frontend-app-api: make session state opaque

Replace exposed prepared app APIs and predicate plumbing with a reusable opaque session state so apps can skip sign-in without leaking internals. Align the specialized app flow around getSignIn().ready and finalize(sessionState) for explicit session bootstrap and reuse.

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor

packages/frontend-defaults/src/createApp.tsx

@@ -126,17 +126,18 @@ export function createApp(options?: CreateAppOptions): {
       bindRoutes: options?.bindRoutes,
       advanced: options?.advanced,
     });
+    const signIn = preparedApp.getSignIn();
 
-    if (preparedApp.getSignIn()) {
+    if (signIn.element) {
       return {
         default: () => <PreparedAppRoot preparedApp={preparedApp} />,
       };
     }
 
-    await preparedApp.buildPredicateContext();
+    const { sessionState } = await signIn.ready;
 
     return {
-      default: () => renderFinalizedApp(preparedApp.finalize()),
+      default: () => renderFinalizedApp(preparedApp.finalize(sessionState)),
     };
   }
 
@@ -166,15 +167,11 @@ function PreparedAppRoot(props: {
     let cancelled = false;
     const runFinalize = async () => {
       try {
-        if (signIn) {
-          await signIn.complete;
-        } else {
-          await props.preparedApp.buildPredicateContext();
-        }
+        const { sessionState } = await signIn.ready;
         if (cancelled) {
           return;
         }
-        setFinalizedApp(props.preparedApp.finalize());
+        setFinalizedApp(props.preparedApp.finalize(sessionState));
       } catch (error) {
         if (cancelled) {
           return;
@@ -193,7 +190,7 @@ function PreparedAppRoot(props: {
   }
 
   if (!finalizedApp) {
-    return signIn?.element ?? <></>;
+    return signIn.element ?? <></>;
   }
 
   return renderFinalizedApp(finalizedApp);