@abraca/nuxt 2.24.0 → 2.25.0

package/dist/module.d.mts

@@ -77,6 +77,7 @@ declare module '@nuxt/schema' {
                 resetToken: string | null;
                 verifyToken: string | null;
             };
+            inviteQueryKey: string | false;
             schema: {
                 validate: boolean;
                 migrateOnRead: boolean;
@@ -301,6 +302,17 @@ interface ModuleOptions {
         /** Query param holding the email-verification token. Default: 'verify_token'. */
         verifyToken?: string | null;
     };
+    /**
+     * Query/hash param the client plugin sniffs at boot for an invite code to
+     * redeem during identity registration (`?invite=CODE`). Set to `false` to
+     * disable sniffing entirely — REQUIRED for apps that use an `invite` query
+     * param for their own flows (e.g. arcana's admin-setup deep link), because
+     * the boot-time guest registration would otherwise redeem the code on a
+     * throwaway soft identity before the app's flow runs.
+     *
+     * Default: `'invite'`.
+     */
+    inviteQueryKey?: string | false;
     /**
      * Optional `@abraca/schema` integration.
      *

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": ">=4.0.0"
   },
-  "version": "2.24.0",
+  "version": "2.25.0",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -64,6 +64,7 @@ const module$1 = defineNuxtModule({
       resetToken: "reset_token",
       verifyToken: "verify_token"
     },
+    inviteQueryKey: "invite",
     schema: {
       validate: false,
       migrateOnRead: false,
@@ -112,6 +113,7 @@ const module$1 = defineNuxtModule({
             resetToken: options.authQueryKeys?.resetToken ?? "reset_token",
             verifyToken: options.authQueryKeys?.verifyToken ?? "verify_token"
           },
+          inviteQueryKey: options.inviteQueryKey ?? "invite",
           schema: {
             validate: options.schema?.validate ?? false,
             migrateOnRead: options.schema?.migrateOnRead ?? false,

package/dist/runtime/components/settings/ASettingsProfilePanel.vue

@@ -11,7 +11,8 @@ const {
   userNeutralColorName,
   setNeutralColor,
   publicKeyB64,
-  isClaimed
+  isClaimed,
+  identityState
 } = useAbracadabra();
 const { copy, copied } = useClipboard();
 const nameInput = ref(userName.value);
@@ -138,7 +139,7 @@ function setFont(value) {
             :icon="isClaimed ? 'i-lucide-shield-check' : 'i-lucide-shield-off'"
             :color="isClaimed ? 'success' : 'neutral'"
             variant="subtle"
-            :label="isClaimed ? 'Hardware Protected' : 'Guest (Soft Key)'"
+            :label="isClaimed ? 'Hardware Protected' : identityState === 'account' ? 'Password Account' : 'Guest (Soft Key)'"
           />
         </ClientOnly>
       </div>

package/dist/runtime/components/settings/ASettingsSecurityPanel.vue

@@ -4,6 +4,7 @@ import { useAbracadabra } from "../../composables/useAbracadabra";
 import { usePasskeyAccounts } from "../../composables/usePasskeyAccounts";
 const {
   isClaimed,
+  identityState,
   claimAccount,
   loginWithHardware,
   logout,
@@ -98,10 +99,10 @@ const showLogoutConfirm = ref(false);
           />
           <div class="flex-1 min-w-0">
             <p class="text-sm font-medium">
-              {{ isClaimed ? "Hardware Protected" : "Guest Identity" }}
+              {{ isClaimed ? "Hardware Protected" : identityState === "account" ? "Password Account" : "Guest Identity" }}
             </p>
             <p class="text-xs text-(--ui-text-muted)">
-              {{ isClaimed ? "Bound to hardware security enclave." : "Key stored in localStorage only." }}
+              {{ isClaimed ? "Bound to hardware security enclave." : identityState === "account" ? "Signed in with a password. Add a passkey for hardware protection." : "Key stored in localStorage only." }}
             </p>
           </div>
           <div class="flex gap-2 shrink-0">

package/dist/runtime/middleware/abracadabra-auth.js

@@ -1,11 +1,12 @@
 import { defineNuxtRouteMiddleware, useRuntimeConfig, navigateTo } from "#imports";
 import { useAbracadabra } from "../composables/useAbracadabra.js";
-export default defineNuxtRouteMiddleware((to) => {
+export default defineNuxtRouteMiddleware(async (to) => {
   if (import.meta.server) return;
-  const { isReady, publicKeyB64 } = useAbracadabra();
+  const abra = useAbracadabra();
   const config = useRuntimeConfig();
   const loginPath = config.public?.abracadabra?.auth?.loginPath ?? "/login";
-  if (isReady?.value && !publicKeyB64?.value) {
+  await abra.whenReady?.();
+  if (!abra.publicKeyB64?.value) {
     return navigateTo({ path: loginPath, query: { redirect: to.fullPath } });
   }
 });

package/dist/runtime/plugin-abracadabra.client.js

@@ -138,6 +138,7 @@ const STORAGE_KEY_EXTERNAL_PLUGINS = "abracadabra_external_plugins";
 const STORAGE_KEY_DISABLED_BUILTINS = "abracadabra_disabled_builtins";
 const CLAIMED_FLAG_KEY = "abracadabra_was_claimed";
 const PUBKEY_KEY = "abracadabra_pubkey";
+const ACCOUNT_SESSION_KEY = "abracadabra_account_session";
 const CURRENT_SERVER_KEY = "abracadabra_current_server";
 const REQUIRE_PASSKEY_KEY = "abracadabra_require_passkey";
 const SERVERS_KEY = "abracadabra_servers";
@@ -372,6 +373,7 @@ export default defineNuxtPlugin({
     let _initPromise = null;
     let _wsp = null;
     let _tokenManager = null;
+    let _signChallenge = null;
     let authFailureCount = 0;
     const AUTH_FAILURE_LIMIT = 3;
     let lastClientIds = /* @__PURE__ */ new Set();
@@ -479,6 +481,10 @@ export default defineNuxtPlugin({
       if (userStatusText.value) payload.statusText = userStatusText.value;
       provider.value?.setAwarenessField("user", payload);
     }
+    watch(
+      [userName, userColor, publicKeyB64, userStatusIcon, userStatusText],
+      () => publishAwarenessUser()
+    );
     function setUserName(name) {
       userName.value = name;
       localStorage.setItem("abracadabra_username", name);
@@ -538,6 +544,14 @@ export default defineNuxtPlugin({
       connectionError.value = null;
       _wsp.connect();
     }
+    function whenReady() {
+      const p = _initPromise;
+      if (!p) return Promise.resolve();
+      return p.then(
+        () => _initPromise !== p ? whenReady() : void 0,
+        () => void 0
+      );
+    }
     function _teardown() {
       if (_wsp) {
         _wsp.disconnect();
@@ -559,6 +573,7 @@ export default defineNuxtPlugin({
       }
       client.value = null;
       keystore.value = null;
+      _signChallenge = null;
       isReady.value = false;
       synced.value = false;
       status.value = "disconnected";
@@ -737,6 +752,7 @@ export default defineNuxtPlugin({
       localStorage.removeItem("abracadabra_username");
       localStorage.removeItem(CLAIMED_FLAG_KEY);
       localStorage.removeItem(PUBKEY_KEY);
+      localStorage.removeItem(ACCOUNT_SESSION_KEY);
       window.location.reload();
     }
     async function logoutServer() {
@@ -766,11 +782,31 @@ export default defineNuxtPlugin({
       await client.value.requestPasswordReset(opts);
       addLog("Password reset email requested", "auth");
     }
+    async function _adoptAccountSession(fallbackName) {
+      hasPassword.value = true;
+      if (identityState.value !== "claimed") {
+        identityState.value = "account";
+        try {
+          localStorage.setItem(ACCOUNT_SESSION_KEY, "1");
+        } catch {
+        }
+      }
+      try {
+        const me = await client.value?.getMe();
+        const name = me?.displayName || me?.username || fallbackName;
+        if (name) {
+          userName.value = name;
+          localStorage.setItem("abracadabra_username", name);
+          publishAwarenessUser();
+        }
+      } catch {
+      }
+    }
     async function loginWithPassword(opts) {
       if (!client.value) throw new Error("Not connected");
       await client.value.login(opts);
       addLog(`Logged in as ${opts.username}`, "auth");
-      hasPassword.value = true;
+      await _adoptAccountSession(opts.username);
       if (_wsp) {
         _wsp.disconnect();
         setTimeout(() => _wsp?.connect(), 300);
@@ -781,7 +817,7 @@ export default defineNuxtPlugin({
       await client.value.register(opts);
       await client.value.login({ username: opts.username, password: opts.password });
       addLog(`Registered + logged in as ${opts.username}`, "auth");
-      hasPassword.value = true;
+      await _adoptAccountSession(opts.displayName || opts.username);
       if (_wsp) {
         _wsp.disconnect();
         setTimeout(() => _wsp?.connect(), 300);
@@ -808,19 +844,10 @@ export default defineNuxtPlugin({
       await client.value.redeemInvite(code);
       addLog(`Invite redeemed: ${code}`, "auth");
       const pubKey = publicKeyB64.value;
-      if (pubKey) {
+      const sign = _signChallenge;
+      if (pubKey && sign) {
         try {
-          const ed = await import("@noble/ed25519");
-          const storedPrivKey = localStorage.getItem("abracadabra_privkey");
-          await client.value.loginWithKey(pubKey, async (ch) => {
-            if (isClaimed.value && keystore.value) return keystore.value.sign(ch);
-            if (storedPrivKey) {
-              const privKey = fromBase64Url(storedPrivKey);
-              const sig = await ed.sign(fromBase64Url(ch), privKey);
-              return toBase64Url(sig);
-            }
-            throw new Error("No signing key available");
-          });
+          await client.value.loginWithKey(pubKey, sign);
           if (_wsp) {
             _wsp.disconnect();
             setTimeout(() => _wsp?.connect(), 300);
@@ -881,10 +908,11 @@ export default defineNuxtPlugin({
     async function init(serverUrl) {
       currentServerUrl.value = serverUrl;
       addLog("Initializing Abracadabra...", "system");
-      if (!pendingInviteCode.value) {
+      const inviteQueryKey = abraConfig.inviteQueryKey ?? "invite";
+      if (inviteQueryKey !== false && !pendingInviteCode.value) {
         const urlParams = new URLSearchParams(window.location.search);
         const hashParams = new URLSearchParams(window.location.hash.replace(/^#/, ""));
-        const code = urlParams.get("invite") || hashParams.get("invite");
+        const code = urlParams.get(inviteQueryKey) || hashParams.get(inviteQueryKey);
         if (code) {
           pendingInviteCode.value = code.toUpperCase();
           addLog(`Invite code found in URL: ${pendingInviteCode.value}`, "auth");
@@ -989,6 +1017,7 @@ export default defineNuxtPlugin({
           }
           throw new Error("No identity available for signing");
         };
+        _signChallenge = signChallengeFn;
         const _client = new AbracadabraClient({ url: serverUrl, persistAuth, storageKey: authStorageKey });
         client.value = _client;
         addLog(`Server: ${serverUrl}`, "connection");
@@ -1001,6 +1030,13 @@ export default defineNuxtPlugin({
         tm.on("session-expired", () => {
           addLog("Device session rejected \u2014 please re-authenticate", "auth");
           if (identityState.value === "claimed") identityState.value = "needsReauth";
+          else if (identityState.value === "account") {
+            try {
+              localStorage.removeItem(ACCOUNT_SESSION_KEY);
+            } catch {
+            }
+            identityState.value = "guest";
+          }
         });
         if (tm.hasSession && !_client.isTokenValid()) {
           try {
@@ -1011,9 +1047,11 @@ export default defineNuxtPlugin({
           }
         }
         let useExistingToken = _client.isTokenValid();
+        let resumedMe = null;
         if (useExistingToken) {
           try {
             const me = await _client.getMe();
+            resumedMe = me ?? null;
             hasPassword.value = !!me?.hasPassword;
           } catch (e) {
             const status2 = e?.status ?? 0;
@@ -1034,11 +1072,28 @@ export default defineNuxtPlugin({
         if (useExistingToken && identityState.value === "claimed") {
           addLog("Resumed session from persisted token", "auth");
         } else if (useExistingToken) {
-          addLog("Resumed session from persisted token", "auth");
+          if (localStorage.getItem(ACCOUNT_SESSION_KEY) === "1") {
+            identityState.value = "account";
+            const name = resumedMe?.displayName || resumedMe?.username;
+            if (name) {
+              userName.value = name;
+              localStorage.setItem("abracadabra_username", name);
+            }
+            addLog("Resumed account session from persisted token", "auth");
+          } else {
+            addLog("Resumed session from persisted token", "auth");
+          }
         } else if (identityState.value === "claimed" && !requirePasskeyOnLogin.value) {
           identityState.value = "needsReauth";
           addLog("Session expired \u2014 passkey sign-in available", "auth");
         } else {
+          if (localStorage.getItem(ACCOUNT_SESSION_KEY) === "1") {
+            try {
+              localStorage.removeItem(ACCOUNT_SESSION_KEY);
+            } catch {
+            }
+            addLog("Account session could not be refreshed \u2014 continuing as guest", "auth");
+          }
           try {
             await _client.registerWithKey({
               publicKey: pubKey,
@@ -1288,23 +1343,6 @@ export default defineNuxtPlugin({
         });
         _provider.attach();
         provider.value = _provider;
-        try {
-          const onPointerLeave = (e) => {
-            if (e.relatedTarget !== null) return;
-            try {
-              _provider.awareness?.setLocalStateField("hover", null);
-            } catch {
-            }
-          };
-          document.addEventListener("pointerleave", onPointerLeave);
-          window.addEventListener("beforeunload", () => {
-            try {
-              _provider.awareness?.setLocalState(null);
-            } catch {
-            }
-          });
-        } catch {
-        }
         try {
           const { FileBlobStore } = await import("@abraca/dabra");
           const blobStore = new FileBlobStore(serverUrl, _client);
@@ -1321,20 +1359,7 @@ export default defineNuxtPlugin({
         _provider.ready.then(() => {
           isReady.value = true;
         }, () => null);
-        watch(
-          [userName, userColor, publicKeyB64, userStatusIcon, userStatusText],
-          () => {
-            const payload = {
-              name: userName.value,
-              color: userColor.value,
-              publicKey: publicKeyB64.value
-            };
-            if (userStatusIcon.value) payload.statusIcon = userStatusIcon.value;
-            if (userStatusText.value) payload.statusText = userStatusText.value;
-            _provider.setAwarenessField("user", payload);
-          },
-          { immediate: true }
-        );
+        publishAwarenessUser();
         addLog("Provider attached, connecting...", "connection");
       } catch (e) {
         addLog(`Error: ${e instanceof Error ? e.message : String(e)}`, "system");
@@ -1411,7 +1436,8 @@ export default defineNuxtPlugin({
       recoverIdentity,
       unblockConnection,
       broadcastSyncActive: useBroadcastSync().isActive,
-      init
+      init,
+      whenReady
     };
     nuxtApp.provide("abracadabra", abra);
     if (debug) {
@@ -1440,11 +1466,27 @@ export default defineNuxtPlugin({
         }
       }
     }
+    function _onVisibilityChange() {
+      if (document.visibilityState === "visible") _kickConnection();
+    }
     window.addEventListener("focus", _kickConnection);
     window.addEventListener("online", _kickConnection);
-    document.addEventListener("visibilitychange", () => {
-      if (document.visibilityState === "visible") _kickConnection();
-    });
+    document.addEventListener("visibilitychange", _onVisibilityChange);
+    function _onPointerLeave(e) {
+      if (e.relatedTarget !== null) return;
+      try {
+        provider.value?.awareness?.setLocalStateField("hover", null);
+      } catch {
+      }
+    }
+    function _onBeforeUnload() {
+      try {
+        provider.value?.awareness?.setLocalState(null);
+      } catch {
+      }
+    }
+    document.addEventListener("pointerleave", _onPointerLeave);
+    window.addEventListener("beforeunload", _onBeforeUnload);
     loadServers();
     let deepLinkServer = "";
     try {
@@ -1490,6 +1532,7 @@ export default defineNuxtPlugin({
         }
       }
       const shortcuts = registry.getAllKeyboardShortcuts();
+      let removeKeydown = null;
       if (shortcuts.length > 0) {
         const handleKey = (e) => {
           for (const s of shortcuts) {
@@ -1506,17 +1549,19 @@ export default defineNuxtPlugin({
           }
         };
         document.addEventListener("keydown", handleKey);
-        nuxtApp.hook("app:beforeMount", () => {
-          nuxtApp.hook("app:suspense:resolve", () => {
-          });
-        });
-        const origUnmount = nuxtApp._cleanup;
-        nuxtApp._cleanup = () => {
-          document.removeEventListener("keydown", handleKey);
-          teardowns.forEach((fn) => fn());
-          origUnmount?.();
-        };
+        removeKeydown = () => document.removeEventListener("keydown", handleKey);
       }
+      const origUnmount = nuxtApp._cleanup;
+      nuxtApp._cleanup = () => {
+        removeKeydown?.();
+        teardowns.forEach((fn) => fn());
+        window.removeEventListener("focus", _kickConnection);
+        window.removeEventListener("online", _kickConnection);
+        document.removeEventListener("visibilitychange", _onVisibilityChange);
+        document.removeEventListener("pointerleave", _onPointerLeave);
+        window.removeEventListener("beforeunload", _onBeforeUnload);
+        origUnmount?.();
+      };
     }).catch((e) => console.error("[abracadabra] boot error:", e));
   }
 });

package/dist/runtime/plugin-abracadabra.server.js

@@ -31,10 +31,16 @@ export default defineNuxtPlugin({
       userNeutralColorName: ref("zinc"),
       userCount: ref(0),
       publicKeyB64: ref(""),
+      identityState: ref("initializing"),
       isClaimed: ref(false),
       identityLost: ref(false),
       needsReauth: ref(false),
       requirePasskeyOnLogin: ref(false),
+      effectiveRole: ref(null),
+      unsyncedChanges: ref(0),
+      userStatusIcon: ref(""),
+      userStatusText: ref(""),
+      userStatusAsAvatar: ref(false),
       // Servers / spaces
       currentServerUrl: ref(""),
       savedServers: ref([]),
@@ -52,11 +58,24 @@ export default defineNuxtPlugin({
       setUserColor: noop,
       setNeutralColor: noop,
       setRequirePasskey: noop,
+      setUserStatusIcon: noop,
+      setUserStatusText: noop,
+      setUserStatusAsAvatar: noop,
       reconnect: noop,
       removeServer: noop,
+      unblockConnection: noop,
       claimAccount: noopAsync,
       loginWithHardware: noopAsync,
+      loginWithPassword: noopAsync,
+      registerWithPassword: noopAsync,
       logout: noopAsync,
+      logoutServer: noopAsync,
+      logoutAll: noopAsync,
+      requestPasswordReset: noopAsync,
+      confirmPasswordReset: noopAsync,
+      changePassword: noopAsync,
+      setPassword: noopAsync,
+      recoverIdentity: async () => false,
       addServer: noopAsync,
       switchServer: noopAsync,
       switchSpace: noopAsync,
@@ -70,7 +89,8 @@ export default defineNuxtPlugin({
       revokeInvite: noopAsync,
       hasPassword: ref(false),
       refreshHasPassword: noopAsync,
-      init: noopAsync
+      init: noopAsync,
+      whenReady: () => Promise.resolve()
     });
   }
 });

package/dist/runtime/types.d.ts

@@ -378,15 +378,22 @@ export declare function deriveColorFromPubKey(pubKey: string): {
  * Transitions:
  *   initializing → guest       (soft-key generated)
  *   initializing → claimed     (passkey restored from cache)
+ *   initializing → account     (password-account JWT resumed from storage)
  *   initializing → identityLost (was claimed but cached key missing)
  *   guest → claimed            (claimAccount succeeds)
+ *   guest → account            (loginWithPassword / registerWithPassword succeeds)
+ *   account → guest            (device session rejected / token unrecoverable)
  *   claimed → needsReauth      (token expired, passkey re-auth available)
  *   claimed → identityLost     (passkey/key cache lost)
  *   needsReauth → claimed      (loginWithHardware succeeds)
  *   → connectionBlocked      (AUTH_FAILURE_LIMIT reached or permanent denial)
  *   connectionBlocked → (previous) (unblockConnection called)
+ *
+ * `account` = authenticated against a server account via password (JWT-backed,
+ * no local hardware key). The local soft key keeps identifying the client for
+ * CRDT/awareness purposes; REST authorization uses the account JWT.
  */
-export type IdentityState = 'initializing' | 'guest' | 'claimed' | 'identityLost' | 'needsReauth' | 'connectionBlocked';
+export type IdentityState = 'initializing' | 'guest' | 'claimed' | 'account' | 'identityLost' | 'needsReauth' | 'connectionBlocked';
 /** Injected into nuxtApp as $abracadabra */
 export interface AbracadabraState {
     doc: ShallowRef<Y.Doc>;
@@ -526,6 +533,14 @@ export interface AbracadabraState {
     unblockConnection: () => void;
     broadcastSyncActive: Ref<boolean>;
     init: (serverUrl?: string) => Promise<void>;
+    /**
+     * Resolves once the current `init()` settles (following any re-inits that
+     * happen while waiting). Never rejects — init failures resolve too, so
+     * route guards can `await whenReady()` and then branch on state
+     * (`publicKeyB64`, `effectiveRole`, …) instead of racing a half-booted
+     * plugin. On the server this resolves immediately.
+     */
+    whenReady: () => Promise<void>;
 }
 /** Nitro storage interface (subset used by runners) */
 export interface NitroStorage {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abraca/nuxt",
-  "version": "2.24.0",
+  "version": "2.25.0",
   "description": "First-class Nuxt module for the Abracadabra CRDT collaboration platform",
   "repository": "abracadabra/abracadabra-nuxt",
   "license": "MIT",