convex-auth v2.5.1

Minor Changes

Add a Next.js SSR adapter with HttpOnly cookie sessions.

New: packages/auth/src/nextjs exports the App Router surface — a route-handler proxy (/api/auth), middleware for protected routes and proactive refresh, server-side session reads, and server-action support. Sessions live in HttpOnly cookies; tokens never reach client JS.
Demo: examples/nextjs is a working App Router app verified end-to-end against a local Convex deployment.
SSR renders verify the session server-side and fail closed: expired or revoked sessions redirect to sign-in instead of flashing authenticated UI.

Two parallel requests presenting the same refresh token (the normal SSR pattern) no longer destroy the session. rotateSession marks rotatedAt and reports "converge" inside a 15s grace window; convergeSession mints a bounded sibling session+refresh pair in the same family. Bounds: ≤8 grace redemptions per predecessor, ≤10 live sessions per family, convergence requires a live member.
updateSession now resolves the session’s identity — OAuth/passkey sessions refresh correctly. authSessions gains identityId; authRefreshTokens gains rotatedAt/graceRedemptions.

signOut, stopImpersonation, user-facing revokeSession, and admin revokeSession all revoke the whole session family. revokeSessionsForUser now marks revoked sessions’ refresh tokens too.
Audit: session.sign_out (voluntary), session.revoke (sessions-list), refresh_token_reuse (replay detection) — admin actions stay on auth_admin_audits.

The files allowlist shipped only a handful of convex-runtime modules — installs failed with Could not resolve "./convexAuth.js" and friends. The tarball now ships the full src/convex-runtime/** tree; convex/types export conditions point at src/convex-runtime/index.ts.