@reifydb/auth 0.10.0 → 0.10.2

package/dist/index.d.ts

@@ -10,7 +10,7 @@ interface AuthSession {
     readonly identity: string;
     readonly walletAddress: string;
     readonly expiresAt: number;
-    readonly method?: "wallet" | "password" | "token";
+    readonly method?: "wallet" | "password" | "token" | "guest";
     readonly identifier?: string;
 }
 interface PasswordCredentials {
@@ -38,6 +38,9 @@ interface AuthCapableClient {
 interface CredentialAuthCapableClient extends AuthCapableClient {
     loginWithPassword(identifier: string, password: string): Promise<LoginResult>;
 }
+interface GuestAuthCapableClient extends AuthCapableClient {
+    login(method: string, credentials: Record<string, string>): Promise<LoginResult>;
+}
 
 interface AuthTransport<TClient extends AuthCapableClient = AuthCapableClient> {
     readonly kind: "ws" | "http";
@@ -80,15 +83,24 @@ interface SignInArgs<TClient extends AuthCapableClient = AuthCapableClient> {
     domain: string;
     statement: string;
     sessionTtlSeconds: number;
+    session?: AuthSession | null;
 }
 declare function performSignIn<TClient extends AuthCapableClient>(args: SignInArgs<TClient>): Promise<AuthSession>;
 
+interface GuestSignInArgs<TClient extends AuthCapableClient = AuthCapableClient> {
+    url: string;
+    transport: AuthTransport<TClient>;
+    sessionTtlSeconds: number;
+}
+declare function performGuestSignIn<TClient extends AuthCapableClient>(args: GuestSignInArgs<TClient>): Promise<AuthSession>;
+
 interface PasswordSignInArgs<TClient extends AuthCapableClient = AuthCapableClient> {
     url: string;
     transport: AuthTransport<TClient>;
     identifier: string;
     password: string;
     sessionTtlSeconds: number;
+    session?: AuthSession | null;
 }
 declare function performPasswordSignIn<TClient extends AuthCapableClient>(args: PasswordSignInArgs<TClient>): Promise<AuthSession>;
 
@@ -101,4 +113,4 @@ declare function ensureClient<T extends AuthCapableClient>(transport: AuthTransp
 declare function clearClient(): void;
 declare function currentClient<T extends AuthCapableClient = AuthCapableClient>(): T;
 
-export { type AuthCapableClient, AuthContext, type AuthContextValue, AuthProvider, type AuthProviderProps, type AuthSession, type AuthState, type AuthStatus, type AuthTransport, type CredentialAuthCapableClient, type PasswordCredentials, type PasswordSignInArgs, type SignInArgs, type WalletConnector, clearClient, clearStoredSession, currentClient, ensureClient, httpTransport, jsonHttpTransport, jsonWsTransport, performPasswordSignIn, performSignIn, readStoredSession, storageKeyFor, useAuth, useAuthClient, writeStoredSession, wsTransport };
+export { type AuthCapableClient, AuthContext, type AuthContextValue, AuthProvider, type AuthProviderProps, type AuthSession, type AuthState, type AuthStatus, type AuthTransport, type CredentialAuthCapableClient, type GuestAuthCapableClient, type GuestSignInArgs, type PasswordCredentials, type PasswordSignInArgs, type SignInArgs, type WalletConnector, clearClient, clearStoredSession, currentClient, ensureClient, httpTransport, jsonHttpTransport, jsonWsTransport, performGuestSignIn, performPasswordSignIn, performSignIn, readStoredSession, storageKeyFor, useAuth, useAuthClient, writeStoredSession, wsTransport };

package/dist/index.js

@@ -120,7 +120,7 @@ function currentClient() {
 
 // src/sign-in.ts
 async function performSignIn(args) {
-  const { url, transport, method, wallet, domain, statement, sessionTtlSeconds } = args;
+  const { url, transport, method, wallet, domain, statement, sessionTtlSeconds, session } = args;
   const walletAddress = wallet.publicKey;
   if (walletAddress == null || walletAddress.length === 0) {
     throw new Error("@reifydb/auth: wallet.publicKey is required to sign in");
@@ -128,7 +128,8 @@ async function performSignIn(args) {
   if (!Number.isFinite(sessionTtlSeconds) || sessionTtlSeconds <= 0) {
     throw new Error("@reifydb/auth: sessionTtlSeconds must be a positive number");
   }
-  const client = await transport.connect(url);
+  const token = session != null && session.expiresAt > Date.now() / 1e3 ? session.token : void 0;
+  const client = await transport.connect(url, token);
   try {
     const challenge = await client.loginChallenge(method, {
       identifier: walletAddress,
@@ -170,7 +171,7 @@ function supportsPasswordLogin(client) {
   return typeof client.loginWithPassword === "function";
 }
 async function performPasswordSignIn(args) {
-  const { url, transport, identifier, password, sessionTtlSeconds } = args;
+  const { url, transport, identifier, password, sessionTtlSeconds, session } = args;
   if (identifier.length === 0) {
     throw new Error("@reifydb/auth: identifier is required to sign in");
   }
@@ -180,7 +181,8 @@ async function performPasswordSignIn(args) {
   if (!Number.isFinite(sessionTtlSeconds) || sessionTtlSeconds <= 0) {
     throw new Error("@reifydb/auth: sessionTtlSeconds must be a positive number");
   }
-  const client = await transport.connect(url);
+  const token = session != null && session.expiresAt > Date.now() / 1e3 ? session.token : void 0;
+  const client = await transport.connect(url, token);
   try {
     if (!supportsPasswordLogin(client)) {
       throw new Error(
@@ -235,7 +237,7 @@ function tabScopedNamespace(namespace) {
 function isAuthSession(v) {
   if (v === null || typeof v !== "object") return false;
   const o = v;
-  if (o.method !== void 0 && o.method !== "wallet" && o.method !== "password" && o.method !== "token") {
+  if (o.method !== void 0 && o.method !== "wallet" && o.method !== "password" && o.method !== "token" && o.method !== "guest") {
     return false;
   }
   if (o.identifier !== void 0 && typeof o.identifier !== "string") {
@@ -376,7 +378,6 @@ function AuthProvider(props) {
       }).catch((err) => {
         if (cancelled) return;
         const message = err instanceof Error ? err.message : "Failed to connect client";
-        console.error("DBG auth error: client connect", message, err);
         tearDown("error", message);
       });
       return () => {
@@ -454,7 +455,8 @@ function AuthProvider(props) {
           transport,
           identifier: credentials.identifier,
           password: credentials.password,
-          sessionTtlSeconds
+          sessionTtlSeconds,
+          session: sessionRef.current
         });
         writeStoredSession(effectiveNamespace, session);
         setState({
@@ -465,18 +467,14 @@ function AuthProvider(props) {
         });
       } catch (err) {
         const message = err instanceof Error ? err.message : "Sign in failed";
-        setState({
-          status: "error",
-          session: null,
-          clientReady: false,
-          error: message
-        });
+        setState(
+          (prev) => prev.session != null ? { ...prev, status: prev.clientReady ? "authenticated" : "verifying", error: message } : { status: "error", session: null, clientReady: false, error: message }
+        );
       }
       return;
     }
     const w = walletRef.current;
     if (w == null || !w.connected || w.publicKey == null) {
-      console.error("DBG auth error: wallet not connected");
       setState((prev) => ({ ...prev, status: "error", error: "Wallet not connected" }));
       return;
     }
@@ -497,7 +495,8 @@ function AuthProvider(props) {
         wallet: w,
         domain,
         statement,
-        sessionTtlSeconds
+        sessionTtlSeconds,
+        session: sessionRef.current
       });
       if (session.walletAddress !== walletRef.current?.publicKey) {
         throw new Error("Wallet changed during sign in");
@@ -511,13 +510,9 @@ function AuthProvider(props) {
       });
     } catch (err) {
       const message = err instanceof Error ? err.message : "Sign in failed";
-      console.error("DBG auth error: wallet sign in", message, err);
-      setState({
-        status: "error",
-        session: null,
-        clientReady: false,
-        error: message
-      });
+      setState(
+        (prev) => prev.session != null ? { ...prev, status: prev.clientReady ? "authenticated" : "verifying", error: message } : { status: "error", session: null, clientReady: false, error: message }
+      );
     }
   }, [
     url,
@@ -579,6 +574,33 @@ function useAuthClient() {
   return currentClient();
 }
 
+// src/sign-in-guest.ts
+function supportsLogin(client) {
+  return typeof client.login === "function";
+}
+async function performGuestSignIn(args) {
+  const { url, transport, sessionTtlSeconds } = args;
+  if (!Number.isFinite(sessionTtlSeconds) || sessionTtlSeconds <= 0) {
+    throw new Error("@reifydb/auth: sessionTtlSeconds must be a positive number");
+  }
+  const client = await transport.connect(url);
+  try {
+    if (!supportsLogin(client)) {
+      throw new Error("@reifydb/auth: transport client does not support login");
+    }
+    const auth = await client.login("guest", {});
+    return {
+      token: auth.token,
+      identity: auth.identity,
+      walletAddress: auth.identity,
+      method: "guest",
+      expiresAt: Math.floor(Date.now() / 1e3) + sessionTtlSeconds
+    };
+  } finally {
+    transport.release(client);
+  }
+}
+
 // src/index.ts
 export * from "@reifydb/core";
 export * from "@reifydb/client";
@@ -592,6 +614,7 @@ export {
   httpTransport,
   jsonHttpTransport,
   jsonWsTransport,
+  performGuestSignIn,
   performPasswordSignIn,
   performSignIn,
   readStoredSession,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/transport.ts","../src/auth-provider.tsx","../src/client-cache.ts","../src/sign-in.ts","../src/sign-in-password.ts","../src/storage.ts","../src/use-auth.ts","../src/index.ts"],"sourcesContent":["// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport {\n  Client,\n  type WsClient,\n  type HttpClient,\n  type JsonWsClient,\n  type JsonHttpClient,\n} from \"@reifydb/client\";\nimport type { AuthCapableClient } from \"./types\";\n\nexport interface AuthTransport<\n  TClient extends AuthCapableClient = AuthCapableClient,\n> {\n  readonly kind: \"ws\" | \"http\";\n  connect(url: string, token?: string): Promise<TClient>;\n  release(client: TClient): void;\n}\n\nfunction releaseWithDisconnect(client: { disconnect?: () => void }): void {\n  if (typeof client.disconnect === \"function\") {\n    try {\n      client.disconnect();\n    } catch {\n    }\n  }\n}\n\nexport const wsTransport: AuthTransport<WsClient> = {\n  kind: \"ws\",\n  async connect(url, token) {\n    return Client.connectWs(\n      url,\n      token != null ? { format: \"rbcf\", token } : { format: \"rbcf\" },\n    );\n  },\n  release(client) {\n    releaseWithDisconnect(client);\n  },\n};\n\nexport const httpTransport: AuthTransport<HttpClient> = {\n  kind: \"http\",\n  async connect(url, token) {\n    return Client.connectHttp(\n      url,\n      token != null ? { format: \"rbcf\", token } : { format: \"rbcf\" },\n    );\n  },\n  release(_client) {\n  },\n};\n\nexport const jsonWsTransport: AuthTransport<JsonWsClient> = {\n  kind: \"ws\",\n  async connect(url, token) {\n    return Client.connectJsonWs(url, token != null ? { token } : undefined);\n  },\n  release(client) {\n    releaseWithDisconnect(client);\n  },\n};\n\nexport const jsonHttpTransport: AuthTransport<JsonHttpClient> = {\n  kind: \"http\",\n  async connect(url, token) {\n    return Client.connectJsonHttp(url, token != null ? { token } : undefined);\n  },\n  release(_client) {\n  },\n};\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport React, {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactElement,\n  type ReactNode,\n} from \"react\";\n\nimport { clearClient, currentClient, ensureClient } from \"./client-cache\";\nimport { performSignIn } from \"./sign-in\";\nimport { performPasswordSignIn } from \"./sign-in-password\";\nimport {\n  clearStoredSession,\n  readStoredSession,\n  storageKeyFor,\n  sweepExpiredSessions,\n  tabScopedNamespace,\n  writeStoredSession,\n} from \"./storage\";\nimport type {\n  AuthCapableClient,\n  AuthSession,\n  AuthState,\n  PasswordCredentials,\n  WalletConnector,\n} from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\nconst DEFAULT_TTL_SECONDS = 86400;\n\nexport interface AuthContextValue extends AuthState {\n  signIn(credentials?: PasswordCredentials): Promise<void>;\n  adoptSession(session: AuthSession): void;\n  signOut(): Promise<void>;\n}\n\nexport const AuthContext = createContext<AuthContextValue | null>(null);\n\nexport interface AuthProviderProps<\n  TClient extends AuthCapableClient = AuthCapableClient,\n> {\n  url: string;\n  transport: AuthTransport<TClient>;\n  storageNamespace: string;\n  method?: string;\n  domain?: string;\n  statement?: string;\n  sessionTtlSeconds?: number;\n  wallet?: WalletConnector;\n  sessionScope?: \"tab\" | \"browser\";\n  children: ReactNode;\n}\n\ninterface InternalState {\n  status: AuthState[\"status\"];\n  session: AuthSession | null;\n  clientReady: boolean;\n  error: string | null;\n}\n\nexport function AuthProvider<TClient extends AuthCapableClient>(\n  props: AuthProviderProps<TClient>,\n): ReactElement {\n  const {\n    url,\n    transport,\n    storageNamespace,\n    method,\n    domain,\n    statement,\n    sessionTtlSeconds = DEFAULT_TTL_SECONDS,\n    wallet,\n    sessionScope = \"tab\",\n    children,\n  } = props;\n\n  // Per-tab storage slot: each tab gets its own localStorage key so concurrent\n  // sign-ins in different tabs cannot stomp each other's session. With\n  // sessionScope \"browser\" all tabs deliberately share one slot instead.\n  const effectiveNamespace =\n    sessionScope === \"browser\"\n      ? storageNamespace\n      : tabScopedNamespace(storageNamespace);\n\n  const [state, setState] = useState<InternalState>(() => {\n    const stored = readStoredSession(effectiveNamespace);\n    return stored\n      ? { status: \"verifying\", session: stored, clientReady: false, error: null }\n      : { status: \"disconnected\", session: null, clientReady: false, error: null };\n  });\n\n  // Pull live wallet fields into stable primitives for effect deps.\n  const walletConnected = wallet?.connected ?? false;\n  const walletConnecting = wallet?.connecting ?? false;\n  const walletPublicKey = wallet?.publicKey ?? null;\n  const walletHasSelected = wallet?.hasSelectedWallet ?? false;\n\n  // Refs so callbacks can read latest values without re-binding.\n  const sessionRef = useRef(state.session);\n  sessionRef.current = state.session;\n  const walletRef = useRef(wallet);\n  walletRef.current = wallet;\n\n  const tearDown = useCallback(\n    (nextStatus: InternalState[\"status\"], nextError: string | null) => {\n      clearStoredSession(effectiveNamespace);\n      clearClient();\n      setState({\n        status: nextStatus,\n        session: null,\n        clientReady: false,\n        error: nextError,\n      });\n    },\n    [effectiveNamespace],\n  );\n\n  // Session gate. Password sessions connect directly; wallet sessions keep the\n  // security invariant: the authenticated client is only ever constructed when\n  // the connected wallet matches the persisted session.\n  useEffect(() => {\n    const session = state.session;\n    if (session == null) return;\n\n    const establish = () => {\n      let cancelled = false;\n      ensureClient(transport, url, session.token)\n        .then(() => {\n          if (cancelled) return;\n          setState((prev) =>\n            prev.session === session\n              ? { ...prev, status: \"authenticated\", clientReady: true, error: null }\n              : prev,\n          );\n        })\n        .catch((err: unknown) => {\n          if (cancelled) return;\n          const message = err instanceof Error ? err.message : \"Failed to connect client\";\n          console.error(\"DBG auth error: client connect\", message, err);\n          tearDown(\"error\", message);\n        });\n      return () => {\n        cancelled = true;\n      };\n    };\n\n    // Credential-bound sessions (password, or a token minted server-side) carry\n    // no wallet to prove, so they connect straight away.\n    if (session.method != null && session.method !== \"wallet\") {\n      return establish();\n    }\n\n    if (walletConnected && walletPublicKey != null) {\n      if (walletPublicKey !== session.walletAddress) {\n        tearDown(\"disconnected\", null);\n        return;\n      }\n      return establish();\n    }\n\n    if (!walletConnected && (walletConnecting || walletHasSelected)) {\n      // Wallet adapter is autoConnecting; stay in verifying. Do NOT construct\n      // the client yet - we must not authenticate before the match is confirmed.\n      setState((prev) =>\n        prev.session === session\n          ? { ...prev, status: \"verifying\", clientReady: false }\n          : prev,\n      );\n      return;\n    }\n\n    // Wallet is definitively absent (no selected wallet, not connecting). User\n    // explicitly disconnected, so the session can no longer be proven; tear down.\n    tearDown(\"disconnected\", null);\n  }, [\n    state.session,\n    walletConnected,\n    walletConnecting,\n    walletPublicKey,\n    walletHasSelected,\n    transport,\n    url,\n    tearDown,\n  ]);\n\n  useEffect(() => {\n    if (typeof window === \"undefined\") return;\n    const key = storageKeyFor(effectiveNamespace);\n    const onStorage = (e: StorageEvent) => {\n      if (e.key !== key) return;\n      const current = sessionRef.current;\n\n      // Another tab signed out / cleared the session.\n      if (e.newValue == null) {\n        if (current != null) tearDown(\"disconnected\", null);\n        return;\n      }\n\n      let parsed: Partial<AuthSession>;\n      try {\n        parsed = JSON.parse(e.newValue) as Partial<AuthSession>;\n      } catch {\n        // Corrupt entry written by another tab. Only react if we actually hold\n        // a session; otherwise there is nothing to defend.\n        if (current != null) tearDown(\"disconnected\", null);\n        return;\n      }\n\n      // We hold no session of our own: nothing to defend. Clearing storage here\n      // would clobber the session the other tab just wrote (and bounce it back\n      // out through this same handler). Let our own sign-in / autoConnect flow\n      // converge independently.\n      if (current == null) return;\n\n      // A genuinely different principal took over our storage slot.\n      if (\n        parsed.walletAddress !== current.walletAddress ||\n        parsed.identity !== current.identity\n      ) {\n        const followed =\n          sessionScope === \"browser\" ? readStoredSession(effectiveNamespace) : null;\n        if (followed == null) {\n          tearDown(\"disconnected\", null);\n          return;\n        }\n        setState({ status: \"verifying\", session: followed, clientReady: false, error: null });\n      }\n\n      // Same principal, different token: a concurrent sign-in in another tab,\n      // not an intrusion. Keep our own still-valid client.\n    };\n    window.addEventListener(\"storage\", onStorage);\n    return () => {\n      window.removeEventListener(\"storage\", onStorage);\n    };\n  }, [effectiveNamespace, sessionScope, tearDown]);\n\n  // Housekeeping: drop expired per-tab slots left behind by closed tabs.\n  useEffect(() => {\n    sweepExpiredSessions(storageNamespace);\n  }, [storageNamespace]);\n\n  const signIn = useCallback(async (credentials?: PasswordCredentials) => {\n    if (credentials != null) {\n      setState((prev) => ({ ...prev, status: \"signing\", error: null }));\n      try {\n        const session = await performPasswordSignIn({\n          url,\n          transport,\n          identifier: credentials.identifier,\n          password: credentials.password,\n          sessionTtlSeconds,\n        });\n        writeStoredSession(effectiveNamespace, session);\n        setState({\n          status: \"verifying\",\n          session,\n          clientReady: false,\n          error: null,\n        });\n      } catch (err) {\n        const message = err instanceof Error ? err.message : \"Sign in failed\";\n        setState({\n          status: \"error\",\n          session: null,\n          clientReady: false,\n          error: message,\n        });\n      }\n      return;\n    }\n\n    const w = walletRef.current;\n    if (w == null || !w.connected || w.publicKey == null) {\n      console.error(\"DBG auth error: wallet not connected\");\n      setState((prev) => ({ ...prev, status: \"error\", error: \"Wallet not connected\" }));\n      return;\n    }\n    if (method == null || domain == null || statement == null) {\n      setState((prev) => ({\n        ...prev,\n        status: \"error\",\n        error: \"Wallet sign in requires method, domain, and statement\",\n      }));\n      return;\n    }\n    setState((prev) => ({ ...prev, status: \"signing\", error: null }));\n    try {\n      const session = await performSignIn({\n        url,\n        transport,\n        method,\n        wallet: w,\n        domain,\n        statement,\n        sessionTtlSeconds,\n      });\n      // Sanity: signed-in wallet must match the live publicKey. If the user\n      // swapped wallets while the signature was in flight, refuse the session.\n      if (session.walletAddress !== walletRef.current?.publicKey) {\n        throw new Error(\"Wallet changed during sign in\");\n      }\n      writeStoredSession(effectiveNamespace, session);\n      setState({\n        status: \"verifying\",\n        session,\n        clientReady: false,\n        error: null,\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Sign in failed\";\n      console.error(\"DBG auth error: wallet sign in\", message, err);\n      setState({\n        status: \"error\",\n        session: null,\n        clientReady: false,\n        error: message,\n      });\n    }\n  }, [\n    url,\n    transport,\n    method,\n    domain,\n    statement,\n    sessionTtlSeconds,\n    effectiveNamespace,\n  ]);\n\n  // Adopt a session minted outside the sign-in flows - a guest session handed\n  // out by the application server, for instance. The session gate below picks\n  // it up and connects the client exactly as it would after a sign-in.\n  const adoptSession = useCallback(\n    (session: AuthSession) => {\n      writeStoredSession(effectiveNamespace, session);\n      setState({\n        status: \"verifying\",\n        session,\n        clientReady: false,\n        error: null,\n      });\n    },\n    [effectiveNamespace],\n  );\n\n  const signOut = useCallback(async () => {\n    // Best-effort server-side logout via the currently-cached client.\n    try {\n      await currentClient().logout();\n    } catch {\n      // no current client, or server-side logout failed; tear down regardless\n    }\n    tearDown(\"disconnected\", null);\n  }, [tearDown]);\n\n  const value = useMemo<AuthContextValue>(\n    () => ({\n      status: state.status,\n      session: state.session,\n      clientReady: state.clientReady,\n      error: state.error,\n      signIn,\n      adoptSession,\n      signOut,\n    }),\n    [state, signIn, adoptSession, signOut],\n  );\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthCapableClient } from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\n// Module-level dedupe: in React StrictMode (dev) the AuthProvider effect runs\n// twice with the same inputs, which previously opened two sockets. We cache the\n// in-flight promise so both runs share one connection.\n\nlet currentKey: string | null = null;\nlet cachedClient: AuthCapableClient | null = null;\nlet currentTransport: AuthTransport | null = null;\nlet pendingPromise: Promise<AuthCapableClient> | null = null;\n\nfunction keyOf(kind: string, url: string, token: string): string {\n  return `${kind}|${url}|${token}`;\n}\n\nexport async function ensureClient<T extends AuthCapableClient>(\n  transport: AuthTransport<T>,\n  url: string,\n  token: string,\n): Promise<T> {\n  const key = keyOf(transport.kind, url, token);\n\n  if (currentKey === key) {\n    if (cachedClient) return cachedClient as T;\n    if (pendingPromise) return pendingPromise as Promise<T>;\n  }\n\n  // New (kind, url, token) — release any prior client, start fresh.\n  if (cachedClient && currentTransport) {\n    try {\n      (currentTransport as AuthTransport<AuthCapableClient>).release(cachedClient);\n    } catch {\n      // release must be idempotent; ignore\n    }\n    cachedClient = null;\n  }\n  currentKey = key;\n  currentTransport = transport as AuthTransport;\n\n  const p = transport.connect(url, token).then((client) => {\n    // Another ensure/clear ran while we were connecting — drop this one.\n    if (currentKey !== key) {\n      try {\n        transport.release(client);\n      } catch {\n        // ignore\n      }\n      throw new Error(\"@reifydb/auth: client connect superseded\");\n    }\n    cachedClient = client;\n    pendingPromise = null;\n    return client;\n  });\n  pendingPromise = p as Promise<AuthCapableClient>;\n  return p;\n}\n\nexport function clearClient(): void {\n  if (cachedClient && currentTransport) {\n    try {\n      (currentTransport as AuthTransport<AuthCapableClient>).release(cachedClient);\n    } catch {\n    }\n  }\n  currentKey = null;\n  cachedClient = null;\n  currentTransport = null;\n  pendingPromise = null;\n}\n\nexport function currentClient<T extends AuthCapableClient = AuthCapableClient>(): T {\n  if (!cachedClient) {\n    throw new Error(\"@reifydb/auth: no authenticated client; call ensureClient first\");\n  }\n  return cachedClient as T;\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthCapableClient, AuthSession, WalletConnector } from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\nexport interface SignInArgs<TClient extends AuthCapableClient = AuthCapableClient> {\n  url: string;\n  transport: AuthTransport<TClient>;\n  method: string;\n  wallet: Pick<WalletConnector, \"publicKey\" | \"signMessage\" | \"encodeSignature\">;\n  domain: string;\n  statement: string;\n  sessionTtlSeconds: number;\n}\n\nexport async function performSignIn<TClient extends AuthCapableClient>(\n  args: SignInArgs<TClient>,\n): Promise<AuthSession> {\n  const { url, transport, method, wallet, domain, statement, sessionTtlSeconds } = args;\n\n  const walletAddress = wallet.publicKey;\n  if (walletAddress == null || walletAddress.length === 0) {\n    throw new Error(\"@reifydb/auth: wallet.publicKey is required to sign in\");\n  }\n  if (!Number.isFinite(sessionTtlSeconds) || sessionTtlSeconds <= 0) {\n    throw new Error(\"@reifydb/auth: sessionTtlSeconds must be a positive number\");\n  }\n\n  const client = await transport.connect(url);\n  try {\n    const challenge = await client.loginChallenge(method, {\n      identifier: walletAddress,\n      public_key: walletAddress,\n      domain,\n      statement,\n    });\n    if (challenge.kind !== \"challenge\") {\n      throw new Error(\n        `@reifydb/auth: expected challenge response, got ${challenge.kind}`,\n      );\n    }\n\n    const messageBytes = new TextEncoder().encode(challenge.message);\n    const signatureBytes = await wallet.signMessage(messageBytes);\n    const signature = wallet.encodeSignature(signatureBytes);\n\n    const auth = await client.loginChallenge(method, {\n      challenge_id: challenge.challengeId,\n      signature,\n      signed_message: challenge.message,\n    });\n    if (auth.kind !== \"authenticated\") {\n      throw new Error(\n        `@reifydb/auth: expected authenticated response, got ${auth.kind}`,\n      );\n    }\n\n    return {\n      token: auth.token,\n      identity: auth.identity,\n      walletAddress,\n      expiresAt: Math.floor(Date.now() / 1000) + sessionTtlSeconds,\n    };\n  } finally {\n    transport.release(client);\n  }\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type {\n  AuthCapableClient,\n  AuthSession,\n  CredentialAuthCapableClient,\n} from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\nexport interface PasswordSignInArgs<\n  TClient extends AuthCapableClient = AuthCapableClient,\n> {\n  url: string;\n  transport: AuthTransport<TClient>;\n  identifier: string;\n  password: string;\n  sessionTtlSeconds: number;\n}\n\nfunction supportsPasswordLogin(\n  client: AuthCapableClient,\n): client is CredentialAuthCapableClient {\n  return (\n    typeof (client as CredentialAuthCapableClient).loginWithPassword ===\n    \"function\"\n  );\n}\n\nexport async function performPasswordSignIn<TClient extends AuthCapableClient>(\n  args: PasswordSignInArgs<TClient>,\n): Promise<AuthSession> {\n  const { url, transport, identifier, password, sessionTtlSeconds } = args;\n\n  if (identifier.length === 0) {\n    throw new Error(\"@reifydb/auth: identifier is required to sign in\");\n  }\n  if (password.length === 0) {\n    throw new Error(\"@reifydb/auth: password is required to sign in\");\n  }\n  if (!Number.isFinite(sessionTtlSeconds) || sessionTtlSeconds <= 0) {\n    throw new Error(\"@reifydb/auth: sessionTtlSeconds must be a positive number\");\n  }\n\n  const client = await transport.connect(url);\n  try {\n    if (!supportsPasswordLogin(client)) {\n      throw new Error(\n        \"@reifydb/auth: transport client does not support loginWithPassword\",\n      );\n    }\n    const auth = await client.loginWithPassword(identifier, password);\n    return {\n      token: auth.token,\n      identity: auth.identity,\n      walletAddress: identifier,\n      identifier,\n      method: \"password\",\n      expiresAt: Math.floor(Date.now() / 1000) + sessionTtlSeconds,\n    };\n  } finally {\n    transport.release(client);\n  }\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthSession } from \"./types\";\n\nconst SUFFIX = \".auth\";\n\nfunction keyFor(namespace: string): string {\n  return `${namespace}${SUFFIX}`;\n}\n\n// A per-tab id so two tabs never share one localStorage slot and stomp each\n// other's session. Backed by sessionStorage: stable across reloads within a\n// tab, unique per tab, gone when the tab closes. Falls back to an ephemeral\n// in-memory id when sessionStorage or crypto.randomUUID is unavailable\n// (degraded: the session will not survive a reload).\nconst TAB_ID_KEY = \"reifydb.auth.tab\";\n\nfunction newTabId(): string {\n  try {\n    if (typeof crypto !== \"undefined\" && typeof crypto.randomUUID === \"function\") {\n      return crypto.randomUUID();\n    }\n  } catch {\n  }\n  return `t-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;\n}\n\nfunction resolveTabId(): string {\n  if (typeof window === \"undefined\") return \"ssr\";\n  try {\n    const existing = sessionStorage.getItem(TAB_ID_KEY);\n    if (existing) return existing;\n    const id = newTabId();\n    sessionStorage.setItem(TAB_ID_KEY, id);\n    return id;\n  } catch {\n    // sessionStorage unavailable (private mode, disabled): ephemeral id.\n    return newTabId();\n  }\n}\n\nconst TAB_ID = resolveTabId();\n\n// Scopes a caller's namespace to this browser tab. AuthProvider feeds the\n// result into every storage operation so each tab gets its own slot and the\n// cross-tab `storage` listener filters other tabs out by key.\nexport function tabScopedNamespace(namespace: string): string {\n  return `${namespace}.${TAB_ID}`;\n}\n\nfunction isAuthSession(v: unknown): v is AuthSession {\n  if (v === null || typeof v !== \"object\") return false;\n  const o = v as Record<string, unknown>;\n  if (\n    o.method !== undefined &&\n    o.method !== \"wallet\" &&\n    o.method !== \"password\" &&\n    o.method !== \"token\"\n  ) {\n    return false;\n  }\n  if (o.identifier !== undefined && typeof o.identifier !== \"string\") {\n    return false;\n  }\n  return (\n    typeof o.token === \"string\" && o.token.length > 0 &&\n    typeof o.identity === \"string\" && o.identity.length > 0 &&\n    typeof o.walletAddress === \"string\" && o.walletAddress.length > 0 &&\n    typeof o.expiresAt === \"number\" && Number.isFinite(o.expiresAt) && o.expiresAt > 0\n  );\n}\n\nfunction safeRemove(namespace: string): void {\n  try {\n    localStorage.removeItem(keyFor(namespace));\n  } catch {\n    // localStorage may be unavailable; ignore\n  }\n}\n\nexport function readStoredSession(namespace: string): AuthSession | null {\n  if (typeof window === \"undefined\") return null;\n  let raw: string | null;\n  try {\n    raw = localStorage.getItem(keyFor(namespace));\n  } catch {\n    return null;\n  }\n  if (raw == null) return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    safeRemove(namespace);\n    return null;\n  }\n  if (!isAuthSession(parsed)) {\n    safeRemove(namespace);\n    return null;\n  }\n  if (parsed.expiresAt <= Date.now() / 1000) {\n    safeRemove(namespace);\n    return null;\n  }\n  return parsed;\n}\n\nexport function writeStoredSession(namespace: string, session: AuthSession): void {\n  if (typeof window === \"undefined\") return;\n  if (!isAuthSession(session)) {\n    throw new Error(\"@reifydb/auth: refusing to persist malformed session\");\n  }\n  try {\n    localStorage.setItem(keyFor(namespace), JSON.stringify(session));\n  } catch {\n    // localStorage may be unavailable (private mode, full quota); ignore.\n  }\n}\n\nexport function clearStoredSession(namespace: string): void {\n  if (typeof window === \"undefined\") return;\n  safeRemove(namespace);\n}\n\nexport function storageKeyFor(namespace: string): string {\n  return keyFor(namespace);\n}\n\n// Closed tabs leave their per-tab slot in localStorage forever - nothing ever\n// reads that namespace again. Sweep once on mount: drop slots under\n// `baseNamespace` that belong to other tabs and have already expired. Live\n// tabs' slots have a future `expires_at` and are never touched.\nexport function sweepExpiredSessions(baseNamespace: string): void {\n  if (typeof window === \"undefined\") return;\n  try {\n    const now = Date.now() / 1000;\n    const ownKey = keyFor(tabScopedNamespace(baseNamespace));\n    const prefix = `${baseNamespace}.`;\n    const dead: string[] = [];\n    for (let i = 0; i < localStorage.length; i += 1) {\n      const k = localStorage.key(i);\n      if (k == null || k === ownKey) continue;\n      if (!k.startsWith(prefix) || !k.endsWith(SUFFIX)) continue;\n      const raw = localStorage.getItem(k);\n      if (raw == null) continue;\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(raw);\n      } catch {\n        continue;\n      }\n      if (isAuthSession(parsed) && parsed.expiresAt <= now) {\n        dead.push(k);\n      }\n    }\n    for (const k of dead) localStorage.removeItem(k);\n  } catch {\n    // localStorage unavailable; nothing to sweep.\n  }\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport { useContext } from \"react\";\n\nimport { AuthContext, type AuthContextValue } from \"./auth-provider\";\nimport { currentClient } from \"./client-cache\";\nimport type { AuthCapableClient } from \"./types\";\n\nexport function useAuth(): AuthContextValue {\n  const ctx = useContext(AuthContext);\n  if (ctx == null) {\n    throw new Error(\"@reifydb/auth: useAuth must be used inside <AuthProvider>\");\n  }\n  return ctx;\n}\n\nexport function useAuthClient<\n  TClient extends AuthCapableClient = AuthCapableClient,\n>(): TClient {\n  const { clientReady } = useAuth();\n  if (!clientReady) {\n    throw new Error(\"@reifydb/auth: useAuthClient called before clientReady\");\n  }\n  return currentClient<TClient>();\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nexport type {\n  AuthCapableClient,\n  AuthSession,\n  AuthState,\n  AuthStatus,\n  CredentialAuthCapableClient,\n  LoginChallengeResult,\n  LoginResult,\n  PasswordCredentials,\n  WalletConnector,\n} from \"./types\";\n\nexport type { AuthTransport } from \"./transport\";\nexport {\n  httpTransport,\n  jsonHttpTransport,\n  jsonWsTransport,\n  wsTransport,\n} from \"./transport\";\n\nexport {\n  AuthContext,\n  AuthProvider,\n  type AuthContextValue,\n  type AuthProviderProps,\n} from \"./auth-provider\";\n\nexport { useAuth, useAuthClient } from \"./use-auth\";\n\nexport { performSignIn, type SignInArgs } from \"./sign-in\";\n\nexport {\n  performPasswordSignIn,\n  type PasswordSignInArgs,\n} from \"./sign-in-password\";\n\nexport {\n  clearStoredSession,\n  readStoredSession,\n  storageKeyFor,\n  writeStoredSession,\n} from \"./storage\";\n\nexport { clearClient, currentClient, ensureClient } from \"./client-cache\";\n\nexport * from \"@reifydb/core\";\nexport * from \"@reifydb/client\";\n"],"mappings":";AAGA;AAAA,EACE;AAAA,OAKK;AAWP,SAAS,sBAAsB,QAA2C;AACxE,MAAI,OAAO,OAAO,eAAe,YAAY;AAC3C,QAAI;AACF,aAAO,WAAW;AAAA,IACpB,QAAQ;AAAA,IACR;AAAA,EACF;AACF;AAEO,IAAM,cAAuC;AAAA,EAClD,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO;AAAA,MACZ;AAAA,MACA,SAAS,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI,EAAE,QAAQ,OAAO;AAAA,IAC/D;AAAA,EACF;AAAA,EACA,QAAQ,QAAQ;AACd,0BAAsB,MAAM;AAAA,EAC9B;AACF;AAEO,IAAM,gBAA2C;AAAA,EACtD,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO;AAAA,MACZ;AAAA,MACA,SAAS,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI,EAAE,QAAQ,OAAO;AAAA,IAC/D;AAAA,EACF;AAAA,EACA,QAAQ,SAAS;AAAA,EACjB;AACF;AAEO,IAAM,kBAA+C;AAAA,EAC1D,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO,cAAc,KAAK,SAAS,OAAO,EAAE,MAAM,IAAI,MAAS;AAAA,EACxE;AAAA,EACA,QAAQ,QAAQ;AACd,0BAAsB,MAAM;AAAA,EAC9B;AACF;AAEO,IAAM,oBAAmD;AAAA,EAC9D,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO,gBAAgB,KAAK,SAAS,OAAO,EAAE,MAAM,IAAI,MAAS;AAAA,EAC1E;AAAA,EACA,QAAQ,SAAS;AAAA,EACjB;AACF;;;ACpEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;;;ACFP,IAAI,aAA4B;AAChC,IAAI,eAAyC;AAC7C,IAAI,mBAAyC;AAC7C,IAAI,iBAAoD;AAExD,SAAS,MAAM,MAAc,KAAa,OAAuB;AAC/D,SAAO,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK;AAChC;AAEA,eAAsB,aACpB,WACA,KACA,OACY;AACZ,QAAM,MAAM,MAAM,UAAU,MAAM,KAAK,KAAK;AAE5C,MAAI,eAAe,KAAK;AACtB,QAAI,aAAc,QAAO;AACzB,QAAI,eAAgB,QAAO;AAAA,EAC7B;AAGA,MAAI,gBAAgB,kBAAkB;AACpC,QAAI;AACF,MAAC,iBAAsD,QAAQ,YAAY;AAAA,IAC7E,QAAQ;AAAA,IAER;AACA,mBAAe;AAAA,EACjB;AACA,eAAa;AACb,qBAAmB;AAEnB,QAAM,IAAI,UAAU,QAAQ,KAAK,KAAK,EAAE,KAAK,CAAC,WAAW;AAEvD,QAAI,eAAe,KAAK;AACtB,UAAI;AACF,kBAAU,QAAQ,MAAM;AAAA,MAC1B,QAAQ;AAAA,MAER;AACA,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AACA,mBAAe;AACf,qBAAiB;AACjB,WAAO;AAAA,EACT,CAAC;AACD,mBAAiB;AACjB,SAAO;AACT;AAEO,SAAS,cAAoB;AAClC,MAAI,gBAAgB,kBAAkB;AACpC,QAAI;AACF,MAAC,iBAAsD,QAAQ,YAAY;AAAA,IAC7E,QAAQ;AAAA,IACR;AAAA,EACF;AACA,eAAa;AACb,iBAAe;AACf,qBAAmB;AACnB,mBAAiB;AACnB;AAEO,SAAS,gBAAoE;AAClF,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,SAAO;AACT;;;AC/DA,eAAsB,cACpB,MACsB;AACtB,QAAM,EAAE,KAAK,WAAW,QAAQ,QAAQ,QAAQ,WAAW,kBAAkB,IAAI;AAEjF,QAAM,gBAAgB,OAAO;AAC7B,MAAI,iBAAiB,QAAQ,cAAc,WAAW,GAAG;AACvD,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,MAAI,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,GAAG;AACjE,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAEA,QAAM,SAAS,MAAM,UAAU,QAAQ,GAAG;AAC1C,MAAI;AACF,UAAM,YAAY,MAAM,OAAO,eAAe,QAAQ;AAAA,MACpD,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,UAAU,SAAS,aAAa;AAClC,YAAM,IAAI;AAAA,QACR,mDAAmD,UAAU,IAAI;AAAA,MACnE;AAAA,IACF;AAEA,UAAM,eAAe,IAAI,YAAY,EAAE,OAAO,UAAU,OAAO;AAC/D,UAAM,iBAAiB,MAAM,OAAO,YAAY,YAAY;AAC5D,UAAM,YAAY,OAAO,gBAAgB,cAAc;AAEvD,UAAM,OAAO,MAAM,OAAO,eAAe,QAAQ;AAAA,MAC/C,cAAc,UAAU;AAAA,MACxB;AAAA,MACA,gBAAgB,UAAU;AAAA,IAC5B,CAAC;AACD,QAAI,KAAK,SAAS,iBAAiB;AACjC,YAAM,IAAI;AAAA,QACR,uDAAuD,KAAK,IAAI;AAAA,MAClE;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf;AAAA,MACA,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,IAC7C;AAAA,EACF,UAAE;AACA,cAAU,QAAQ,MAAM;AAAA,EAC1B;AACF;;;AC/CA,SAAS,sBACP,QACuC;AACvC,SACE,OAAQ,OAAuC,sBAC/C;AAEJ;AAEA,eAAsB,sBACpB,MACsB;AACtB,QAAM,EAAE,KAAK,WAAW,YAAY,UAAU,kBAAkB,IAAI;AAEpE,MAAI,WAAW,WAAW,GAAG;AAC3B,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AACA,MAAI,SAAS,WAAW,GAAG;AACzB,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAI,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,GAAG;AACjE,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAEA,QAAM,SAAS,MAAM,UAAU,QAAQ,GAAG;AAC1C,MAAI;AACF,QAAI,CAAC,sBAAsB,MAAM,GAAG;AAClC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,OAAO,MAAM,OAAO,kBAAkB,YAAY,QAAQ;AAChE,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf,eAAe;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,MACR,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,IAC7C;AAAA,EACF,UAAE;AACA,cAAU,QAAQ,MAAM;AAAA,EAC1B;AACF;;;AC1DA,IAAM,SAAS;AAEf,SAAS,OAAO,WAA2B;AACzC,SAAO,GAAG,SAAS,GAAG,MAAM;AAC9B;AAOA,IAAM,aAAa;AAEnB,SAAS,WAAmB;AAC1B,MAAI;AACF,QAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe,YAAY;AAC5E,aAAO,OAAO,WAAW;AAAA,IAC3B;AAAA,EACF,QAAQ;AAAA,EACR;AACA,SAAO,KAAK,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5E;AAEA,SAAS,eAAuB;AAC9B,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACF,UAAM,WAAW,eAAe,QAAQ,UAAU;AAClD,QAAI,SAAU,QAAO;AACrB,UAAM,KAAK,SAAS;AACpB,mBAAe,QAAQ,YAAY,EAAE;AACrC,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO,SAAS;AAAA,EAClB;AACF;AAEA,IAAM,SAAS,aAAa;AAKrB,SAAS,mBAAmB,WAA2B;AAC5D,SAAO,GAAG,SAAS,IAAI,MAAM;AAC/B;AAEA,SAAS,cAAc,GAA8B;AACnD,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,QAAM,IAAI;AACV,MACE,EAAE,WAAW,UACb,EAAE,WAAW,YACb,EAAE,WAAW,cACb,EAAE,WAAW,SACb;AACA,WAAO;AAAA,EACT;AACA,MAAI,EAAE,eAAe,UAAa,OAAO,EAAE,eAAe,UAAU;AAClE,WAAO;AAAA,EACT;AACA,SACE,OAAO,EAAE,UAAU,YAAY,EAAE,MAAM,SAAS,KAChD,OAAO,EAAE,aAAa,YAAY,EAAE,SAAS,SAAS,KACtD,OAAO,EAAE,kBAAkB,YAAY,EAAE,cAAc,SAAS,KAChE,OAAO,EAAE,cAAc,YAAY,OAAO,SAAS,EAAE,SAAS,KAAK,EAAE,YAAY;AAErF;AAEA,SAAS,WAAW,WAAyB;AAC3C,MAAI;AACF,iBAAa,WAAW,OAAO,SAAS,CAAC;AAAA,EAC3C,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,kBAAkB,WAAuC;AACvE,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACJ,MAAI;AACF,UAAM,aAAa,QAAQ,OAAO,SAAS,CAAC;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,KAAM,QAAO;AACxB,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,eAAW,SAAS;AACpB,WAAO;AAAA,EACT;AACA,MAAI,CAAC,cAAc,MAAM,GAAG;AAC1B,eAAW,SAAS;AACpB,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,KAAK,IAAI,IAAI,KAAM;AACzC,eAAW,SAAS;AACpB,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,mBAAmB,WAAmB,SAA4B;AAChF,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI,CAAC,cAAc,OAAO,GAAG;AAC3B,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,MAAI;AACF,iBAAa,QAAQ,OAAO,SAAS,GAAG,KAAK,UAAU,OAAO,CAAC;AAAA,EACjE,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,mBAAmB,WAAyB;AAC1D,MAAI,OAAO,WAAW,YAAa;AACnC,aAAW,SAAS;AACtB;AAEO,SAAS,cAAc,WAA2B;AACvD,SAAO,OAAO,SAAS;AACzB;AAMO,SAAS,qBAAqB,eAA6B;AAChE,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI;AACF,UAAM,MAAM,KAAK,IAAI,IAAI;AACzB,UAAM,SAAS,OAAO,mBAAmB,aAAa,CAAC;AACvD,UAAM,SAAS,GAAG,aAAa;AAC/B,UAAM,OAAiB,CAAC;AACxB,aAAS,IAAI,GAAG,IAAI,aAAa,QAAQ,KAAK,GAAG;AAC/C,YAAM,IAAI,aAAa,IAAI,CAAC;AAC5B,UAAI,KAAK,QAAQ,MAAM,OAAQ;AAC/B,UAAI,CAAC,EAAE,WAAW,MAAM,KAAK,CAAC,EAAE,SAAS,MAAM,EAAG;AAClD,YAAM,MAAM,aAAa,QAAQ,CAAC;AAClC,UAAI,OAAO,KAAM;AACjB,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,GAAG;AAAA,MACzB,QAAQ;AACN;AAAA,MACF;AACA,UAAI,cAAc,MAAM,KAAK,OAAO,aAAa,KAAK;AACpD,aAAK,KAAK,CAAC;AAAA,MACb;AAAA,IACF;AACA,eAAW,KAAK,KAAM,cAAa,WAAW,CAAC;AAAA,EACjD,QAAQ;AAAA,EAER;AACF;;;AJsNS;AApVT,IAAM,sBAAsB;AAQrB,IAAM,cAAc,cAAuC,IAAI;AAwB/D,SAAS,aACd,OACc;AACd,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,oBAAoB;AAAA,IACpB;AAAA,IACA,eAAe;AAAA,IACf;AAAA,EACF,IAAI;AAKJ,QAAM,qBACJ,iBAAiB,YACb,mBACA,mBAAmB,gBAAgB;AAEzC,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,MAAM;AACtD,UAAM,SAAS,kBAAkB,kBAAkB;AACnD,WAAO,SACH,EAAE,QAAQ,aAAa,SAAS,QAAQ,aAAa,OAAO,OAAO,KAAK,IACxE,EAAE,QAAQ,gBAAgB,SAAS,MAAM,aAAa,OAAO,OAAO,KAAK;AAAA,EAC/E,CAAC;AAGD,QAAM,kBAAkB,QAAQ,aAAa;AAC7C,QAAM,mBAAmB,QAAQ,cAAc;AAC/C,QAAM,kBAAkB,QAAQ,aAAa;AAC7C,QAAM,oBAAoB,QAAQ,qBAAqB;AAGvD,QAAM,aAAa,OAAO,MAAM,OAAO;AACvC,aAAW,UAAU,MAAM;AAC3B,QAAM,YAAY,OAAO,MAAM;AAC/B,YAAU,UAAU;AAEpB,QAAM,WAAW;AAAA,IACf,CAAC,YAAqC,cAA6B;AACjE,yBAAmB,kBAAkB;AACrC,kBAAY;AACZ,eAAS;AAAA,QACP,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IACA,CAAC,kBAAkB;AAAA,EACrB;AAKA,YAAU,MAAM;AACd,UAAM,UAAU,MAAM;AACtB,QAAI,WAAW,KAAM;AAErB,UAAM,YAAY,MAAM;AACtB,UAAI,YAAY;AAChB,mBAAa,WAAW,KAAK,QAAQ,KAAK,EACvC,KAAK,MAAM;AACV,YAAI,UAAW;AACf;AAAA,UAAS,CAAC,SACR,KAAK,YAAY,UACb,EAAE,GAAG,MAAM,QAAQ,iBAAiB,aAAa,MAAM,OAAO,KAAK,IACnE;AAAA,QACN;AAAA,MACF,CAAC,EACA,MAAM,CAAC,QAAiB;AACvB,YAAI,UAAW;AACf,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,gBAAQ,MAAM,kCAAkC,SAAS,GAAG;AAC5D,iBAAS,SAAS,OAAO;AAAA,MAC3B,CAAC;AACH,aAAO,MAAM;AACX,oBAAY;AAAA,MACd;AAAA,IACF;AAIA,QAAI,QAAQ,UAAU,QAAQ,QAAQ,WAAW,UAAU;AACzD,aAAO,UAAU;AAAA,IACnB;AAEA,QAAI,mBAAmB,mBAAmB,MAAM;AAC9C,UAAI,oBAAoB,QAAQ,eAAe;AAC7C,iBAAS,gBAAgB,IAAI;AAC7B;AAAA,MACF;AACA,aAAO,UAAU;AAAA,IACnB;AAEA,QAAI,CAAC,oBAAoB,oBAAoB,oBAAoB;AAG/D;AAAA,QAAS,CAAC,SACR,KAAK,YAAY,UACb,EAAE,GAAG,MAAM,QAAQ,aAAa,aAAa,MAAM,IACnD;AAAA,MACN;AACA;AAAA,IACF;AAIA,aAAS,gBAAgB,IAAI;AAAA,EAC/B,GAAG;AAAA,IACD,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,YAAU,MAAM;AACd,QAAI,OAAO,WAAW,YAAa;AACnC,UAAM,MAAM,cAAc,kBAAkB;AAC5C,UAAM,YAAY,CAAC,MAAoB;AACrC,UAAI,EAAE,QAAQ,IAAK;AACnB,YAAM,UAAU,WAAW;AAG3B,UAAI,EAAE,YAAY,MAAM;AACtB,YAAI,WAAW,KAAM,UAAS,gBAAgB,IAAI;AAClD;AAAA,MACF;AAEA,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,EAAE,QAAQ;AAAA,MAChC,QAAQ;AAGN,YAAI,WAAW,KAAM,UAAS,gBAAgB,IAAI;AAClD;AAAA,MACF;AAMA,UAAI,WAAW,KAAM;AAGrB,UACE,OAAO,kBAAkB,QAAQ,iBACjC,OAAO,aAAa,QAAQ,UAC5B;AACA,cAAM,WACJ,iBAAiB,YAAY,kBAAkB,kBAAkB,IAAI;AACvE,YAAI,YAAY,MAAM;AACpB,mBAAS,gBAAgB,IAAI;AAC7B;AAAA,QACF;AACA,iBAAS,EAAE,QAAQ,aAAa,SAAS,UAAU,aAAa,OAAO,OAAO,KAAK,CAAC;AAAA,MACtF;AAAA,IAIF;AACA,WAAO,iBAAiB,WAAW,SAAS;AAC5C,WAAO,MAAM;AACX,aAAO,oBAAoB,WAAW,SAAS;AAAA,IACjD;AAAA,EACF,GAAG,CAAC,oBAAoB,cAAc,QAAQ,CAAC;AAG/C,YAAU,MAAM;AACd,yBAAqB,gBAAgB;AAAA,EACvC,GAAG,CAAC,gBAAgB,CAAC;AAErB,QAAM,SAAS,YAAY,OAAO,gBAAsC;AACtE,QAAI,eAAe,MAAM;AACvB,eAAS,CAAC,UAAU,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,KAAK,EAAE;AAChE,UAAI;AACF,cAAM,UAAU,MAAM,sBAAsB;AAAA,UAC1C;AAAA,UACA;AAAA,UACA,YAAY,YAAY;AAAA,UACxB,UAAU,YAAY;AAAA,UACtB;AAAA,QACF,CAAC;AACD,2BAAmB,oBAAoB,OAAO;AAC9C,iBAAS;AAAA,UACP,QAAQ;AAAA,UACR;AAAA,UACA,aAAa;AAAA,UACb,OAAO;AAAA,QACT,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,iBAAS;AAAA,UACP,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,aAAa;AAAA,UACb,OAAO;AAAA,QACT,CAAC;AAAA,MACH;AACA;AAAA,IACF;AAEA,UAAM,IAAI,UAAU;AACpB,QAAI,KAAK,QAAQ,CAAC,EAAE,aAAa,EAAE,aAAa,MAAM;AACpD,cAAQ,MAAM,sCAAsC;AACpD,eAAS,CAAC,UAAU,EAAE,GAAG,MAAM,QAAQ,SAAS,OAAO,uBAAuB,EAAE;AAChF;AAAA,IACF;AACA,QAAI,UAAU,QAAQ,UAAU,QAAQ,aAAa,MAAM;AACzD,eAAS,CAAC,UAAU;AAAA,QAClB,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,OAAO;AAAA,MACT,EAAE;AACF;AAAA,IACF;AACA,aAAS,CAAC,UAAU,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,KAAK,EAAE;AAChE,QAAI;AACF,YAAM,UAAU,MAAM,cAAc;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAGD,UAAI,QAAQ,kBAAkB,UAAU,SAAS,WAAW;AAC1D,cAAM,IAAI,MAAM,+BAA+B;AAAA,MACjD;AACA,yBAAmB,oBAAoB,OAAO;AAC9C,eAAS;AAAA,QACP,QAAQ;AAAA,QACR;AAAA,QACA,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,cAAQ,MAAM,kCAAkC,SAAS,GAAG;AAC5D,eAAS;AAAA,QACP,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAKD,QAAM,eAAe;AAAA,IACnB,CAAC,YAAyB;AACxB,yBAAmB,oBAAoB,OAAO;AAC9C,eAAS;AAAA,QACP,QAAQ;AAAA,QACR;AAAA,QACA,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IACA,CAAC,kBAAkB;AAAA,EACrB;AAEA,QAAM,UAAU,YAAY,YAAY;AAEtC,QAAI;AACF,YAAM,cAAc,EAAE,OAAO;AAAA,IAC/B,QAAQ;AAAA,IAER;AACA,aAAS,gBAAgB,IAAI;AAAA,EAC/B,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,QAAQ;AAAA,IACZ,OAAO;AAAA,MACL,QAAQ,MAAM;AAAA,MACd,SAAS,MAAM;AAAA,MACf,aAAa,MAAM;AAAA,MACnB,OAAO,MAAM;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,CAAC,OAAO,QAAQ,cAAc,OAAO;AAAA,EACvC;AAEA,SAAO,oBAAC,YAAY,UAAZ,EAAqB,OAAe,UAAS;AACvD;;;AKpXA,SAAS,kBAAkB;AAMpB,SAAS,UAA4B;AAC1C,QAAM,MAAM,WAAW,WAAW;AAClC,MAAI,OAAO,MAAM;AACf,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO;AACT;AAEO,SAAS,gBAEH;AACX,QAAM,EAAE,YAAY,IAAI,QAAQ;AAChC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,SAAO,cAAuB;AAChC;;;ACuBA,cAAc;AACd,cAAc;","names":[]}
+{"version":3,"sources":["../src/transport.ts","../src/auth-provider.tsx","../src/client-cache.ts","../src/sign-in.ts","../src/sign-in-password.ts","../src/storage.ts","../src/use-auth.ts","../src/sign-in-guest.ts","../src/index.ts"],"sourcesContent":["// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport {\n  Client,\n  type WsClient,\n  type HttpClient,\n  type JsonWsClient,\n  type JsonHttpClient,\n} from \"@reifydb/client\";\nimport type { AuthCapableClient } from \"./types\";\n\nexport interface AuthTransport<\n  TClient extends AuthCapableClient = AuthCapableClient,\n> {\n  readonly kind: \"ws\" | \"http\";\n  connect(url: string, token?: string): Promise<TClient>;\n  release(client: TClient): void;\n}\n\nfunction releaseWithDisconnect(client: { disconnect?: () => void }): void {\n  if (typeof client.disconnect === \"function\") {\n    try {\n      client.disconnect();\n    } catch {\n    }\n  }\n}\n\nexport const wsTransport: AuthTransport<WsClient> = {\n  kind: \"ws\",\n  async connect(url, token) {\n    return Client.connectWs(\n      url,\n      token != null ? { format: \"rbcf\", token } : { format: \"rbcf\" },\n    );\n  },\n  release(client) {\n    releaseWithDisconnect(client);\n  },\n};\n\nexport const httpTransport: AuthTransport<HttpClient> = {\n  kind: \"http\",\n  async connect(url, token) {\n    return Client.connectHttp(\n      url,\n      token != null ? { format: \"rbcf\", token } : { format: \"rbcf\" },\n    );\n  },\n  release(_client) {\n  },\n};\n\nexport const jsonWsTransport: AuthTransport<JsonWsClient> = {\n  kind: \"ws\",\n  async connect(url, token) {\n    return Client.connectJsonWs(url, token != null ? { token } : undefined);\n  },\n  release(client) {\n    releaseWithDisconnect(client);\n  },\n};\n\nexport const jsonHttpTransport: AuthTransport<JsonHttpClient> = {\n  kind: \"http\",\n  async connect(url, token) {\n    return Client.connectJsonHttp(url, token != null ? { token } : undefined);\n  },\n  release(_client) {\n  },\n};\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport React, {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactElement,\n  type ReactNode,\n} from \"react\";\n\nimport { clearClient, currentClient, ensureClient } from \"./client-cache\";\nimport { performSignIn } from \"./sign-in\";\nimport { performPasswordSignIn } from \"./sign-in-password\";\nimport {\n  clearStoredSession,\n  readStoredSession,\n  storageKeyFor,\n  sweepExpiredSessions,\n  tabScopedNamespace,\n  writeStoredSession,\n} from \"./storage\";\nimport type {\n  AuthCapableClient,\n  AuthSession,\n  AuthState,\n  PasswordCredentials,\n  WalletConnector,\n} from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\nconst DEFAULT_TTL_SECONDS = 86400;\n\nexport interface AuthContextValue extends AuthState {\n  signIn(credentials?: PasswordCredentials): Promise<void>;\n  adoptSession(session: AuthSession): void;\n  signOut(): Promise<void>;\n}\n\nexport const AuthContext = createContext<AuthContextValue | null>(null);\n\nexport interface AuthProviderProps<\n  TClient extends AuthCapableClient = AuthCapableClient,\n> {\n  url: string;\n  transport: AuthTransport<TClient>;\n  storageNamespace: string;\n  method?: string;\n  domain?: string;\n  statement?: string;\n  sessionTtlSeconds?: number;\n  wallet?: WalletConnector;\n  sessionScope?: \"tab\" | \"browser\";\n  children: ReactNode;\n}\n\ninterface InternalState {\n  status: AuthState[\"status\"];\n  session: AuthSession | null;\n  clientReady: boolean;\n  error: string | null;\n}\n\nexport function AuthProvider<TClient extends AuthCapableClient>(\n  props: AuthProviderProps<TClient>,\n): ReactElement {\n  const {\n    url,\n    transport,\n    storageNamespace,\n    method,\n    domain,\n    statement,\n    sessionTtlSeconds = DEFAULT_TTL_SECONDS,\n    wallet,\n    sessionScope = \"tab\",\n    children,\n  } = props;\n\n  // Per-tab storage slot: each tab gets its own localStorage key so concurrent\n  // sign-ins in different tabs cannot stomp each other's session. With\n  // sessionScope \"browser\" all tabs deliberately share one slot instead.\n  const effectiveNamespace =\n    sessionScope === \"browser\"\n      ? storageNamespace\n      : tabScopedNamespace(storageNamespace);\n\n  const [state, setState] = useState<InternalState>(() => {\n    const stored = readStoredSession(effectiveNamespace);\n    return stored\n      ? { status: \"verifying\", session: stored, clientReady: false, error: null }\n      : { status: \"disconnected\", session: null, clientReady: false, error: null };\n  });\n\n  // Pull live wallet fields into stable primitives for effect deps.\n  const walletConnected = wallet?.connected ?? false;\n  const walletConnecting = wallet?.connecting ?? false;\n  const walletPublicKey = wallet?.publicKey ?? null;\n  const walletHasSelected = wallet?.hasSelectedWallet ?? false;\n\n  // Refs so callbacks can read latest values without re-binding.\n  const sessionRef = useRef(state.session);\n  sessionRef.current = state.session;\n  const walletRef = useRef(wallet);\n  walletRef.current = wallet;\n\n  const tearDown = useCallback(\n    (nextStatus: InternalState[\"status\"], nextError: string | null) => {\n      clearStoredSession(effectiveNamespace);\n      clearClient();\n      setState({\n        status: nextStatus,\n        session: null,\n        clientReady: false,\n        error: nextError,\n      });\n    },\n    [effectiveNamespace],\n  );\n\n  // Session gate. Password sessions connect directly; wallet sessions keep the\n  // security invariant: the authenticated client is only ever constructed when\n  // the connected wallet matches the persisted session.\n  useEffect(() => {\n    const session = state.session;\n    if (session == null) return;\n\n    const establish = () => {\n      let cancelled = false;\n      ensureClient(transport, url, session.token)\n        .then(() => {\n          if (cancelled) return;\n          setState((prev) =>\n            prev.session === session\n              ? { ...prev, status: \"authenticated\", clientReady: true, error: null }\n              : prev,\n          );\n        })\n        .catch((err: unknown) => {\n          if (cancelled) return;\n          const message = err instanceof Error ? err.message : \"Failed to connect client\";\n          tearDown(\"error\", message);\n        });\n      return () => {\n        cancelled = true;\n      };\n    };\n\n    // Credential-bound sessions (password, or a token minted server-side) carry\n    // no wallet to prove, so they connect straight away.\n    if (session.method != null && session.method !== \"wallet\") {\n      return establish();\n    }\n\n    if (walletConnected && walletPublicKey != null) {\n      if (walletPublicKey !== session.walletAddress) {\n        tearDown(\"disconnected\", null);\n        return;\n      }\n      return establish();\n    }\n\n    if (!walletConnected && (walletConnecting || walletHasSelected)) {\n      // Wallet adapter is autoConnecting; stay in verifying. Do NOT construct\n      // the client yet - we must not authenticate before the match is confirmed.\n      setState((prev) =>\n        prev.session === session\n          ? { ...prev, status: \"verifying\", clientReady: false }\n          : prev,\n      );\n      return;\n    }\n\n    // Wallet is definitively absent (no selected wallet, not connecting). User\n    // explicitly disconnected, so the session can no longer be proven; tear down.\n    tearDown(\"disconnected\", null);\n  }, [\n    state.session,\n    walletConnected,\n    walletConnecting,\n    walletPublicKey,\n    walletHasSelected,\n    transport,\n    url,\n    tearDown,\n  ]);\n\n  useEffect(() => {\n    if (typeof window === \"undefined\") return;\n    const key = storageKeyFor(effectiveNamespace);\n    const onStorage = (e: StorageEvent) => {\n      if (e.key !== key) return;\n      const current = sessionRef.current;\n\n      // Another tab signed out / cleared the session.\n      if (e.newValue == null) {\n        if (current != null) tearDown(\"disconnected\", null);\n        return;\n      }\n\n      let parsed: Partial<AuthSession>;\n      try {\n        parsed = JSON.parse(e.newValue) as Partial<AuthSession>;\n      } catch {\n        // Corrupt entry written by another tab. Only react if we actually hold\n        // a session; otherwise there is nothing to defend.\n        if (current != null) tearDown(\"disconnected\", null);\n        return;\n      }\n\n      // We hold no session of our own: nothing to defend. Clearing storage here\n      // would clobber the session the other tab just wrote (and bounce it back\n      // out through this same handler). Let our own sign-in / autoConnect flow\n      // converge independently.\n      if (current == null) return;\n\n      // A genuinely different principal took over our storage slot.\n      if (\n        parsed.walletAddress !== current.walletAddress ||\n        parsed.identity !== current.identity\n      ) {\n        const followed =\n          sessionScope === \"browser\" ? readStoredSession(effectiveNamespace) : null;\n        if (followed == null) {\n          tearDown(\"disconnected\", null);\n          return;\n        }\n        setState({ status: \"verifying\", session: followed, clientReady: false, error: null });\n      }\n\n      // Same principal, different token: a concurrent sign-in in another tab,\n      // not an intrusion. Keep our own still-valid client.\n    };\n    window.addEventListener(\"storage\", onStorage);\n    return () => {\n      window.removeEventListener(\"storage\", onStorage);\n    };\n  }, [effectiveNamespace, sessionScope, tearDown]);\n\n  // Housekeeping: drop expired per-tab slots left behind by closed tabs.\n  useEffect(() => {\n    sweepExpiredSessions(storageNamespace);\n  }, [storageNamespace]);\n\n  const signIn = useCallback(async (credentials?: PasswordCredentials) => {\n    if (credentials != null) {\n      setState((prev) => ({ ...prev, status: \"signing\", error: null }));\n      try {\n        const session = await performPasswordSignIn({\n          url,\n          transport,\n          identifier: credentials.identifier,\n          password: credentials.password,\n          sessionTtlSeconds,\n          session: sessionRef.current,\n        });\n        writeStoredSession(effectiveNamespace, session);\n        setState({\n          status: \"verifying\",\n          session,\n          clientReady: false,\n          error: null,\n        });\n      } catch (err) {\n        const message = err instanceof Error ? err.message : \"Sign in failed\";\n        setState((prev) =>\n          prev.session != null\n            ? { ...prev, status: prev.clientReady ? \"authenticated\" : \"verifying\", error: message }\n            : { status: \"error\", session: null, clientReady: false, error: message },\n        );\n      }\n      return;\n    }\n\n    const w = walletRef.current;\n    if (w == null || !w.connected || w.publicKey == null) {\n      setState((prev) => ({ ...prev, status: \"error\", error: \"Wallet not connected\" }));\n      return;\n    }\n    if (method == null || domain == null || statement == null) {\n      setState((prev) => ({\n        ...prev,\n        status: \"error\",\n        error: \"Wallet sign in requires method, domain, and statement\",\n      }));\n      return;\n    }\n    setState((prev) => ({ ...prev, status: \"signing\", error: null }));\n    try {\n      const session = await performSignIn({\n        url,\n        transport,\n        method,\n        wallet: w,\n        domain,\n        statement,\n        sessionTtlSeconds,\n        session: sessionRef.current,\n      });\n      // Sanity: signed-in wallet must match the live publicKey. If the user\n      // swapped wallets while the signature was in flight, refuse the session.\n      if (session.walletAddress !== walletRef.current?.publicKey) {\n        throw new Error(\"Wallet changed during sign in\");\n      }\n      writeStoredSession(effectiveNamespace, session);\n      setState({\n        status: \"verifying\",\n        session,\n        clientReady: false,\n        error: null,\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Sign in failed\";\n      setState((prev) =>\n        prev.session != null\n          ? { ...prev, status: prev.clientReady ? \"authenticated\" : \"verifying\", error: message }\n          : { status: \"error\", session: null, clientReady: false, error: message },\n      );\n    }\n  }, [\n    url,\n    transport,\n    method,\n    domain,\n    statement,\n    sessionTtlSeconds,\n    effectiveNamespace,\n  ]);\n\n  // Adopt a session minted outside the sign-in flows - a guest session handed\n  // out by the application server, for instance. The session gate below picks\n  // it up and connects the client exactly as it would after a sign-in.\n  const adoptSession = useCallback(\n    (session: AuthSession) => {\n      writeStoredSession(effectiveNamespace, session);\n      setState({\n        status: \"verifying\",\n        session,\n        clientReady: false,\n        error: null,\n      });\n    },\n    [effectiveNamespace],\n  );\n\n  const signOut = useCallback(async () => {\n    // Best-effort server-side logout via the currently-cached client.\n    try {\n      await currentClient().logout();\n    } catch {\n      // no current client, or server-side logout failed; tear down regardless\n    }\n    tearDown(\"disconnected\", null);\n  }, [tearDown]);\n\n  const value = useMemo<AuthContextValue>(\n    () => ({\n      status: state.status,\n      session: state.session,\n      clientReady: state.clientReady,\n      error: state.error,\n      signIn,\n      adoptSession,\n      signOut,\n    }),\n    [state, signIn, adoptSession, signOut],\n  );\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthCapableClient } from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\n// Module-level dedupe: in React StrictMode (dev) the AuthProvider effect runs\n// twice with the same inputs, which previously opened two sockets. We cache the\n// in-flight promise so both runs share one connection.\n\nlet currentKey: string | null = null;\nlet cachedClient: AuthCapableClient | null = null;\nlet currentTransport: AuthTransport | null = null;\nlet pendingPromise: Promise<AuthCapableClient> | null = null;\n\nfunction keyOf(kind: string, url: string, token: string): string {\n  return `${kind}|${url}|${token}`;\n}\n\nexport async function ensureClient<T extends AuthCapableClient>(\n  transport: AuthTransport<T>,\n  url: string,\n  token: string,\n): Promise<T> {\n  const key = keyOf(transport.kind, url, token);\n\n  if (currentKey === key) {\n    if (cachedClient) return cachedClient as T;\n    if (pendingPromise) return pendingPromise as Promise<T>;\n  }\n\n  // New (kind, url, token) — release any prior client, start fresh.\n  if (cachedClient && currentTransport) {\n    try {\n      (currentTransport as AuthTransport<AuthCapableClient>).release(cachedClient);\n    } catch {\n      // release must be idempotent; ignore\n    }\n    cachedClient = null;\n  }\n  currentKey = key;\n  currentTransport = transport as AuthTransport;\n\n  const p = transport.connect(url, token).then((client) => {\n    // Another ensure/clear ran while we were connecting — drop this one.\n    if (currentKey !== key) {\n      try {\n        transport.release(client);\n      } catch {\n        // ignore\n      }\n      throw new Error(\"@reifydb/auth: client connect superseded\");\n    }\n    cachedClient = client;\n    pendingPromise = null;\n    return client;\n  });\n  pendingPromise = p as Promise<AuthCapableClient>;\n  return p;\n}\n\nexport function clearClient(): void {\n  if (cachedClient && currentTransport) {\n    try {\n      (currentTransport as AuthTransport<AuthCapableClient>).release(cachedClient);\n    } catch {\n    }\n  }\n  currentKey = null;\n  cachedClient = null;\n  currentTransport = null;\n  pendingPromise = null;\n}\n\nexport function currentClient<T extends AuthCapableClient = AuthCapableClient>(): T {\n  if (!cachedClient) {\n    throw new Error(\"@reifydb/auth: no authenticated client; call ensureClient first\");\n  }\n  return cachedClient as T;\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthCapableClient, AuthSession, WalletConnector } from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\nexport interface SignInArgs<TClient extends AuthCapableClient = AuthCapableClient> {\n  url: string;\n  transport: AuthTransport<TClient>;\n  method: string;\n  wallet: Pick<WalletConnector, \"publicKey\" | \"signMessage\" | \"encodeSignature\">;\n  domain: string;\n  statement: string;\n  sessionTtlSeconds: number;\n  session?: AuthSession | null;\n}\n\nexport async function performSignIn<TClient extends AuthCapableClient>(\n  args: SignInArgs<TClient>,\n): Promise<AuthSession> {\n  const { url, transport, method, wallet, domain, statement, sessionTtlSeconds, session } = args;\n\n  const walletAddress = wallet.publicKey;\n  if (walletAddress == null || walletAddress.length === 0) {\n    throw new Error(\"@reifydb/auth: wallet.publicKey is required to sign in\");\n  }\n  if (!Number.isFinite(sessionTtlSeconds) || sessionTtlSeconds <= 0) {\n    throw new Error(\"@reifydb/auth: sessionTtlSeconds must be a positive number\");\n  }\n\n  const token =\n    session != null && session.expiresAt > Date.now() / 1000 ? session.token : undefined;\n  const client = await transport.connect(url, token);\n  try {\n    const challenge = await client.loginChallenge(method, {\n      identifier: walletAddress,\n      public_key: walletAddress,\n      domain,\n      statement,\n    });\n    if (challenge.kind !== \"challenge\") {\n      throw new Error(\n        `@reifydb/auth: expected challenge response, got ${challenge.kind}`,\n      );\n    }\n\n    const messageBytes = new TextEncoder().encode(challenge.message);\n    const signatureBytes = await wallet.signMessage(messageBytes);\n    const signature = wallet.encodeSignature(signatureBytes);\n\n    const auth = await client.loginChallenge(method, {\n      challenge_id: challenge.challengeId,\n      signature,\n      signed_message: challenge.message,\n    });\n    if (auth.kind !== \"authenticated\") {\n      throw new Error(\n        `@reifydb/auth: expected authenticated response, got ${auth.kind}`,\n      );\n    }\n\n    return {\n      token: auth.token,\n      identity: auth.identity,\n      walletAddress,\n      expiresAt: Math.floor(Date.now() / 1000) + sessionTtlSeconds,\n    };\n  } finally {\n    transport.release(client);\n  }\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type {\n  AuthCapableClient,\n  AuthSession,\n  CredentialAuthCapableClient,\n} from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\nexport interface PasswordSignInArgs<\n  TClient extends AuthCapableClient = AuthCapableClient,\n> {\n  url: string;\n  transport: AuthTransport<TClient>;\n  identifier: string;\n  password: string;\n  sessionTtlSeconds: number;\n  session?: AuthSession | null;\n}\n\nfunction supportsPasswordLogin(\n  client: AuthCapableClient,\n): client is CredentialAuthCapableClient {\n  return (\n    typeof (client as CredentialAuthCapableClient).loginWithPassword ===\n    \"function\"\n  );\n}\n\nexport async function performPasswordSignIn<TClient extends AuthCapableClient>(\n  args: PasswordSignInArgs<TClient>,\n): Promise<AuthSession> {\n  const { url, transport, identifier, password, sessionTtlSeconds, session } = args;\n\n  if (identifier.length === 0) {\n    throw new Error(\"@reifydb/auth: identifier is required to sign in\");\n  }\n  if (password.length === 0) {\n    throw new Error(\"@reifydb/auth: password is required to sign in\");\n  }\n  if (!Number.isFinite(sessionTtlSeconds) || sessionTtlSeconds <= 0) {\n    throw new Error(\"@reifydb/auth: sessionTtlSeconds must be a positive number\");\n  }\n\n  const token =\n    session != null && session.expiresAt > Date.now() / 1000 ? session.token : undefined;\n  const client = await transport.connect(url, token);\n  try {\n    if (!supportsPasswordLogin(client)) {\n      throw new Error(\n        \"@reifydb/auth: transport client does not support loginWithPassword\",\n      );\n    }\n    const auth = await client.loginWithPassword(identifier, password);\n    return {\n      token: auth.token,\n      identity: auth.identity,\n      walletAddress: identifier,\n      identifier,\n      method: \"password\",\n      expiresAt: Math.floor(Date.now() / 1000) + sessionTtlSeconds,\n    };\n  } finally {\n    transport.release(client);\n  }\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthSession } from \"./types\";\n\nconst SUFFIX = \".auth\";\n\nfunction keyFor(namespace: string): string {\n  return `${namespace}${SUFFIX}`;\n}\n\n// A per-tab id so two tabs never share one localStorage slot and stomp each\n// other's session. Backed by sessionStorage: stable across reloads within a\n// tab, unique per tab, gone when the tab closes. Falls back to an ephemeral\n// in-memory id when sessionStorage or crypto.randomUUID is unavailable\n// (degraded: the session will not survive a reload).\nconst TAB_ID_KEY = \"reifydb.auth.tab\";\n\nfunction newTabId(): string {\n  try {\n    if (typeof crypto !== \"undefined\" && typeof crypto.randomUUID === \"function\") {\n      return crypto.randomUUID();\n    }\n  } catch {\n  }\n  return `t-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;\n}\n\nfunction resolveTabId(): string {\n  if (typeof window === \"undefined\") return \"ssr\";\n  try {\n    const existing = sessionStorage.getItem(TAB_ID_KEY);\n    if (existing) return existing;\n    const id = newTabId();\n    sessionStorage.setItem(TAB_ID_KEY, id);\n    return id;\n  } catch {\n    // sessionStorage unavailable (private mode, disabled): ephemeral id.\n    return newTabId();\n  }\n}\n\nconst TAB_ID = resolveTabId();\n\n// Scopes a caller's namespace to this browser tab. AuthProvider feeds the\n// result into every storage operation so each tab gets its own slot and the\n// cross-tab `storage` listener filters other tabs out by key.\nexport function tabScopedNamespace(namespace: string): string {\n  return `${namespace}.${TAB_ID}`;\n}\n\nfunction isAuthSession(v: unknown): v is AuthSession {\n  if (v === null || typeof v !== \"object\") return false;\n  const o = v as Record<string, unknown>;\n  if (\n    o.method !== undefined &&\n    o.method !== \"wallet\" &&\n    o.method !== \"password\" &&\n    o.method !== \"token\" &&\n    o.method !== \"guest\"\n  ) {\n    return false;\n  }\n  if (o.identifier !== undefined && typeof o.identifier !== \"string\") {\n    return false;\n  }\n  return (\n    typeof o.token === \"string\" && o.token.length > 0 &&\n    typeof o.identity === \"string\" && o.identity.length > 0 &&\n    typeof o.walletAddress === \"string\" && o.walletAddress.length > 0 &&\n    typeof o.expiresAt === \"number\" && Number.isFinite(o.expiresAt) && o.expiresAt > 0\n  );\n}\n\nfunction safeRemove(namespace: string): void {\n  try {\n    localStorage.removeItem(keyFor(namespace));\n  } catch {\n    // localStorage may be unavailable; ignore\n  }\n}\n\nexport function readStoredSession(namespace: string): AuthSession | null {\n  if (typeof window === \"undefined\") return null;\n  let raw: string | null;\n  try {\n    raw = localStorage.getItem(keyFor(namespace));\n  } catch {\n    return null;\n  }\n  if (raw == null) return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    safeRemove(namespace);\n    return null;\n  }\n  if (!isAuthSession(parsed)) {\n    safeRemove(namespace);\n    return null;\n  }\n  if (parsed.expiresAt <= Date.now() / 1000) {\n    safeRemove(namespace);\n    return null;\n  }\n  return parsed;\n}\n\nexport function writeStoredSession(namespace: string, session: AuthSession): void {\n  if (typeof window === \"undefined\") return;\n  if (!isAuthSession(session)) {\n    throw new Error(\"@reifydb/auth: refusing to persist malformed session\");\n  }\n  try {\n    localStorage.setItem(keyFor(namespace), JSON.stringify(session));\n  } catch {\n    // localStorage may be unavailable (private mode, full quota); ignore.\n  }\n}\n\nexport function clearStoredSession(namespace: string): void {\n  if (typeof window === \"undefined\") return;\n  safeRemove(namespace);\n}\n\nexport function storageKeyFor(namespace: string): string {\n  return keyFor(namespace);\n}\n\n// Closed tabs leave their per-tab slot in localStorage forever - nothing ever\n// reads that namespace again. Sweep once on mount: drop slots under\n// `baseNamespace` that belong to other tabs and have already expired. Live\n// tabs' slots have a future `expires_at` and are never touched.\nexport function sweepExpiredSessions(baseNamespace: string): void {\n  if (typeof window === \"undefined\") return;\n  try {\n    const now = Date.now() / 1000;\n    const ownKey = keyFor(tabScopedNamespace(baseNamespace));\n    const prefix = `${baseNamespace}.`;\n    const dead: string[] = [];\n    for (let i = 0; i < localStorage.length; i += 1) {\n      const k = localStorage.key(i);\n      if (k == null || k === ownKey) continue;\n      if (!k.startsWith(prefix) || !k.endsWith(SUFFIX)) continue;\n      const raw = localStorage.getItem(k);\n      if (raw == null) continue;\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(raw);\n      } catch {\n        continue;\n      }\n      if (isAuthSession(parsed) && parsed.expiresAt <= now) {\n        dead.push(k);\n      }\n    }\n    for (const k of dead) localStorage.removeItem(k);\n  } catch {\n    // localStorage unavailable; nothing to sweep.\n  }\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport { useContext } from \"react\";\n\nimport { AuthContext, type AuthContextValue } from \"./auth-provider\";\nimport { currentClient } from \"./client-cache\";\nimport type { AuthCapableClient } from \"./types\";\n\nexport function useAuth(): AuthContextValue {\n  const ctx = useContext(AuthContext);\n  if (ctx == null) {\n    throw new Error(\"@reifydb/auth: useAuth must be used inside <AuthProvider>\");\n  }\n  return ctx;\n}\n\nexport function useAuthClient<\n  TClient extends AuthCapableClient = AuthCapableClient,\n>(): TClient {\n  const { clientReady } = useAuth();\n  if (!clientReady) {\n    throw new Error(\"@reifydb/auth: useAuthClient called before clientReady\");\n  }\n  return currentClient<TClient>();\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type {\n  AuthCapableClient,\n  AuthSession,\n  GuestAuthCapableClient,\n} from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\nexport interface GuestSignInArgs<\n  TClient extends AuthCapableClient = AuthCapableClient,\n> {\n  url: string;\n  transport: AuthTransport<TClient>;\n  sessionTtlSeconds: number;\n}\n\nfunction supportsLogin(\n  client: AuthCapableClient,\n): client is GuestAuthCapableClient {\n  return typeof (client as GuestAuthCapableClient).login === \"function\";\n}\n\nexport async function performGuestSignIn<TClient extends AuthCapableClient>(\n  args: GuestSignInArgs<TClient>,\n): Promise<AuthSession> {\n  const { url, transport, sessionTtlSeconds } = args;\n\n  if (!Number.isFinite(sessionTtlSeconds) || sessionTtlSeconds <= 0) {\n    throw new Error(\"@reifydb/auth: sessionTtlSeconds must be a positive number\");\n  }\n\n  const client = await transport.connect(url);\n  try {\n    if (!supportsLogin(client)) {\n      throw new Error(\"@reifydb/auth: transport client does not support login\");\n    }\n    const auth = await client.login(\"guest\", {});\n    return {\n      token: auth.token,\n      identity: auth.identity,\n      walletAddress: auth.identity,\n      method: \"guest\",\n      expiresAt: Math.floor(Date.now() / 1000) + sessionTtlSeconds,\n    };\n  } finally {\n    transport.release(client);\n  }\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nexport type {\n  AuthCapableClient,\n  AuthSession,\n  AuthState,\n  AuthStatus,\n  CredentialAuthCapableClient,\n  GuestAuthCapableClient,\n  LoginChallengeResult,\n  LoginResult,\n  PasswordCredentials,\n  WalletConnector,\n} from \"./types\";\n\nexport type { AuthTransport } from \"./transport\";\nexport {\n  httpTransport,\n  jsonHttpTransport,\n  jsonWsTransport,\n  wsTransport,\n} from \"./transport\";\n\nexport {\n  AuthContext,\n  AuthProvider,\n  type AuthContextValue,\n  type AuthProviderProps,\n} from \"./auth-provider\";\n\nexport { useAuth, useAuthClient } from \"./use-auth\";\n\nexport { performSignIn, type SignInArgs } from \"./sign-in\";\n\nexport {\n  performGuestSignIn,\n  type GuestSignInArgs,\n} from \"./sign-in-guest\";\n\nexport {\n  performPasswordSignIn,\n  type PasswordSignInArgs,\n} from \"./sign-in-password\";\n\nexport {\n  clearStoredSession,\n  readStoredSession,\n  storageKeyFor,\n  writeStoredSession,\n} from \"./storage\";\n\nexport { clearClient, currentClient, ensureClient } from \"./client-cache\";\n\nexport * from \"@reifydb/core\";\nexport * from \"@reifydb/client\";\n"],"mappings":";AAGA;AAAA,EACE;AAAA,OAKK;AAWP,SAAS,sBAAsB,QAA2C;AACxE,MAAI,OAAO,OAAO,eAAe,YAAY;AAC3C,QAAI;AACF,aAAO,WAAW;AAAA,IACpB,QAAQ;AAAA,IACR;AAAA,EACF;AACF;AAEO,IAAM,cAAuC;AAAA,EAClD,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO;AAAA,MACZ;AAAA,MACA,SAAS,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI,EAAE,QAAQ,OAAO;AAAA,IAC/D;AAAA,EACF;AAAA,EACA,QAAQ,QAAQ;AACd,0BAAsB,MAAM;AAAA,EAC9B;AACF;AAEO,IAAM,gBAA2C;AAAA,EACtD,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO;AAAA,MACZ;AAAA,MACA,SAAS,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI,EAAE,QAAQ,OAAO;AAAA,IAC/D;AAAA,EACF;AAAA,EACA,QAAQ,SAAS;AAAA,EACjB;AACF;AAEO,IAAM,kBAA+C;AAAA,EAC1D,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO,cAAc,KAAK,SAAS,OAAO,EAAE,MAAM,IAAI,MAAS;AAAA,EACxE;AAAA,EACA,QAAQ,QAAQ;AACd,0BAAsB,MAAM;AAAA,EAC9B;AACF;AAEO,IAAM,oBAAmD;AAAA,EAC9D,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO,gBAAgB,KAAK,SAAS,OAAO,EAAE,MAAM,IAAI,MAAS;AAAA,EAC1E;AAAA,EACA,QAAQ,SAAS;AAAA,EACjB;AACF;;;ACpEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;;;ACFP,IAAI,aAA4B;AAChC,IAAI,eAAyC;AAC7C,IAAI,mBAAyC;AAC7C,IAAI,iBAAoD;AAExD,SAAS,MAAM,MAAc,KAAa,OAAuB;AAC/D,SAAO,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK;AAChC;AAEA,eAAsB,aACpB,WACA,KACA,OACY;AACZ,QAAM,MAAM,MAAM,UAAU,MAAM,KAAK,KAAK;AAE5C,MAAI,eAAe,KAAK;AACtB,QAAI,aAAc,QAAO;AACzB,QAAI,eAAgB,QAAO;AAAA,EAC7B;AAGA,MAAI,gBAAgB,kBAAkB;AACpC,QAAI;AACF,MAAC,iBAAsD,QAAQ,YAAY;AAAA,IAC7E,QAAQ;AAAA,IAER;AACA,mBAAe;AAAA,EACjB;AACA,eAAa;AACb,qBAAmB;AAEnB,QAAM,IAAI,UAAU,QAAQ,KAAK,KAAK,EAAE,KAAK,CAAC,WAAW;AAEvD,QAAI,eAAe,KAAK;AACtB,UAAI;AACF,kBAAU,QAAQ,MAAM;AAAA,MAC1B,QAAQ;AAAA,MAER;AACA,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AACA,mBAAe;AACf,qBAAiB;AACjB,WAAO;AAAA,EACT,CAAC;AACD,mBAAiB;AACjB,SAAO;AACT;AAEO,SAAS,cAAoB;AAClC,MAAI,gBAAgB,kBAAkB;AACpC,QAAI;AACF,MAAC,iBAAsD,QAAQ,YAAY;AAAA,IAC7E,QAAQ;AAAA,IACR;AAAA,EACF;AACA,eAAa;AACb,iBAAe;AACf,qBAAmB;AACnB,mBAAiB;AACnB;AAEO,SAAS,gBAAoE;AAClF,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,SAAO;AACT;;;AC9DA,eAAsB,cACpB,MACsB;AACtB,QAAM,EAAE,KAAK,WAAW,QAAQ,QAAQ,QAAQ,WAAW,mBAAmB,QAAQ,IAAI;AAE1F,QAAM,gBAAgB,OAAO;AAC7B,MAAI,iBAAiB,QAAQ,cAAc,WAAW,GAAG;AACvD,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,MAAI,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,GAAG;AACjE,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAEA,QAAM,QACJ,WAAW,QAAQ,QAAQ,YAAY,KAAK,IAAI,IAAI,MAAO,QAAQ,QAAQ;AAC7E,QAAM,SAAS,MAAM,UAAU,QAAQ,KAAK,KAAK;AACjD,MAAI;AACF,UAAM,YAAY,MAAM,OAAO,eAAe,QAAQ;AAAA,MACpD,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,UAAU,SAAS,aAAa;AAClC,YAAM,IAAI;AAAA,QACR,mDAAmD,UAAU,IAAI;AAAA,MACnE;AAAA,IACF;AAEA,UAAM,eAAe,IAAI,YAAY,EAAE,OAAO,UAAU,OAAO;AAC/D,UAAM,iBAAiB,MAAM,OAAO,YAAY,YAAY;AAC5D,UAAM,YAAY,OAAO,gBAAgB,cAAc;AAEvD,UAAM,OAAO,MAAM,OAAO,eAAe,QAAQ;AAAA,MAC/C,cAAc,UAAU;AAAA,MACxB;AAAA,MACA,gBAAgB,UAAU;AAAA,IAC5B,CAAC;AACD,QAAI,KAAK,SAAS,iBAAiB;AACjC,YAAM,IAAI;AAAA,QACR,uDAAuD,KAAK,IAAI;AAAA,MAClE;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf;AAAA,MACA,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,IAC7C;AAAA,EACF,UAAE;AACA,cAAU,QAAQ,MAAM;AAAA,EAC1B;AACF;;;ACjDA,SAAS,sBACP,QACuC;AACvC,SACE,OAAQ,OAAuC,sBAC/C;AAEJ;AAEA,eAAsB,sBACpB,MACsB;AACtB,QAAM,EAAE,KAAK,WAAW,YAAY,UAAU,mBAAmB,QAAQ,IAAI;AAE7E,MAAI,WAAW,WAAW,GAAG;AAC3B,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AACA,MAAI,SAAS,WAAW,GAAG;AACzB,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAI,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,GAAG;AACjE,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAEA,QAAM,QACJ,WAAW,QAAQ,QAAQ,YAAY,KAAK,IAAI,IAAI,MAAO,QAAQ,QAAQ;AAC7E,QAAM,SAAS,MAAM,UAAU,QAAQ,KAAK,KAAK;AACjD,MAAI;AACF,QAAI,CAAC,sBAAsB,MAAM,GAAG;AAClC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,OAAO,MAAM,OAAO,kBAAkB,YAAY,QAAQ;AAChE,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf,eAAe;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,MACR,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,IAC7C;AAAA,EACF,UAAE;AACA,cAAU,QAAQ,MAAM;AAAA,EAC1B;AACF;;;AC7DA,IAAM,SAAS;AAEf,SAAS,OAAO,WAA2B;AACzC,SAAO,GAAG,SAAS,GAAG,MAAM;AAC9B;AAOA,IAAM,aAAa;AAEnB,SAAS,WAAmB;AAC1B,MAAI;AACF,QAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe,YAAY;AAC5E,aAAO,OAAO,WAAW;AAAA,IAC3B;AAAA,EACF,QAAQ;AAAA,EACR;AACA,SAAO,KAAK,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5E;AAEA,SAAS,eAAuB;AAC9B,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACF,UAAM,WAAW,eAAe,QAAQ,UAAU;AAClD,QAAI,SAAU,QAAO;AACrB,UAAM,KAAK,SAAS;AACpB,mBAAe,QAAQ,YAAY,EAAE;AACrC,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO,SAAS;AAAA,EAClB;AACF;AAEA,IAAM,SAAS,aAAa;AAKrB,SAAS,mBAAmB,WAA2B;AAC5D,SAAO,GAAG,SAAS,IAAI,MAAM;AAC/B;AAEA,SAAS,cAAc,GAA8B;AACnD,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,QAAM,IAAI;AACV,MACE,EAAE,WAAW,UACb,EAAE,WAAW,YACb,EAAE,WAAW,cACb,EAAE,WAAW,WACb,EAAE,WAAW,SACb;AACA,WAAO;AAAA,EACT;AACA,MAAI,EAAE,eAAe,UAAa,OAAO,EAAE,eAAe,UAAU;AAClE,WAAO;AAAA,EACT;AACA,SACE,OAAO,EAAE,UAAU,YAAY,EAAE,MAAM,SAAS,KAChD,OAAO,EAAE,aAAa,YAAY,EAAE,SAAS,SAAS,KACtD,OAAO,EAAE,kBAAkB,YAAY,EAAE,cAAc,SAAS,KAChE,OAAO,EAAE,cAAc,YAAY,OAAO,SAAS,EAAE,SAAS,KAAK,EAAE,YAAY;AAErF;AAEA,SAAS,WAAW,WAAyB;AAC3C,MAAI;AACF,iBAAa,WAAW,OAAO,SAAS,CAAC;AAAA,EAC3C,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,kBAAkB,WAAuC;AACvE,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACJ,MAAI;AACF,UAAM,aAAa,QAAQ,OAAO,SAAS,CAAC;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,KAAM,QAAO;AACxB,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,eAAW,SAAS;AACpB,WAAO;AAAA,EACT;AACA,MAAI,CAAC,cAAc,MAAM,GAAG;AAC1B,eAAW,SAAS;AACpB,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,KAAK,IAAI,IAAI,KAAM;AACzC,eAAW,SAAS;AACpB,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,mBAAmB,WAAmB,SAA4B;AAChF,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI,CAAC,cAAc,OAAO,GAAG;AAC3B,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,MAAI;AACF,iBAAa,QAAQ,OAAO,SAAS,GAAG,KAAK,UAAU,OAAO,CAAC;AAAA,EACjE,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,mBAAmB,WAAyB;AAC1D,MAAI,OAAO,WAAW,YAAa;AACnC,aAAW,SAAS;AACtB;AAEO,SAAS,cAAc,WAA2B;AACvD,SAAO,OAAO,SAAS;AACzB;AAMO,SAAS,qBAAqB,eAA6B;AAChE,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI;AACF,UAAM,MAAM,KAAK,IAAI,IAAI;AACzB,UAAM,SAAS,OAAO,mBAAmB,aAAa,CAAC;AACvD,UAAM,SAAS,GAAG,aAAa;AAC/B,UAAM,OAAiB,CAAC;AACxB,aAAS,IAAI,GAAG,IAAI,aAAa,QAAQ,KAAK,GAAG;AAC/C,YAAM,IAAI,aAAa,IAAI,CAAC;AAC5B,UAAI,KAAK,QAAQ,MAAM,OAAQ;AAC/B,UAAI,CAAC,EAAE,WAAW,MAAM,KAAK,CAAC,EAAE,SAAS,MAAM,EAAG;AAClD,YAAM,MAAM,aAAa,QAAQ,CAAC;AAClC,UAAI,OAAO,KAAM;AACjB,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,GAAG;AAAA,MACzB,QAAQ;AACN;AAAA,MACF;AACA,UAAI,cAAc,MAAM,KAAK,OAAO,aAAa,KAAK;AACpD,aAAK,KAAK,CAAC;AAAA,MACb;AAAA,IACF;AACA,eAAW,KAAK,KAAM,cAAa,WAAW,CAAC;AAAA,EACjD,QAAQ;AAAA,EAER;AACF;;;AJkNS;AAjVT,IAAM,sBAAsB;AAQrB,IAAM,cAAc,cAAuC,IAAI;AAwB/D,SAAS,aACd,OACc;AACd,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,oBAAoB;AAAA,IACpB;AAAA,IACA,eAAe;AAAA,IACf;AAAA,EACF,IAAI;AAKJ,QAAM,qBACJ,iBAAiB,YACb,mBACA,mBAAmB,gBAAgB;AAEzC,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,MAAM;AACtD,UAAM,SAAS,kBAAkB,kBAAkB;AACnD,WAAO,SACH,EAAE,QAAQ,aAAa,SAAS,QAAQ,aAAa,OAAO,OAAO,KAAK,IACxE,EAAE,QAAQ,gBAAgB,SAAS,MAAM,aAAa,OAAO,OAAO,KAAK;AAAA,EAC/E,CAAC;AAGD,QAAM,kBAAkB,QAAQ,aAAa;AAC7C,QAAM,mBAAmB,QAAQ,cAAc;AAC/C,QAAM,kBAAkB,QAAQ,aAAa;AAC7C,QAAM,oBAAoB,QAAQ,qBAAqB;AAGvD,QAAM,aAAa,OAAO,MAAM,OAAO;AACvC,aAAW,UAAU,MAAM;AAC3B,QAAM,YAAY,OAAO,MAAM;AAC/B,YAAU,UAAU;AAEpB,QAAM,WAAW;AAAA,IACf,CAAC,YAAqC,cAA6B;AACjE,yBAAmB,kBAAkB;AACrC,kBAAY;AACZ,eAAS;AAAA,QACP,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IACA,CAAC,kBAAkB;AAAA,EACrB;AAKA,YAAU,MAAM;AACd,UAAM,UAAU,MAAM;AACtB,QAAI,WAAW,KAAM;AAErB,UAAM,YAAY,MAAM;AACtB,UAAI,YAAY;AAChB,mBAAa,WAAW,KAAK,QAAQ,KAAK,EACvC,KAAK,MAAM;AACV,YAAI,UAAW;AACf;AAAA,UAAS,CAAC,SACR,KAAK,YAAY,UACb,EAAE,GAAG,MAAM,QAAQ,iBAAiB,aAAa,MAAM,OAAO,KAAK,IACnE;AAAA,QACN;AAAA,MACF,CAAC,EACA,MAAM,CAAC,QAAiB;AACvB,YAAI,UAAW;AACf,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,iBAAS,SAAS,OAAO;AAAA,MAC3B,CAAC;AACH,aAAO,MAAM;AACX,oBAAY;AAAA,MACd;AAAA,IACF;AAIA,QAAI,QAAQ,UAAU,QAAQ,QAAQ,WAAW,UAAU;AACzD,aAAO,UAAU;AAAA,IACnB;AAEA,QAAI,mBAAmB,mBAAmB,MAAM;AAC9C,UAAI,oBAAoB,QAAQ,eAAe;AAC7C,iBAAS,gBAAgB,IAAI;AAC7B;AAAA,MACF;AACA,aAAO,UAAU;AAAA,IACnB;AAEA,QAAI,CAAC,oBAAoB,oBAAoB,oBAAoB;AAG/D;AAAA,QAAS,CAAC,SACR,KAAK,YAAY,UACb,EAAE,GAAG,MAAM,QAAQ,aAAa,aAAa,MAAM,IACnD;AAAA,MACN;AACA;AAAA,IACF;AAIA,aAAS,gBAAgB,IAAI;AAAA,EAC/B,GAAG;AAAA,IACD,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,YAAU,MAAM;AACd,QAAI,OAAO,WAAW,YAAa;AACnC,UAAM,MAAM,cAAc,kBAAkB;AAC5C,UAAM,YAAY,CAAC,MAAoB;AACrC,UAAI,EAAE,QAAQ,IAAK;AACnB,YAAM,UAAU,WAAW;AAG3B,UAAI,EAAE,YAAY,MAAM;AACtB,YAAI,WAAW,KAAM,UAAS,gBAAgB,IAAI;AAClD;AAAA,MACF;AAEA,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,EAAE,QAAQ;AAAA,MAChC,QAAQ;AAGN,YAAI,WAAW,KAAM,UAAS,gBAAgB,IAAI;AAClD;AAAA,MACF;AAMA,UAAI,WAAW,KAAM;AAGrB,UACE,OAAO,kBAAkB,QAAQ,iBACjC,OAAO,aAAa,QAAQ,UAC5B;AACA,cAAM,WACJ,iBAAiB,YAAY,kBAAkB,kBAAkB,IAAI;AACvE,YAAI,YAAY,MAAM;AACpB,mBAAS,gBAAgB,IAAI;AAC7B;AAAA,QACF;AACA,iBAAS,EAAE,QAAQ,aAAa,SAAS,UAAU,aAAa,OAAO,OAAO,KAAK,CAAC;AAAA,MACtF;AAAA,IAIF;AACA,WAAO,iBAAiB,WAAW,SAAS;AAC5C,WAAO,MAAM;AACX,aAAO,oBAAoB,WAAW,SAAS;AAAA,IACjD;AAAA,EACF,GAAG,CAAC,oBAAoB,cAAc,QAAQ,CAAC;AAG/C,YAAU,MAAM;AACd,yBAAqB,gBAAgB;AAAA,EACvC,GAAG,CAAC,gBAAgB,CAAC;AAErB,QAAM,SAAS,YAAY,OAAO,gBAAsC;AACtE,QAAI,eAAe,MAAM;AACvB,eAAS,CAAC,UAAU,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,KAAK,EAAE;AAChE,UAAI;AACF,cAAM,UAAU,MAAM,sBAAsB;AAAA,UAC1C;AAAA,UACA;AAAA,UACA,YAAY,YAAY;AAAA,UACxB,UAAU,YAAY;AAAA,UACtB;AAAA,UACA,SAAS,WAAW;AAAA,QACtB,CAAC;AACD,2BAAmB,oBAAoB,OAAO;AAC9C,iBAAS;AAAA,UACP,QAAQ;AAAA,UACR;AAAA,UACA,aAAa;AAAA,UACb,OAAO;AAAA,QACT,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD;AAAA,UAAS,CAAC,SACR,KAAK,WAAW,OACZ,EAAE,GAAG,MAAM,QAAQ,KAAK,cAAc,kBAAkB,aAAa,OAAO,QAAQ,IACpF,EAAE,QAAQ,SAAS,SAAS,MAAM,aAAa,OAAO,OAAO,QAAQ;AAAA,QAC3E;AAAA,MACF;AACA;AAAA,IACF;AAEA,UAAM,IAAI,UAAU;AACpB,QAAI,KAAK,QAAQ,CAAC,EAAE,aAAa,EAAE,aAAa,MAAM;AACpD,eAAS,CAAC,UAAU,EAAE,GAAG,MAAM,QAAQ,SAAS,OAAO,uBAAuB,EAAE;AAChF;AAAA,IACF;AACA,QAAI,UAAU,QAAQ,UAAU,QAAQ,aAAa,MAAM;AACzD,eAAS,CAAC,UAAU;AAAA,QAClB,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,OAAO;AAAA,MACT,EAAE;AACF;AAAA,IACF;AACA,aAAS,CAAC,UAAU,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,KAAK,EAAE;AAChE,QAAI;AACF,YAAM,UAAU,MAAM,cAAc;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,WAAW;AAAA,MACtB,CAAC;AAGD,UAAI,QAAQ,kBAAkB,UAAU,SAAS,WAAW;AAC1D,cAAM,IAAI,MAAM,+BAA+B;AAAA,MACjD;AACA,yBAAmB,oBAAoB,OAAO;AAC9C,eAAS;AAAA,QACP,QAAQ;AAAA,QACR;AAAA,QACA,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD;AAAA,QAAS,CAAC,SACR,KAAK,WAAW,OACZ,EAAE,GAAG,MAAM,QAAQ,KAAK,cAAc,kBAAkB,aAAa,OAAO,QAAQ,IACpF,EAAE,QAAQ,SAAS,SAAS,MAAM,aAAa,OAAO,OAAO,QAAQ;AAAA,MAC3E;AAAA,IACF;AAAA,EACF,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAKD,QAAM,eAAe;AAAA,IACnB,CAAC,YAAyB;AACxB,yBAAmB,oBAAoB,OAAO;AAC9C,eAAS;AAAA,QACP,QAAQ;AAAA,QACR;AAAA,QACA,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IACA,CAAC,kBAAkB;AAAA,EACrB;AAEA,QAAM,UAAU,YAAY,YAAY;AAEtC,QAAI;AACF,YAAM,cAAc,EAAE,OAAO;AAAA,IAC/B,QAAQ;AAAA,IAER;AACA,aAAS,gBAAgB,IAAI;AAAA,EAC/B,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,QAAQ;AAAA,IACZ,OAAO;AAAA,MACL,QAAQ,MAAM;AAAA,MACd,SAAS,MAAM;AAAA,MACf,aAAa,MAAM;AAAA,MACnB,OAAO,MAAM;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,CAAC,OAAO,QAAQ,cAAc,OAAO;AAAA,EACvC;AAEA,SAAO,oBAAC,YAAY,UAAZ,EAAqB,OAAe,UAAS;AACvD;;;AKjXA,SAAS,kBAAkB;AAMpB,SAAS,UAA4B;AAC1C,QAAM,MAAM,WAAW,WAAW;AAClC,MAAI,OAAO,MAAM;AACf,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO;AACT;AAEO,SAAS,gBAEH;AACX,QAAM,EAAE,YAAY,IAAI,QAAQ;AAChC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,SAAO,cAAuB;AAChC;;;ACPA,SAAS,cACP,QACkC;AAClC,SAAO,OAAQ,OAAkC,UAAU;AAC7D;AAEA,eAAsB,mBACpB,MACsB;AACtB,QAAM,EAAE,KAAK,WAAW,kBAAkB,IAAI;AAE9C,MAAI,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,GAAG;AACjE,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAEA,QAAM,SAAS,MAAM,UAAU,QAAQ,GAAG;AAC1C,MAAI;AACF,QAAI,CAAC,cAAc,MAAM,GAAG;AAC1B,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E;AACA,UAAM,OAAO,MAAM,OAAO,MAAM,SAAS,CAAC,CAAC;AAC3C,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf,eAAe,KAAK;AAAA,MACpB,QAAQ;AAAA,MACR,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,IAC7C;AAAA,EACF,UAAE;AACA,cAAU,QAAQ,MAAM;AAAA,EAC1B;AACF;;;ACKA,cAAc;AACd,cAAc;","names":[]}

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@reifydb/auth",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "dependencies": {
-    "@reifydb/core": "0.10.0",
-    "@reifydb/client": "0.10.0"
+    "@reifydb/core": "0.10.2",
+    "@reifydb/client": "0.10.2"
   },
   "peerDependencies": {
     "react": ">=16.8.0"