Auth sign-in transiently fails after two-phase deploy (auth apply → deploy)

[Younginspace]

Summary

When using the edgespark-quick skill's two-phase deploy pattern (Phase 1: deploy with signup open → seed admin via platform endpoint → Phase 2: edgespark auth apply to disable signup → redeploy), client.auth.signIn.email() returns an error for the first few minutes after Phase 2 completes, even though the credentials are valid.

This is specific to the edgespark-quick skill's admin seeding workflow: since EdgeSpark has no server-side auth.api.signUpEmail, the skill must temporarily open public signup, POST to /api/_es/auth/sign-up/email to create the admin user, then lock signup via disableSignUp: true and redeploy. The config change from edgespark auth apply appears to have a propagation delay to D1 edge nodes, during which sign-in behaves inconsistently.

Steps to Reproduce

1. edgespark init a new project with email/password auth enabled
2. Phase 1: edgespark deploy with disableSignUp: false (default)
3. Seed an admin user via curl -X POST https://<slug>.edgespark.app/api/_es/auth/sign-up/email — succeeds (HTTP 200)
4. Edit configs/auth-config.yaml → disableSignUp: true
5. edgespark auth apply — succeeds
6. Phase 2: edgespark deploy — succeeds
7. Immediately attempt client.auth.signIn.email({ email, password }) from the browser

Expected Behavior

Sign-in should succeed immediately after Phase 2 deploy completes, since the admin user was already created and the only config change was disabling public signup.

Actual Behavior

client.auth.signIn.email() returns { data: null, error: { ... } } — treated as "Invalid credentials" by the app. The same credentials work fine:

• Via direct curl to /api/_es/auth/sign-in/email at the same time (returns 200 with token)
• After waiting ~2-3 minutes and trying again in the browser
• After a 3rd deploy (no meaningful code change, just added console.log)

Environment

• edgespark CLI: v0.0.13
• @edgespark/web: latest (as of 2026-04-14)
• Auth provider: providerEmailPassword (no OAuth)
• Skill: edgespark-quick
• Browser: Chrome (macOS)

Analysis

The sign-in API endpoint itself works (confirmed via curl at the same time the browser fails). The issue appears to be a propagation delay between edgespark auth apply modifying the auth config in D1 and that config being fully consistent across edge nodes for the Better Auth client-side flow. During this window, signIn.email() via @edgespark/web encounters an intermediate state that causes it to return an error, while the raw REST endpoint still works.

The problem resolved itself after ~2-3 minutes (or after a subsequent deploy), suggesting eventual consistency in the auth config layer.

Why This Is Specific to edgespark-quick

Normal apps don't hit this because they either:

• Use the managed auth UI (no two-phase deploy needed), or
• Don't toggle disableSignUp between deploys

The edgespark-quick skill specifically needs this pattern because it auto-seeds an admin account without requiring human registration — the only way to do this on EdgeSpark is to temporarily open signup, create the user via the platform endpoint, then lock it down. This open → seed → lock → redeploy cycle is what triggers the propagation delay.

Suggested Fix / Workaround

Current workaround in the skill: After Phase 2 deploy, wait 15-30 seconds before validating sign-in.

Platform fix suggestions:

1. Ensure edgespark deploy waits for auth config convergence before reporting success, or
2. Make edgespark auth apply + edgespark deploy atomic so the config and code ship together, or
3. Provide a server-side admin seeding API (e.g. auth.api.signUpEmail or a CLI command like edgespark auth seed-user) so the two-phase deploy pattern isn't needed at all, or
4. Document the expected propagation delay after auth apply in the CLI output