",
+        "Connects the bouncing to the shared record naming an account this origin can never hold a credential for",
+        "Does NOT blame cookie attributes, SameSite, Secure, or the cookie domain itself as the cause"
+      ]
+    },
+    {
+      "name": "Adversarial: silent re-issue without hint",
+      "prompt": "Review this: on hr.example.com I detect signed-in-elsewhere and then run `await new AuthClient({ ...clientOptions, prompt: 'none' }).signIn()` on page load. Anything wrong? Two sentences, no rewrite.",
+      "expected_behaviors": [
+        "Flags the missing hint and says a provider holding more than one session refuses the silent request rather than answering for another account",
+        "Flags that a silent request on page load has no user gesture, so it needs transport: 'redirect' rather than the default window transport",
+        "Does NOT claim prompt: 'none' is wrong or unsupported",
+        "Does NOT claim the missing hint signs the user in as a different account"
+      ]
+    },
+    {
+      "name": "Adversarial: redirecting an already-open page to /reauth",
+      "prompt": "In my subdomain-shared setup I subscribe to the auth client and call location.replace('/reauth?next=...') on every change to signed-in-elsewhere, including while the user is filling in a form. Is that right? Three sentences, no code.",
+      "expected_behaviors": [
+        "Says redirecting a page that is already open throws away what the user is doing, so it is wrong for the subscribe path",
+        "Says an already-open page should prompt the user, for example a banner or dialog whose button runs the redirect",
+        "Keeps the automatic redirect for the check a page runs on load, rather than calling the whole redirect approach wrong"
+      ]
     }
   ],
   "trigger_evals": {