@reifydb/auth 0.6.0 → 0.7.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/transport.ts","../src/auth-provider.tsx","../src/client-cache.ts","../src/sign-in.ts","../src/storage.ts","../src/use-auth.ts","../src/index.ts"],"sourcesContent":["// SPDX-License-Identifier: MIT\n// Copyright (c) 2026 ReifyDB\n\nimport {\n  Client,\n  type WsClient,\n  type HttpClient,\n  type JsonWsClient,\n  type JsonHttpClient,\n} from \"@reifydb/client\";\nimport type { AuthCapableClient } from \"./types\";\n\nexport interface AuthTransport<\n  TClient extends AuthCapableClient = AuthCapableClient,\n> {\n  readonly kind: \"ws\" | \"http\";\n  connect(url: string, token?: string): Promise<TClient>;\n  release(client: TClient): void;\n}\n\nfunction release_with_disconnect(client: { disconnect?: () => void }): void {\n  if (typeof client.disconnect === \"function\") {\n    try {\n      client.disconnect();\n    } catch {\n      // disconnect should be idempotent and never throw, but guard anyway\n    }\n  }\n}\n\nexport const ws_transport: AuthTransport<WsClient> = {\n  kind: \"ws\",\n  async connect(url, token) {\n    return Client.connect_ws(\n      url,\n      token != null ? { format: \"rbcf\", token } : { format: \"rbcf\" },\n    );\n  },\n  release(client) {\n    release_with_disconnect(client);\n  },\n};\n\nexport const http_transport: AuthTransport<HttpClient> = {\n  kind: \"http\",\n  async connect(url, token) {\n    return Client.connect_http(\n      url,\n      token != null ? { format: \"rbcf\", token } : { format: \"rbcf\" },\n    );\n  },\n  release(_client) {\n    // HttpClient has no persistent socket; nothing to release.\n  },\n};\n\nexport const json_ws_transport: AuthTransport<JsonWsClient> = {\n  kind: \"ws\",\n  async connect(url, token) {\n    return Client.connect_json_ws(url, token != null ? { token } : undefined);\n  },\n  release(client) {\n    release_with_disconnect(client);\n  },\n};\n\nexport const json_http_transport: AuthTransport<JsonHttpClient> = {\n  kind: \"http\",\n  async connect(url, token) {\n    return Client.connect_json_http(url, token != null ? { token } : undefined);\n  },\n  release(_client) {\n    // JsonHttpClient has no persistent socket; nothing to release.\n  },\n};\n","// SPDX-License-Identifier: MIT\n// Copyright (c) 2026 ReifyDB\n\nimport React, {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactElement,\n  type ReactNode,\n} from \"react\";\n\nimport { clearClient, currentClient, ensureClient } from \"./client-cache\";\nimport { performSignIn } from \"./sign-in\";\nimport {\n  clearStoredSession,\n  readStoredSession,\n  storageKeyFor,\n  sweepExpiredSessions,\n  tabScopedNamespace,\n  writeStoredSession,\n} from \"./storage\";\nimport type {\n  AuthCapableClient,\n  AuthSession,\n  AuthState,\n  WalletConnector,\n} from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\nconst DEFAULT_TTL_SECONDS = 86400;\n\nexport interface AuthContextValue extends AuthState {\n  signIn(): Promise<void>;\n  signOut(): Promise<void>;\n}\n\nexport const AuthContext = createContext<AuthContextValue | null>(null);\n\nexport interface AuthProviderProps<\n  TClient extends AuthCapableClient = AuthCapableClient,\n> {\n  url: string;\n  transport: AuthTransport<TClient>;\n  storageNamespace: string;\n  method: string;\n  domain: string;\n  statement: string;\n  sessionTtlSeconds?: number;\n  wallet: WalletConnector;\n  children: ReactNode;\n}\n\ninterface InternalState {\n  status: AuthState[\"status\"];\n  session: AuthSession | null;\n  clientReady: boolean;\n  error: string | null;\n}\n\nexport function AuthProvider<TClient extends AuthCapableClient>(\n  props: AuthProviderProps<TClient>,\n): ReactElement {\n  const {\n    url,\n    transport,\n    storageNamespace,\n    method,\n    domain,\n    statement,\n    sessionTtlSeconds = DEFAULT_TTL_SECONDS,\n    wallet,\n    children,\n  } = props;\n\n  // Per-tab storage slot: each tab gets its own localStorage key so concurrent\n  // sign-ins in different tabs cannot stomp each other's session.\n  const effective_namespace = tabScopedNamespace(storageNamespace);\n\n  const [state, setState] = useState<InternalState>(() => {\n    const stored = readStoredSession(effective_namespace);\n    return stored\n      ? { status: \"verifying\", session: stored, clientReady: false, error: null }\n      : { status: \"disconnected\", session: null, clientReady: false, error: null };\n  });\n\n  // Pull live wallet fields into stable primitives for effect deps.\n  const wallet_connected = wallet.connected;\n  const wallet_connecting = wallet.connecting;\n  const wallet_public_key = wallet.publicKey;\n  const wallet_has_selected = wallet.hasSelectedWallet;\n\n  // Refs so callbacks can read latest values without re-binding.\n  const session_ref = useRef(state.session);\n  session_ref.current = state.session;\n  const wallet_ref = useRef(wallet);\n  wallet_ref.current = wallet;\n\n  const tear_down = useCallback(\n    (next_status: InternalState[\"status\"], next_error: string | null) => {\n      clearStoredSession(effective_namespace);\n      clearClient();\n      setState({\n        status: next_status,\n        session: null,\n        clientReady: false,\n        error: next_error,\n      });\n    },\n    [effective_namespace],\n  );\n\n  // Wallet-match gate: the security invariant. The authenticated client is only\n  // ever constructed when the connected wallet matches the persisted session.\n  useEffect(() => {\n    const session = state.session;\n    if (session == null) return;\n\n    if (wallet_connected && wallet_public_key != null) {\n      if (wallet_public_key !== session.wallet_address) {\n        tear_down(\"disconnected\", null);\n        return;\n      }\n      let cancelled = false;\n      ensureClient(transport, url, session.token)\n        .then(() => {\n          if (cancelled) return;\n          setState((prev) =>\n            prev.session === session\n              ? { ...prev, status: \"authenticated\", clientReady: true, error: null }\n              : prev,\n          );\n        })\n        .catch((err: unknown) => {\n          if (cancelled) return;\n          const message = err instanceof Error ? err.message : \"Failed to connect client\";\n          tear_down(\"error\", message);\n        });\n      return () => {\n        cancelled = true;\n      };\n    }\n\n    if (!wallet_connected && (wallet_connecting || wallet_has_selected)) {\n      // Wallet adapter is autoConnecting; stay in verifying. Do NOT construct\n      // the client yet - we must not authenticate before the match is confirmed.\n      setState((prev) =>\n        prev.session === session\n          ? { ...prev, status: \"verifying\", clientReady: false }\n          : prev,\n      );\n      return;\n    }\n\n    // Wallet is definitively absent (no selected wallet, not connecting). User\n    // explicitly disconnected, so the session can no longer be proven; tear down.\n    tear_down(\"disconnected\", null);\n  }, [\n    state.session,\n    wallet_connected,\n    wallet_connecting,\n    wallet_public_key,\n    wallet_has_selected,\n    transport,\n    url,\n    tear_down,\n  ]);\n\n  useEffect(() => {\n    if (typeof window === \"undefined\") return;\n    const key = storageKeyFor(effective_namespace);\n    const on_storage = (e: StorageEvent) => {\n      if (e.key !== key) return;\n      const current = session_ref.current;\n\n      // Another tab signed out / cleared the session.\n      if (e.newValue == null) {\n        if (current != null) tear_down(\"disconnected\", null);\n        return;\n      }\n\n      let parsed: Partial<AuthSession>;\n      try {\n        parsed = JSON.parse(e.newValue) as Partial<AuthSession>;\n      } catch {\n        // Corrupt entry written by another tab. Only react if we actually hold\n        // a session; otherwise there is nothing to defend.\n        if (current != null) tear_down(\"disconnected\", null);\n        return;\n      }\n\n      // We hold no session of our own: nothing to defend. Clearing storage here\n      // would clobber the session the other tab just wrote (and bounce it back\n      // out through this same handler). Let our own sign-in / autoConnect flow\n      // converge independently.\n      if (current == null) return;\n\n      // A genuinely different principal took over our storage slot.\n      if (\n        parsed.wallet_address !== current.wallet_address ||\n        parsed.identity !== current.identity\n      ) {\n        tear_down(\"disconnected\", null);\n      }\n\n      // Same principal, different token: a concurrent sign-in in another tab,\n      // not an intrusion. Keep our own still-valid client.\n    };\n    window.addEventListener(\"storage\", on_storage);\n    return () => {\n      window.removeEventListener(\"storage\", on_storage);\n    };\n  }, [effective_namespace, tear_down]);\n\n  // Housekeeping: drop expired per-tab slots left behind by closed tabs.\n  useEffect(() => {\n    sweepExpiredSessions(storageNamespace);\n  }, [storageNamespace]);\n\n  const signIn = useCallback(async () => {\n    const w = wallet_ref.current;\n    if (!w.connected || w.publicKey == null) {\n      setState((prev) => ({ ...prev, status: \"error\", error: \"Wallet not connected\" }));\n      return;\n    }\n    setState((prev) => ({ ...prev, status: \"signing\", error: null }));\n    try {\n      const session = await performSignIn({\n        url,\n        transport,\n        method,\n        wallet: w,\n        domain,\n        statement,\n        sessionTtlSeconds,\n      });\n      // Sanity: signed-in wallet must match the live publicKey. If the user\n      // swapped wallets while the signature was in flight, refuse the session.\n      if (session.wallet_address !== wallet_ref.current.publicKey) {\n        throw new Error(\"Wallet changed during sign in\");\n      }\n      writeStoredSession(effective_namespace, session);\n      setState({\n        status: \"verifying\",\n        session,\n        clientReady: false,\n        error: null,\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Sign in failed\";\n      setState({\n        status: \"error\",\n        session: null,\n        clientReady: false,\n        error: message,\n      });\n    }\n  }, [\n    url,\n    transport,\n    method,\n    domain,\n    statement,\n    sessionTtlSeconds,\n    effective_namespace,\n  ]);\n\n  const signOut = useCallback(async () => {\n    // Best-effort server-side logout via the currently-cached client.\n    try {\n      await currentClient().logout();\n    } catch {\n      // no current client, or server-side logout failed; tear down regardless\n    }\n    tear_down(\"disconnected\", null);\n  }, [tear_down]);\n\n  const value = useMemo<AuthContextValue>(\n    () => ({\n      status: state.status,\n      session: state.session,\n      clientReady: state.clientReady,\n      error: state.error,\n      signIn,\n      signOut,\n    }),\n    [state, signIn, signOut],\n  );\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;\n}\n","// SPDX-License-Identifier: MIT\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthCapableClient } from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\n// Module-level dedupe: in React StrictMode (dev) the AuthProvider effect runs\n// twice with the same inputs, which previously opened two sockets. We cache the\n// in-flight promise so both runs share one connection.\n\nlet current_key: string | null = null;\nlet current_client: AuthCapableClient | null = null;\nlet current_transport: AuthTransport | null = null;\nlet pending_promise: Promise<AuthCapableClient> | null = null;\n\nfunction key_of(kind: string, url: string, token: string): string {\n  return `${kind}|${url}|${token}`;\n}\n\nexport async function ensureClient<T extends AuthCapableClient>(\n  transport: AuthTransport<T>,\n  url: string,\n  token: string,\n): Promise<T> {\n  const key = key_of(transport.kind, url, token);\n\n  if (current_key === key) {\n    if (current_client) return current_client as T;\n    if (pending_promise) return pending_promise as Promise<T>;\n  }\n\n  // New (kind, url, token) — release any prior client, start fresh.\n  if (current_client && current_transport) {\n    try {\n      (current_transport as AuthTransport<AuthCapableClient>).release(current_client);\n    } catch {\n      // release must be idempotent; ignore\n    }\n    current_client = null;\n  }\n  current_key = key;\n  current_transport = transport as AuthTransport;\n\n  const p = transport.connect(url, token).then((client) => {\n    // Another ensure/clear ran while we were connecting — drop this one.\n    if (current_key !== key) {\n      try {\n        transport.release(client);\n      } catch {\n        // ignore\n      }\n      throw new Error(\"@reifydb/auth: client connect superseded\");\n    }\n    current_client = client;\n    pending_promise = null;\n    return client;\n  });\n  pending_promise = p as Promise<AuthCapableClient>;\n  return p;\n}\n\nexport function clearClient(): void {\n  if (current_client && current_transport) {\n    try {\n      (current_transport as AuthTransport<AuthCapableClient>).release(current_client);\n    } catch {\n      // ignore\n    }\n  }\n  current_key = null;\n  current_client = null;\n  current_transport = null;\n  pending_promise = null;\n}\n\nexport function currentClient<T extends AuthCapableClient = AuthCapableClient>(): T {\n  if (!current_client) {\n    throw new Error(\"@reifydb/auth: no authenticated client; call ensureClient first\");\n  }\n  return current_client as T;\n}\n","// SPDX-License-Identifier: MIT\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthCapableClient, AuthSession, WalletConnector } from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\nexport interface SignInArgs<TClient extends AuthCapableClient = AuthCapableClient> {\n  url: string;\n  transport: AuthTransport<TClient>;\n  method: string;\n  wallet: Pick<WalletConnector, \"publicKey\" | \"signMessage\" | \"encodeSignature\">;\n  domain: string;\n  statement: string;\n  sessionTtlSeconds: number;\n}\n\nexport async function performSignIn<TClient extends AuthCapableClient>(\n  args: SignInArgs<TClient>,\n): Promise<AuthSession> {\n  const { url, transport, method, wallet, domain, statement, sessionTtlSeconds } = args;\n\n  const wallet_address = wallet.publicKey;\n  if (wallet_address == null || wallet_address.length === 0) {\n    throw new Error(\"@reifydb/auth: wallet.publicKey is required to sign in\");\n  }\n  if (!Number.isFinite(sessionTtlSeconds) || sessionTtlSeconds <= 0) {\n    throw new Error(\"@reifydb/auth: sessionTtlSeconds must be a positive number\");\n  }\n\n  const client = await transport.connect(url);\n  try {\n    const challenge = await client.login_challenge(method, {\n      identifier: wallet_address,\n      public_key: wallet_address,\n      domain,\n      statement,\n    });\n    if (challenge.kind !== \"challenge\") {\n      throw new Error(\n        `@reifydb/auth: expected challenge response, got ${challenge.kind}`,\n      );\n    }\n\n    const messageBytes = new TextEncoder().encode(challenge.message);\n    const signatureBytes = await wallet.signMessage(messageBytes);\n    const signature = wallet.encodeSignature(signatureBytes);\n\n    const auth = await client.login_challenge(method, {\n      challenge_id: challenge.challenge_id,\n      signature,\n      signed_message: challenge.message,\n    });\n    if (auth.kind !== \"authenticated\") {\n      throw new Error(\n        `@reifydb/auth: expected authenticated response, got ${auth.kind}`,\n      );\n    }\n\n    return {\n      token: auth.token,\n      identity: auth.identity,\n      wallet_address,\n      expires_at: Math.floor(Date.now() / 1000) + sessionTtlSeconds,\n    };\n  } finally {\n    transport.release(client);\n  }\n}\n","// SPDX-License-Identifier: MIT\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthSession } from \"./types\";\n\nconst SUFFIX = \".auth\";\n\nfunction key_for(namespace: string): string {\n  return `${namespace}${SUFFIX}`;\n}\n\n// A per-tab id so two tabs never share one localStorage slot and stomp each\n// other's session. Backed by sessionStorage: stable across reloads within a\n// tab, unique per tab, gone when the tab closes. Falls back to an ephemeral\n// in-memory id when sessionStorage or crypto.randomUUID is unavailable\n// (degraded: the session will not survive a reload).\nconst TAB_ID_KEY = \"reifydb.auth.tab\";\n\nfunction new_tab_id(): string {\n  try {\n    if (typeof crypto !== \"undefined\" && typeof crypto.randomUUID === \"function\") {\n      return crypto.randomUUID();\n    }\n  } catch {\n    // crypto unavailable; fall through to the cheap fallback\n  }\n  return `t-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;\n}\n\nfunction resolve_tab_id(): string {\n  if (typeof window === \"undefined\") return \"ssr\";\n  try {\n    const existing = sessionStorage.getItem(TAB_ID_KEY);\n    if (existing) return existing;\n    const id = new_tab_id();\n    sessionStorage.setItem(TAB_ID_KEY, id);\n    return id;\n  } catch {\n    // sessionStorage unavailable (private mode, disabled): ephemeral id.\n    return new_tab_id();\n  }\n}\n\nconst TAB_ID = resolve_tab_id();\n\n// Scopes a caller's namespace to this browser tab. AuthProvider feeds the\n// result into every storage operation so each tab gets its own slot and the\n// cross-tab `storage` listener filters other tabs out by key.\nexport function tabScopedNamespace(namespace: string): string {\n  return `${namespace}.${TAB_ID}`;\n}\n\nfunction is_auth_session(v: unknown): v is AuthSession {\n  if (v === null || typeof v !== \"object\") return false;\n  const o = v as Record<string, unknown>;\n  return (\n    typeof o.token === \"string\" && o.token.length > 0 &&\n    typeof o.identity === \"string\" && o.identity.length > 0 &&\n    typeof o.wallet_address === \"string\" && o.wallet_address.length > 0 &&\n    typeof o.expires_at === \"number\" && Number.isFinite(o.expires_at) && o.expires_at > 0\n  );\n}\n\nfunction safe_remove(namespace: string): void {\n  try {\n    localStorage.removeItem(key_for(namespace));\n  } catch {\n    // localStorage may be unavailable; ignore\n  }\n}\n\nexport function readStoredSession(namespace: string): AuthSession | null {\n  if (typeof window === \"undefined\") return null;\n  let raw: string | null;\n  try {\n    raw = localStorage.getItem(key_for(namespace));\n  } catch {\n    return null;\n  }\n  if (raw == null) return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    safe_remove(namespace);\n    return null;\n  }\n  if (!is_auth_session(parsed)) {\n    safe_remove(namespace);\n    return null;\n  }\n  if (parsed.expires_at <= Date.now() / 1000) {\n    safe_remove(namespace);\n    return null;\n  }\n  return parsed;\n}\n\nexport function writeStoredSession(namespace: string, session: AuthSession): void {\n  if (typeof window === \"undefined\") return;\n  if (!is_auth_session(session)) {\n    throw new Error(\"@reifydb/auth: refusing to persist malformed session\");\n  }\n  try {\n    localStorage.setItem(key_for(namespace), JSON.stringify(session));\n  } catch {\n    // localStorage may be unavailable (private mode, full quota); ignore.\n  }\n}\n\nexport function clearStoredSession(namespace: string): void {\n  if (typeof window === \"undefined\") return;\n  safe_remove(namespace);\n}\n\nexport function storageKeyFor(namespace: string): string {\n  return key_for(namespace);\n}\n\n// Closed tabs leave their per-tab slot in localStorage forever - nothing ever\n// reads that namespace again. Sweep once on mount: drop slots under\n// `baseNamespace` that belong to other tabs and have already expired. Live\n// tabs' slots have a future `expires_at` and are never touched.\nexport function sweepExpiredSessions(baseNamespace: string): void {\n  if (typeof window === \"undefined\") return;\n  try {\n    const now = Date.now() / 1000;\n    const own_key = key_for(tabScopedNamespace(baseNamespace));\n    const prefix = `${baseNamespace}.`;\n    const dead: string[] = [];\n    for (let i = 0; i < localStorage.length; i += 1) {\n      const k = localStorage.key(i);\n      if (k == null || k === own_key) continue;\n      if (!k.startsWith(prefix) || !k.endsWith(SUFFIX)) continue;\n      const raw = localStorage.getItem(k);\n      if (raw == null) continue;\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(raw);\n      } catch {\n        continue;\n      }\n      if (is_auth_session(parsed) && parsed.expires_at <= now) {\n        dead.push(k);\n      }\n    }\n    for (const k of dead) localStorage.removeItem(k);\n  } catch {\n    // localStorage unavailable; nothing to sweep.\n  }\n}\n","// SPDX-License-Identifier: MIT\n// Copyright (c) 2026 ReifyDB\n\nimport { useContext } from \"react\";\n\nimport { AuthContext, type AuthContextValue } from \"./auth-provider\";\nimport { currentClient } from \"./client-cache\";\nimport type { AuthCapableClient } from \"./types\";\n\nexport function useAuth(): AuthContextValue {\n  const ctx = useContext(AuthContext);\n  if (ctx == null) {\n    throw new Error(\"@reifydb/auth: useAuth must be used inside <AuthProvider>\");\n  }\n  return ctx;\n}\n\nexport function useAuthClient<\n  TClient extends AuthCapableClient = AuthCapableClient,\n>(): TClient {\n  const { clientReady } = useAuth();\n  if (!clientReady) {\n    throw new Error(\"@reifydb/auth: useAuthClient called before clientReady\");\n  }\n  return currentClient<TClient>();\n}\n","// SPDX-License-Identifier: MIT\n// Copyright (c) 2026 ReifyDB\n\nexport type {\n  AuthCapableClient,\n  AuthSession,\n  AuthState,\n  AuthStatus,\n  LoginChallengeResult,\n  WalletConnector,\n} from \"./types\";\n\nexport type { AuthTransport } from \"./transport\";\nexport {\n  http_transport,\n  json_http_transport,\n  json_ws_transport,\n  ws_transport,\n} from \"./transport\";\n\nexport {\n  AuthContext,\n  AuthProvider,\n  type AuthContextValue,\n  type AuthProviderProps,\n} from \"./auth-provider\";\n\nexport { useAuth, useAuthClient } from \"./use-auth\";\n\nexport { performSignIn, type SignInArgs } from \"./sign-in\";\n\nexport {\n  clearStoredSession,\n  readStoredSession,\n  storageKeyFor,\n  writeStoredSession,\n} from \"./storage\";\n\nexport { clearClient, currentClient, ensureClient } from \"./client-cache\";\n\nexport * from \"@reifydb/core\";\nexport * from \"@reifydb/client\";\n"],"mappings":";AAGA;AAAA,EACE;AAAA,OAKK;AAWP,SAAS,wBAAwB,QAA2C;AAC1E,MAAI,OAAO,OAAO,eAAe,YAAY;AAC3C,QAAI;AACF,aAAO,WAAW;AAAA,IACpB,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAEO,IAAM,eAAwC;AAAA,EACnD,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO;AAAA,MACZ;AAAA,MACA,SAAS,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI,EAAE,QAAQ,OAAO;AAAA,IAC/D;AAAA,EACF;AAAA,EACA,QAAQ,QAAQ;AACd,4BAAwB,MAAM;AAAA,EAChC;AACF;AAEO,IAAM,iBAA4C;AAAA,EACvD,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO;AAAA,MACZ;AAAA,MACA,SAAS,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI,EAAE,QAAQ,OAAO;AAAA,IAC/D;AAAA,EACF;AAAA,EACA,QAAQ,SAAS;AAAA,EAEjB;AACF;AAEO,IAAM,oBAAiD;AAAA,EAC5D,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO,gBAAgB,KAAK,SAAS,OAAO,EAAE,MAAM,IAAI,MAAS;AAAA,EAC1E;AAAA,EACA,QAAQ,QAAQ;AACd,4BAAwB,MAAM;AAAA,EAChC;AACF;AAEO,IAAM,sBAAqD;AAAA,EAChE,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO,kBAAkB,KAAK,SAAS,OAAO,EAAE,MAAM,IAAI,MAAS;AAAA,EAC5E;AAAA,EACA,QAAQ,SAAS;AAAA,EAEjB;AACF;;;ACvEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;;;ACFP,IAAI,cAA6B;AACjC,IAAI,iBAA2C;AAC/C,IAAI,oBAA0C;AAC9C,IAAI,kBAAqD;AAEzD,SAAS,OAAO,MAAc,KAAa,OAAuB;AAChE,SAAO,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK;AAChC;AAEA,eAAsB,aACpB,WACA,KACA,OACY;AACZ,QAAM,MAAM,OAAO,UAAU,MAAM,KAAK,KAAK;AAE7C,MAAI,gBAAgB,KAAK;AACvB,QAAI,eAAgB,QAAO;AAC3B,QAAI,gBAAiB,QAAO;AAAA,EAC9B;AAGA,MAAI,kBAAkB,mBAAmB;AACvC,QAAI;AACF,MAAC,kBAAuD,QAAQ,cAAc;AAAA,IAChF,QAAQ;AAAA,IAER;AACA,qBAAiB;AAAA,EACnB;AACA,gBAAc;AACd,sBAAoB;AAEpB,QAAM,IAAI,UAAU,QAAQ,KAAK,KAAK,EAAE,KAAK,CAAC,WAAW;AAEvD,QAAI,gBAAgB,KAAK;AACvB,UAAI;AACF,kBAAU,QAAQ,MAAM;AAAA,MAC1B,QAAQ;AAAA,MAER;AACA,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AACA,qBAAiB;AACjB,sBAAkB;AAClB,WAAO;AAAA,EACT,CAAC;AACD,oBAAkB;AAClB,SAAO;AACT;AAEO,SAAS,cAAoB;AAClC,MAAI,kBAAkB,mBAAmB;AACvC,QAAI;AACF,MAAC,kBAAuD,QAAQ,cAAc;AAAA,IAChF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,gBAAc;AACd,mBAAiB;AACjB,sBAAoB;AACpB,oBAAkB;AACpB;AAEO,SAAS,gBAAoE;AAClF,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,SAAO;AACT;;;AChEA,eAAsB,cACpB,MACsB;AACtB,QAAM,EAAE,KAAK,WAAW,QAAQ,QAAQ,QAAQ,WAAW,kBAAkB,IAAI;AAEjF,QAAM,iBAAiB,OAAO;AAC9B,MAAI,kBAAkB,QAAQ,eAAe,WAAW,GAAG;AACzD,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,MAAI,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,GAAG;AACjE,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAEA,QAAM,SAAS,MAAM,UAAU,QAAQ,GAAG;AAC1C,MAAI;AACF,UAAM,YAAY,MAAM,OAAO,gBAAgB,QAAQ;AAAA,MACrD,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,UAAU,SAAS,aAAa;AAClC,YAAM,IAAI;AAAA,QACR,mDAAmD,UAAU,IAAI;AAAA,MACnE;AAAA,IACF;AAEA,UAAM,eAAe,IAAI,YAAY,EAAE,OAAO,UAAU,OAAO;AAC/D,UAAM,iBAAiB,MAAM,OAAO,YAAY,YAAY;AAC5D,UAAM,YAAY,OAAO,gBAAgB,cAAc;AAEvD,UAAM,OAAO,MAAM,OAAO,gBAAgB,QAAQ;AAAA,MAChD,cAAc,UAAU;AAAA,MACxB;AAAA,MACA,gBAAgB,UAAU;AAAA,IAC5B,CAAC;AACD,QAAI,KAAK,SAAS,iBAAiB;AACjC,YAAM,IAAI;AAAA,QACR,uDAAuD,KAAK,IAAI;AAAA,MAClE;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf;AAAA,MACA,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,IAC9C;AAAA,EACF,UAAE;AACA,cAAU,QAAQ,MAAM;AAAA,EAC1B;AACF;;;AC9DA,IAAM,SAAS;AAEf,SAAS,QAAQ,WAA2B;AAC1C,SAAO,GAAG,SAAS,GAAG,MAAM;AAC9B;AAOA,IAAM,aAAa;AAEnB,SAAS,aAAqB;AAC5B,MAAI;AACF,QAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe,YAAY;AAC5E,aAAO,OAAO,WAAW;AAAA,IAC3B;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,KAAK,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5E;AAEA,SAAS,iBAAyB;AAChC,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACF,UAAM,WAAW,eAAe,QAAQ,UAAU;AAClD,QAAI,SAAU,QAAO;AACrB,UAAM,KAAK,WAAW;AACtB,mBAAe,QAAQ,YAAY,EAAE;AACrC,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO,WAAW;AAAA,EACpB;AACF;AAEA,IAAM,SAAS,eAAe;AAKvB,SAAS,mBAAmB,WAA2B;AAC5D,SAAO,GAAG,SAAS,IAAI,MAAM;AAC/B;AAEA,SAAS,gBAAgB,GAA8B;AACrD,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,QAAM,IAAI;AACV,SACE,OAAO,EAAE,UAAU,YAAY,EAAE,MAAM,SAAS,KAChD,OAAO,EAAE,aAAa,YAAY,EAAE,SAAS,SAAS,KACtD,OAAO,EAAE,mBAAmB,YAAY,EAAE,eAAe,SAAS,KAClE,OAAO,EAAE,eAAe,YAAY,OAAO,SAAS,EAAE,UAAU,KAAK,EAAE,aAAa;AAExF;AAEA,SAAS,YAAY,WAAyB;AAC5C,MAAI;AACF,iBAAa,WAAW,QAAQ,SAAS,CAAC;AAAA,EAC5C,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,kBAAkB,WAAuC;AACvE,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACJ,MAAI;AACF,UAAM,aAAa,QAAQ,QAAQ,SAAS,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,KAAM,QAAO;AACxB,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,gBAAY,SAAS;AACrB,WAAO;AAAA,EACT;AACA,MAAI,CAAC,gBAAgB,MAAM,GAAG;AAC5B,gBAAY,SAAS;AACrB,WAAO;AAAA,EACT;AACA,MAAI,OAAO,cAAc,KAAK,IAAI,IAAI,KAAM;AAC1C,gBAAY,SAAS;AACrB,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,mBAAmB,WAAmB,SAA4B;AAChF,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI,CAAC,gBAAgB,OAAO,GAAG;AAC7B,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,MAAI;AACF,iBAAa,QAAQ,QAAQ,SAAS,GAAG,KAAK,UAAU,OAAO,CAAC;AAAA,EAClE,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,mBAAmB,WAAyB;AAC1D,MAAI,OAAO,WAAW,YAAa;AACnC,cAAY,SAAS;AACvB;AAEO,SAAS,cAAc,WAA2B;AACvD,SAAO,QAAQ,SAAS;AAC1B;AAMO,SAAS,qBAAqB,eAA6B;AAChE,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI;AACF,UAAM,MAAM,KAAK,IAAI,IAAI;AACzB,UAAM,UAAU,QAAQ,mBAAmB,aAAa,CAAC;AACzD,UAAM,SAAS,GAAG,aAAa;AAC/B,UAAM,OAAiB,CAAC;AACxB,aAAS,IAAI,GAAG,IAAI,aAAa,QAAQ,KAAK,GAAG;AAC/C,YAAM,IAAI,aAAa,IAAI,CAAC;AAC5B,UAAI,KAAK,QAAQ,MAAM,QAAS;AAChC,UAAI,CAAC,EAAE,WAAW,MAAM,KAAK,CAAC,EAAE,SAAS,MAAM,EAAG;AAClD,YAAM,MAAM,aAAa,QAAQ,CAAC;AAClC,UAAI,OAAO,KAAM;AACjB,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,GAAG;AAAA,MACzB,QAAQ;AACN;AAAA,MACF;AACA,UAAI,gBAAgB,MAAM,KAAK,OAAO,cAAc,KAAK;AACvD,aAAK,KAAK,CAAC;AAAA,MACb;AAAA,IACF;AACA,eAAW,KAAK,KAAM,cAAa,WAAW,CAAC;AAAA,EACjD,QAAQ;AAAA,EAER;AACF;;;AH6IS;AAnQT,IAAM,sBAAsB;AAOrB,IAAM,cAAc,cAAuC,IAAI;AAuB/D,SAAS,aACd,OACc;AACd,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,oBAAoB;AAAA,IACpB;AAAA,IACA;AAAA,EACF,IAAI;AAIJ,QAAM,sBAAsB,mBAAmB,gBAAgB;AAE/D,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,MAAM;AACtD,UAAM,SAAS,kBAAkB,mBAAmB;AACpD,WAAO,SACH,EAAE,QAAQ,aAAa,SAAS,QAAQ,aAAa,OAAO,OAAO,KAAK,IACxE,EAAE,QAAQ,gBAAgB,SAAS,MAAM,aAAa,OAAO,OAAO,KAAK;AAAA,EAC/E,CAAC;AAGD,QAAM,mBAAmB,OAAO;AAChC,QAAM,oBAAoB,OAAO;AACjC,QAAM,oBAAoB,OAAO;AACjC,QAAM,sBAAsB,OAAO;AAGnC,QAAM,cAAc,OAAO,MAAM,OAAO;AACxC,cAAY,UAAU,MAAM;AAC5B,QAAM,aAAa,OAAO,MAAM;AAChC,aAAW,UAAU;AAErB,QAAM,YAAY;AAAA,IAChB,CAAC,aAAsC,eAA8B;AACnE,yBAAmB,mBAAmB;AACtC,kBAAY;AACZ,eAAS;AAAA,QACP,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IACA,CAAC,mBAAmB;AAAA,EACtB;AAIA,YAAU,MAAM;AACd,UAAM,UAAU,MAAM;AACtB,QAAI,WAAW,KAAM;AAErB,QAAI,oBAAoB,qBAAqB,MAAM;AACjD,UAAI,sBAAsB,QAAQ,gBAAgB;AAChD,kBAAU,gBAAgB,IAAI;AAC9B;AAAA,MACF;AACA,UAAI,YAAY;AAChB,mBAAa,WAAW,KAAK,QAAQ,KAAK,EACvC,KAAK,MAAM;AACV,YAAI,UAAW;AACf;AAAA,UAAS,CAAC,SACR,KAAK,YAAY,UACb,EAAE,GAAG,MAAM,QAAQ,iBAAiB,aAAa,MAAM,OAAO,KAAK,IACnE;AAAA,QACN;AAAA,MACF,CAAC,EACA,MAAM,CAAC,QAAiB;AACvB,YAAI,UAAW;AACf,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,kBAAU,SAAS,OAAO;AAAA,MAC5B,CAAC;AACH,aAAO,MAAM;AACX,oBAAY;AAAA,MACd;AAAA,IACF;AAEA,QAAI,CAAC,qBAAqB,qBAAqB,sBAAsB;AAGnE;AAAA,QAAS,CAAC,SACR,KAAK,YAAY,UACb,EAAE,GAAG,MAAM,QAAQ,aAAa,aAAa,MAAM,IACnD;AAAA,MACN;AACA;AAAA,IACF;AAIA,cAAU,gBAAgB,IAAI;AAAA,EAChC,GAAG;AAAA,IACD,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,YAAU,MAAM;AACd,QAAI,OAAO,WAAW,YAAa;AACnC,UAAM,MAAM,cAAc,mBAAmB;AAC7C,UAAM,aAAa,CAAC,MAAoB;AACtC,UAAI,EAAE,QAAQ,IAAK;AACnB,YAAM,UAAU,YAAY;AAG5B,UAAI,EAAE,YAAY,MAAM;AACtB,YAAI,WAAW,KAAM,WAAU,gBAAgB,IAAI;AACnD;AAAA,MACF;AAEA,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,EAAE,QAAQ;AAAA,MAChC,QAAQ;AAGN,YAAI,WAAW,KAAM,WAAU,gBAAgB,IAAI;AACnD;AAAA,MACF;AAMA,UAAI,WAAW,KAAM;AAGrB,UACE,OAAO,mBAAmB,QAAQ,kBAClC,OAAO,aAAa,QAAQ,UAC5B;AACA,kBAAU,gBAAgB,IAAI;AAAA,MAChC;AAAA,IAIF;AACA,WAAO,iBAAiB,WAAW,UAAU;AAC7C,WAAO,MAAM;AACX,aAAO,oBAAoB,WAAW,UAAU;AAAA,IAClD;AAAA,EACF,GAAG,CAAC,qBAAqB,SAAS,CAAC;AAGnC,YAAU,MAAM;AACd,yBAAqB,gBAAgB;AAAA,EACvC,GAAG,CAAC,gBAAgB,CAAC;AAErB,QAAM,SAAS,YAAY,YAAY;AACrC,UAAM,IAAI,WAAW;AACrB,QAAI,CAAC,EAAE,aAAa,EAAE,aAAa,MAAM;AACvC,eAAS,CAAC,UAAU,EAAE,GAAG,MAAM,QAAQ,SAAS,OAAO,uBAAuB,EAAE;AAChF;AAAA,IACF;AACA,aAAS,CAAC,UAAU,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,KAAK,EAAE;AAChE,QAAI;AACF,YAAM,UAAU,MAAM,cAAc;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAGD,UAAI,QAAQ,mBAAmB,WAAW,QAAQ,WAAW;AAC3D,cAAM,IAAI,MAAM,+BAA+B;AAAA,MACjD;AACA,yBAAmB,qBAAqB,OAAO;AAC/C,eAAS;AAAA,QACP,QAAQ;AAAA,QACR;AAAA,QACA,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,eAAS;AAAA,QACP,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,UAAU,YAAY,YAAY;AAEtC,QAAI;AACF,YAAM,cAAc,EAAE,OAAO;AAAA,IAC/B,QAAQ;AAAA,IAER;AACA,cAAU,gBAAgB,IAAI;AAAA,EAChC,GAAG,CAAC,SAAS,CAAC;AAEd,QAAM,QAAQ;AAAA,IACZ,OAAO;AAAA,MACL,QAAQ,MAAM;AAAA,MACd,SAAS,MAAM;AAAA,MACf,aAAa,MAAM;AAAA,MACnB,OAAO,MAAM;AAAA,MACb;AAAA,MACA;AAAA,IACF;AAAA,IACA,CAAC,OAAO,QAAQ,OAAO;AAAA,EACzB;AAEA,SAAO,oBAAC,YAAY,UAAZ,EAAqB,OAAe,UAAS;AACvD;;;AIjSA,SAAS,kBAAkB;AAMpB,SAAS,UAA4B;AAC1C,QAAM,MAAM,WAAW,WAAW;AAClC,MAAI,OAAO,MAAM;AACf,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO;AACT;AAEO,SAAS,gBAEH;AACX,QAAM,EAAE,YAAY,IAAI,QAAQ;AAChC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,SAAO,cAAuB;AAChC;;;ACeA,cAAc;AACd,cAAc;","names":[]}
+{"version":3,"sources":["../src/transport.ts","../src/auth-provider.tsx","../src/client-cache.ts","../src/sign-in.ts","../src/storage.ts","../src/use-auth.ts","../src/index.ts"],"sourcesContent":["// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport {\n  Client,\n  type WsClient,\n  type HttpClient,\n  type JsonWsClient,\n  type JsonHttpClient,\n} from \"@reifydb/client\";\nimport type { AuthCapableClient } from \"./types\";\n\nexport interface AuthTransport<\n  TClient extends AuthCapableClient = AuthCapableClient,\n> {\n  readonly kind: \"ws\" | \"http\";\n  connect(url: string, token?: string): Promise<TClient>;\n  release(client: TClient): void;\n}\n\nfunction release_with_disconnect(client: { disconnect?: () => void }): void {\n  if (typeof client.disconnect === \"function\") {\n    try {\n      client.disconnect();\n    } catch {\n      // disconnect should be idempotent and never throw, but guard anyway\n    }\n  }\n}\n\nexport const ws_transport: AuthTransport<WsClient> = {\n  kind: \"ws\",\n  async connect(url, token) {\n    return Client.connect_ws(\n      url,\n      token != null ? { format: \"rbcf\", token } : { format: \"rbcf\" },\n    );\n  },\n  release(client) {\n    release_with_disconnect(client);\n  },\n};\n\nexport const http_transport: AuthTransport<HttpClient> = {\n  kind: \"http\",\n  async connect(url, token) {\n    return Client.connect_http(\n      url,\n      token != null ? { format: \"rbcf\", token } : { format: \"rbcf\" },\n    );\n  },\n  release(_client) {\n    // HttpClient has no persistent socket; nothing to release.\n  },\n};\n\nexport const json_ws_transport: AuthTransport<JsonWsClient> = {\n  kind: \"ws\",\n  async connect(url, token) {\n    return Client.connect_json_ws(url, token != null ? { token } : undefined);\n  },\n  release(client) {\n    release_with_disconnect(client);\n  },\n};\n\nexport const json_http_transport: AuthTransport<JsonHttpClient> = {\n  kind: \"http\",\n  async connect(url, token) {\n    return Client.connect_json_http(url, token != null ? { token } : undefined);\n  },\n  release(_client) {\n    // JsonHttpClient has no persistent socket; nothing to release.\n  },\n};\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport React, {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactElement,\n  type ReactNode,\n} from \"react\";\n\nimport { clearClient, currentClient, ensureClient } from \"./client-cache\";\nimport { performSignIn } from \"./sign-in\";\nimport {\n  clearStoredSession,\n  readStoredSession,\n  storageKeyFor,\n  sweepExpiredSessions,\n  tabScopedNamespace,\n  writeStoredSession,\n} from \"./storage\";\nimport type {\n  AuthCapableClient,\n  AuthSession,\n  AuthState,\n  WalletConnector,\n} from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\nconst DEFAULT_TTL_SECONDS = 86400;\n\nexport interface AuthContextValue extends AuthState {\n  signIn(): Promise<void>;\n  signOut(): Promise<void>;\n}\n\nexport const AuthContext = createContext<AuthContextValue | null>(null);\n\nexport interface AuthProviderProps<\n  TClient extends AuthCapableClient = AuthCapableClient,\n> {\n  url: string;\n  transport: AuthTransport<TClient>;\n  storageNamespace: string;\n  method: string;\n  domain: string;\n  statement: string;\n  sessionTtlSeconds?: number;\n  wallet: WalletConnector;\n  children: ReactNode;\n}\n\ninterface InternalState {\n  status: AuthState[\"status\"];\n  session: AuthSession | null;\n  clientReady: boolean;\n  error: string | null;\n}\n\nexport function AuthProvider<TClient extends AuthCapableClient>(\n  props: AuthProviderProps<TClient>,\n): ReactElement {\n  const {\n    url,\n    transport,\n    storageNamespace,\n    method,\n    domain,\n    statement,\n    sessionTtlSeconds = DEFAULT_TTL_SECONDS,\n    wallet,\n    children,\n  } = props;\n\n  // Per-tab storage slot: each tab gets its own localStorage key so concurrent\n  // sign-ins in different tabs cannot stomp each other's session.\n  const effective_namespace = tabScopedNamespace(storageNamespace);\n\n  const [state, setState] = useState<InternalState>(() => {\n    const stored = readStoredSession(effective_namespace);\n    return stored\n      ? { status: \"verifying\", session: stored, clientReady: false, error: null }\n      : { status: \"disconnected\", session: null, clientReady: false, error: null };\n  });\n\n  // Pull live wallet fields into stable primitives for effect deps.\n  const wallet_connected = wallet.connected;\n  const wallet_connecting = wallet.connecting;\n  const wallet_public_key = wallet.publicKey;\n  const wallet_has_selected = wallet.hasSelectedWallet;\n\n  // Refs so callbacks can read latest values without re-binding.\n  const session_ref = useRef(state.session);\n  session_ref.current = state.session;\n  const wallet_ref = useRef(wallet);\n  wallet_ref.current = wallet;\n\n  const tear_down = useCallback(\n    (next_status: InternalState[\"status\"], next_error: string | null) => {\n      clearStoredSession(effective_namespace);\n      clearClient();\n      setState({\n        status: next_status,\n        session: null,\n        clientReady: false,\n        error: next_error,\n      });\n    },\n    [effective_namespace],\n  );\n\n  // Wallet-match gate: the security invariant. The authenticated client is only\n  // ever constructed when the connected wallet matches the persisted session.\n  useEffect(() => {\n    const session = state.session;\n    if (session == null) return;\n\n    if (wallet_connected && wallet_public_key != null) {\n      if (wallet_public_key !== session.wallet_address) {\n        tear_down(\"disconnected\", null);\n        return;\n      }\n      let cancelled = false;\n      ensureClient(transport, url, session.token)\n        .then(() => {\n          if (cancelled) return;\n          setState((prev) =>\n            prev.session === session\n              ? { ...prev, status: \"authenticated\", clientReady: true, error: null }\n              : prev,\n          );\n        })\n        .catch((err: unknown) => {\n          if (cancelled) return;\n          const message = err instanceof Error ? err.message : \"Failed to connect client\";\n          tear_down(\"error\", message);\n        });\n      return () => {\n        cancelled = true;\n      };\n    }\n\n    if (!wallet_connected && (wallet_connecting || wallet_has_selected)) {\n      // Wallet adapter is autoConnecting; stay in verifying. Do NOT construct\n      // the client yet - we must not authenticate before the match is confirmed.\n      setState((prev) =>\n        prev.session === session\n          ? { ...prev, status: \"verifying\", clientReady: false }\n          : prev,\n      );\n      return;\n    }\n\n    // Wallet is definitively absent (no selected wallet, not connecting). User\n    // explicitly disconnected, so the session can no longer be proven; tear down.\n    tear_down(\"disconnected\", null);\n  }, [\n    state.session,\n    wallet_connected,\n    wallet_connecting,\n    wallet_public_key,\n    wallet_has_selected,\n    transport,\n    url,\n    tear_down,\n  ]);\n\n  useEffect(() => {\n    if (typeof window === \"undefined\") return;\n    const key = storageKeyFor(effective_namespace);\n    const on_storage = (e: StorageEvent) => {\n      if (e.key !== key) return;\n      const current = session_ref.current;\n\n      // Another tab signed out / cleared the session.\n      if (e.newValue == null) {\n        if (current != null) tear_down(\"disconnected\", null);\n        return;\n      }\n\n      let parsed: Partial<AuthSession>;\n      try {\n        parsed = JSON.parse(e.newValue) as Partial<AuthSession>;\n      } catch {\n        // Corrupt entry written by another tab. Only react if we actually hold\n        // a session; otherwise there is nothing to defend.\n        if (current != null) tear_down(\"disconnected\", null);\n        return;\n      }\n\n      // We hold no session of our own: nothing to defend. Clearing storage here\n      // would clobber the session the other tab just wrote (and bounce it back\n      // out through this same handler). Let our own sign-in / autoConnect flow\n      // converge independently.\n      if (current == null) return;\n\n      // A genuinely different principal took over our storage slot.\n      if (\n        parsed.wallet_address !== current.wallet_address ||\n        parsed.identity !== current.identity\n      ) {\n        tear_down(\"disconnected\", null);\n      }\n\n      // Same principal, different token: a concurrent sign-in in another tab,\n      // not an intrusion. Keep our own still-valid client.\n    };\n    window.addEventListener(\"storage\", on_storage);\n    return () => {\n      window.removeEventListener(\"storage\", on_storage);\n    };\n  }, [effective_namespace, tear_down]);\n\n  // Housekeeping: drop expired per-tab slots left behind by closed tabs.\n  useEffect(() => {\n    sweepExpiredSessions(storageNamespace);\n  }, [storageNamespace]);\n\n  const signIn = useCallback(async () => {\n    const w = wallet_ref.current;\n    if (!w.connected || w.publicKey == null) {\n      setState((prev) => ({ ...prev, status: \"error\", error: \"Wallet not connected\" }));\n      return;\n    }\n    setState((prev) => ({ ...prev, status: \"signing\", error: null }));\n    try {\n      const session = await performSignIn({\n        url,\n        transport,\n        method,\n        wallet: w,\n        domain,\n        statement,\n        sessionTtlSeconds,\n      });\n      // Sanity: signed-in wallet must match the live publicKey. If the user\n      // swapped wallets while the signature was in flight, refuse the session.\n      if (session.wallet_address !== wallet_ref.current.publicKey) {\n        throw new Error(\"Wallet changed during sign in\");\n      }\n      writeStoredSession(effective_namespace, session);\n      setState({\n        status: \"verifying\",\n        session,\n        clientReady: false,\n        error: null,\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Sign in failed\";\n      setState({\n        status: \"error\",\n        session: null,\n        clientReady: false,\n        error: message,\n      });\n    }\n  }, [\n    url,\n    transport,\n    method,\n    domain,\n    statement,\n    sessionTtlSeconds,\n    effective_namespace,\n  ]);\n\n  const signOut = useCallback(async () => {\n    // Best-effort server-side logout via the currently-cached client.\n    try {\n      await currentClient().logout();\n    } catch {\n      // no current client, or server-side logout failed; tear down regardless\n    }\n    tear_down(\"disconnected\", null);\n  }, [tear_down]);\n\n  const value = useMemo<AuthContextValue>(\n    () => ({\n      status: state.status,\n      session: state.session,\n      clientReady: state.clientReady,\n      error: state.error,\n      signIn,\n      signOut,\n    }),\n    [state, signIn, signOut],\n  );\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthCapableClient } from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\n// Module-level dedupe: in React StrictMode (dev) the AuthProvider effect runs\n// twice with the same inputs, which previously opened two sockets. We cache the\n// in-flight promise so both runs share one connection.\n\nlet current_key: string | null = null;\nlet current_client: AuthCapableClient | null = null;\nlet current_transport: AuthTransport | null = null;\nlet pending_promise: Promise<AuthCapableClient> | null = null;\n\nfunction key_of(kind: string, url: string, token: string): string {\n  return `${kind}|${url}|${token}`;\n}\n\nexport async function ensureClient<T extends AuthCapableClient>(\n  transport: AuthTransport<T>,\n  url: string,\n  token: string,\n): Promise<T> {\n  const key = key_of(transport.kind, url, token);\n\n  if (current_key === key) {\n    if (current_client) return current_client as T;\n    if (pending_promise) return pending_promise as Promise<T>;\n  }\n\n  // New (kind, url, token) — release any prior client, start fresh.\n  if (current_client && current_transport) {\n    try {\n      (current_transport as AuthTransport<AuthCapableClient>).release(current_client);\n    } catch {\n      // release must be idempotent; ignore\n    }\n    current_client = null;\n  }\n  current_key = key;\n  current_transport = transport as AuthTransport;\n\n  const p = transport.connect(url, token).then((client) => {\n    // Another ensure/clear ran while we were connecting — drop this one.\n    if (current_key !== key) {\n      try {\n        transport.release(client);\n      } catch {\n        // ignore\n      }\n      throw new Error(\"@reifydb/auth: client connect superseded\");\n    }\n    current_client = client;\n    pending_promise = null;\n    return client;\n  });\n  pending_promise = p as Promise<AuthCapableClient>;\n  return p;\n}\n\nexport function clearClient(): void {\n  if (current_client && current_transport) {\n    try {\n      (current_transport as AuthTransport<AuthCapableClient>).release(current_client);\n    } catch {\n      // ignore\n    }\n  }\n  current_key = null;\n  current_client = null;\n  current_transport = null;\n  pending_promise = null;\n}\n\nexport function currentClient<T extends AuthCapableClient = AuthCapableClient>(): T {\n  if (!current_client) {\n    throw new Error(\"@reifydb/auth: no authenticated client; call ensureClient first\");\n  }\n  return current_client as T;\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthCapableClient, AuthSession, WalletConnector } from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\nexport interface SignInArgs<TClient extends AuthCapableClient = AuthCapableClient> {\n  url: string;\n  transport: AuthTransport<TClient>;\n  method: string;\n  wallet: Pick<WalletConnector, \"publicKey\" | \"signMessage\" | \"encodeSignature\">;\n  domain: string;\n  statement: string;\n  sessionTtlSeconds: number;\n}\n\nexport async function performSignIn<TClient extends AuthCapableClient>(\n  args: SignInArgs<TClient>,\n): Promise<AuthSession> {\n  const { url, transport, method, wallet, domain, statement, sessionTtlSeconds } = args;\n\n  const wallet_address = wallet.publicKey;\n  if (wallet_address == null || wallet_address.length === 0) {\n    throw new Error(\"@reifydb/auth: wallet.publicKey is required to sign in\");\n  }\n  if (!Number.isFinite(sessionTtlSeconds) || sessionTtlSeconds <= 0) {\n    throw new Error(\"@reifydb/auth: sessionTtlSeconds must be a positive number\");\n  }\n\n  const client = await transport.connect(url);\n  try {\n    const challenge = await client.login_challenge(method, {\n      identifier: wallet_address,\n      public_key: wallet_address,\n      domain,\n      statement,\n    });\n    if (challenge.kind !== \"challenge\") {\n      throw new Error(\n        `@reifydb/auth: expected challenge response, got ${challenge.kind}`,\n      );\n    }\n\n    const messageBytes = new TextEncoder().encode(challenge.message);\n    const signatureBytes = await wallet.signMessage(messageBytes);\n    const signature = wallet.encodeSignature(signatureBytes);\n\n    const auth = await client.login_challenge(method, {\n      challenge_id: challenge.challenge_id,\n      signature,\n      signed_message: challenge.message,\n    });\n    if (auth.kind !== \"authenticated\") {\n      throw new Error(\n        `@reifydb/auth: expected authenticated response, got ${auth.kind}`,\n      );\n    }\n\n    return {\n      token: auth.token,\n      identity: auth.identity,\n      wallet_address,\n      expires_at: Math.floor(Date.now() / 1000) + sessionTtlSeconds,\n    };\n  } finally {\n    transport.release(client);\n  }\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthSession } from \"./types\";\n\nconst SUFFIX = \".auth\";\n\nfunction key_for(namespace: string): string {\n  return `${namespace}${SUFFIX}`;\n}\n\n// A per-tab id so two tabs never share one localStorage slot and stomp each\n// other's session. Backed by sessionStorage: stable across reloads within a\n// tab, unique per tab, gone when the tab closes. Falls back to an ephemeral\n// in-memory id when sessionStorage or crypto.randomUUID is unavailable\n// (degraded: the session will not survive a reload).\nconst TAB_ID_KEY = \"reifydb.auth.tab\";\n\nfunction new_tab_id(): string {\n  try {\n    if (typeof crypto !== \"undefined\" && typeof crypto.randomUUID === \"function\") {\n      return crypto.randomUUID();\n    }\n  } catch {\n    // crypto unavailable; fall through to the cheap fallback\n  }\n  return `t-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;\n}\n\nfunction resolve_tab_id(): string {\n  if (typeof window === \"undefined\") return \"ssr\";\n  try {\n    const existing = sessionStorage.getItem(TAB_ID_KEY);\n    if (existing) return existing;\n    const id = new_tab_id();\n    sessionStorage.setItem(TAB_ID_KEY, id);\n    return id;\n  } catch {\n    // sessionStorage unavailable (private mode, disabled): ephemeral id.\n    return new_tab_id();\n  }\n}\n\nconst TAB_ID = resolve_tab_id();\n\n// Scopes a caller's namespace to this browser tab. AuthProvider feeds the\n// result into every storage operation so each tab gets its own slot and the\n// cross-tab `storage` listener filters other tabs out by key.\nexport function tabScopedNamespace(namespace: string): string {\n  return `${namespace}.${TAB_ID}`;\n}\n\nfunction is_auth_session(v: unknown): v is AuthSession {\n  if (v === null || typeof v !== \"object\") return false;\n  const o = v as Record<string, unknown>;\n  return (\n    typeof o.token === \"string\" && o.token.length > 0 &&\n    typeof o.identity === \"string\" && o.identity.length > 0 &&\n    typeof o.wallet_address === \"string\" && o.wallet_address.length > 0 &&\n    typeof o.expires_at === \"number\" && Number.isFinite(o.expires_at) && o.expires_at > 0\n  );\n}\n\nfunction safe_remove(namespace: string): void {\n  try {\n    localStorage.removeItem(key_for(namespace));\n  } catch {\n    // localStorage may be unavailable; ignore\n  }\n}\n\nexport function readStoredSession(namespace: string): AuthSession | null {\n  if (typeof window === \"undefined\") return null;\n  let raw: string | null;\n  try {\n    raw = localStorage.getItem(key_for(namespace));\n  } catch {\n    return null;\n  }\n  if (raw == null) return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    safe_remove(namespace);\n    return null;\n  }\n  if (!is_auth_session(parsed)) {\n    safe_remove(namespace);\n    return null;\n  }\n  if (parsed.expires_at <= Date.now() / 1000) {\n    safe_remove(namespace);\n    return null;\n  }\n  return parsed;\n}\n\nexport function writeStoredSession(namespace: string, session: AuthSession): void {\n  if (typeof window === \"undefined\") return;\n  if (!is_auth_session(session)) {\n    throw new Error(\"@reifydb/auth: refusing to persist malformed session\");\n  }\n  try {\n    localStorage.setItem(key_for(namespace), JSON.stringify(session));\n  } catch {\n    // localStorage may be unavailable (private mode, full quota); ignore.\n  }\n}\n\nexport function clearStoredSession(namespace: string): void {\n  if (typeof window === \"undefined\") return;\n  safe_remove(namespace);\n}\n\nexport function storageKeyFor(namespace: string): string {\n  return key_for(namespace);\n}\n\n// Closed tabs leave their per-tab slot in localStorage forever - nothing ever\n// reads that namespace again. Sweep once on mount: drop slots under\n// `baseNamespace` that belong to other tabs and have already expired. Live\n// tabs' slots have a future `expires_at` and are never touched.\nexport function sweepExpiredSessions(baseNamespace: string): void {\n  if (typeof window === \"undefined\") return;\n  try {\n    const now = Date.now() / 1000;\n    const own_key = key_for(tabScopedNamespace(baseNamespace));\n    const prefix = `${baseNamespace}.`;\n    const dead: string[] = [];\n    for (let i = 0; i < localStorage.length; i += 1) {\n      const k = localStorage.key(i);\n      if (k == null || k === own_key) continue;\n      if (!k.startsWith(prefix) || !k.endsWith(SUFFIX)) continue;\n      const raw = localStorage.getItem(k);\n      if (raw == null) continue;\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(raw);\n      } catch {\n        continue;\n      }\n      if (is_auth_session(parsed) && parsed.expires_at <= now) {\n        dead.push(k);\n      }\n    }\n    for (const k of dead) localStorage.removeItem(k);\n  } catch {\n    // localStorage unavailable; nothing to sweep.\n  }\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport { useContext } from \"react\";\n\nimport { AuthContext, type AuthContextValue } from \"./auth-provider\";\nimport { currentClient } from \"./client-cache\";\nimport type { AuthCapableClient } from \"./types\";\n\nexport function useAuth(): AuthContextValue {\n  const ctx = useContext(AuthContext);\n  if (ctx == null) {\n    throw new Error(\"@reifydb/auth: useAuth must be used inside <AuthProvider>\");\n  }\n  return ctx;\n}\n\nexport function useAuthClient<\n  TClient extends AuthCapableClient = AuthCapableClient,\n>(): TClient {\n  const { clientReady } = useAuth();\n  if (!clientReady) {\n    throw new Error(\"@reifydb/auth: useAuthClient called before clientReady\");\n  }\n  return currentClient<TClient>();\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nexport type {\n  AuthCapableClient,\n  AuthSession,\n  AuthState,\n  AuthStatus,\n  LoginChallengeResult,\n  WalletConnector,\n} from \"./types\";\n\nexport type { AuthTransport } from \"./transport\";\nexport {\n  http_transport,\n  json_http_transport,\n  json_ws_transport,\n  ws_transport,\n} from \"./transport\";\n\nexport {\n  AuthContext,\n  AuthProvider,\n  type AuthContextValue,\n  type AuthProviderProps,\n} from \"./auth-provider\";\n\nexport { useAuth, useAuthClient } from \"./use-auth\";\n\nexport { performSignIn, type SignInArgs } from \"./sign-in\";\n\nexport {\n  clearStoredSession,\n  readStoredSession,\n  storageKeyFor,\n  writeStoredSession,\n} from \"./storage\";\n\nexport { clearClient, currentClient, ensureClient } from \"./client-cache\";\n\nexport * from \"@reifydb/core\";\nexport * from \"@reifydb/client\";\n"],"mappings":";AAGA;AAAA,EACE;AAAA,OAKK;AAWP,SAAS,wBAAwB,QAA2C;AAC1E,MAAI,OAAO,OAAO,eAAe,YAAY;AAC3C,QAAI;AACF,aAAO,WAAW;AAAA,IACpB,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAEO,IAAM,eAAwC;AAAA,EACnD,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO;AAAA,MACZ;AAAA,MACA,SAAS,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI,EAAE,QAAQ,OAAO;AAAA,IAC/D;AAAA,EACF;AAAA,EACA,QAAQ,QAAQ;AACd,4BAAwB,MAAM;AAAA,EAChC;AACF;AAEO,IAAM,iBAA4C;AAAA,EACvD,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO;AAAA,MACZ;AAAA,MACA,SAAS,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI,EAAE,QAAQ,OAAO;AAAA,IAC/D;AAAA,EACF;AAAA,EACA,QAAQ,SAAS;AAAA,EAEjB;AACF;AAEO,IAAM,oBAAiD;AAAA,EAC5D,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO,gBAAgB,KAAK,SAAS,OAAO,EAAE,MAAM,IAAI,MAAS;AAAA,EAC1E;AAAA,EACA,QAAQ,QAAQ;AACd,4BAAwB,MAAM;AAAA,EAChC;AACF;AAEO,IAAM,sBAAqD;AAAA,EAChE,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO,kBAAkB,KAAK,SAAS,OAAO,EAAE,MAAM,IAAI,MAAS;AAAA,EAC5E;AAAA,EACA,QAAQ,SAAS;AAAA,EAEjB;AACF;;;ACvEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;;;ACFP,IAAI,cAA6B;AACjC,IAAI,iBAA2C;AAC/C,IAAI,oBAA0C;AAC9C,IAAI,kBAAqD;AAEzD,SAAS,OAAO,MAAc,KAAa,OAAuB;AAChE,SAAO,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK;AAChC;AAEA,eAAsB,aACpB,WACA,KACA,OACY;AACZ,QAAM,MAAM,OAAO,UAAU,MAAM,KAAK,KAAK;AAE7C,MAAI,gBAAgB,KAAK;AACvB,QAAI,eAAgB,QAAO;AAC3B,QAAI,gBAAiB,QAAO;AAAA,EAC9B;AAGA,MAAI,kBAAkB,mBAAmB;AACvC,QAAI;AACF,MAAC,kBAAuD,QAAQ,cAAc;AAAA,IAChF,QAAQ;AAAA,IAER;AACA,qBAAiB;AAAA,EACnB;AACA,gBAAc;AACd,sBAAoB;AAEpB,QAAM,IAAI,UAAU,QAAQ,KAAK,KAAK,EAAE,KAAK,CAAC,WAAW;AAEvD,QAAI,gBAAgB,KAAK;AACvB,UAAI;AACF,kBAAU,QAAQ,MAAM;AAAA,MAC1B,QAAQ;AAAA,MAER;AACA,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AACA,qBAAiB;AACjB,sBAAkB;AAClB,WAAO;AAAA,EACT,CAAC;AACD,oBAAkB;AAClB,SAAO;AACT;AAEO,SAAS,cAAoB;AAClC,MAAI,kBAAkB,mBAAmB;AACvC,QAAI;AACF,MAAC,kBAAuD,QAAQ,cAAc;AAAA,IAChF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,gBAAc;AACd,mBAAiB;AACjB,sBAAoB;AACpB,oBAAkB;AACpB;AAEO,SAAS,gBAAoE;AAClF,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,SAAO;AACT;;;AChEA,eAAsB,cACpB,MACsB;AACtB,QAAM,EAAE,KAAK,WAAW,QAAQ,QAAQ,QAAQ,WAAW,kBAAkB,IAAI;AAEjF,QAAM,iBAAiB,OAAO;AAC9B,MAAI,kBAAkB,QAAQ,eAAe,WAAW,GAAG;AACzD,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,MAAI,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,GAAG;AACjE,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAEA,QAAM,SAAS,MAAM,UAAU,QAAQ,GAAG;AAC1C,MAAI;AACF,UAAM,YAAY,MAAM,OAAO,gBAAgB,QAAQ;AAAA,MACrD,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,UAAU,SAAS,aAAa;AAClC,YAAM,IAAI;AAAA,QACR,mDAAmD,UAAU,IAAI;AAAA,MACnE;AAAA,IACF;AAEA,UAAM,eAAe,IAAI,YAAY,EAAE,OAAO,UAAU,OAAO;AAC/D,UAAM,iBAAiB,MAAM,OAAO,YAAY,YAAY;AAC5D,UAAM,YAAY,OAAO,gBAAgB,cAAc;AAEvD,UAAM,OAAO,MAAM,OAAO,gBAAgB,QAAQ;AAAA,MAChD,cAAc,UAAU;AAAA,MACxB;AAAA,MACA,gBAAgB,UAAU;AAAA,IAC5B,CAAC;AACD,QAAI,KAAK,SAAS,iBAAiB;AACjC,YAAM,IAAI;AAAA,QACR,uDAAuD,KAAK,IAAI;AAAA,MAClE;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf;AAAA,MACA,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,IAC9C;AAAA,EACF,UAAE;AACA,cAAU,QAAQ,MAAM;AAAA,EAC1B;AACF;;;AC9DA,IAAM,SAAS;AAEf,SAAS,QAAQ,WAA2B;AAC1C,SAAO,GAAG,SAAS,GAAG,MAAM;AAC9B;AAOA,IAAM,aAAa;AAEnB,SAAS,aAAqB;AAC5B,MAAI;AACF,QAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe,YAAY;AAC5E,aAAO,OAAO,WAAW;AAAA,IAC3B;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,KAAK,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5E;AAEA,SAAS,iBAAyB;AAChC,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACF,UAAM,WAAW,eAAe,QAAQ,UAAU;AAClD,QAAI,SAAU,QAAO;AACrB,UAAM,KAAK,WAAW;AACtB,mBAAe,QAAQ,YAAY,EAAE;AACrC,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO,WAAW;AAAA,EACpB;AACF;AAEA,IAAM,SAAS,eAAe;AAKvB,SAAS,mBAAmB,WAA2B;AAC5D,SAAO,GAAG,SAAS,IAAI,MAAM;AAC/B;AAEA,SAAS,gBAAgB,GAA8B;AACrD,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,QAAM,IAAI;AACV,SACE,OAAO,EAAE,UAAU,YAAY,EAAE,MAAM,SAAS,KAChD,OAAO,EAAE,aAAa,YAAY,EAAE,SAAS,SAAS,KACtD,OAAO,EAAE,mBAAmB,YAAY,EAAE,eAAe,SAAS,KAClE,OAAO,EAAE,eAAe,YAAY,OAAO,SAAS,EAAE,UAAU,KAAK,EAAE,aAAa;AAExF;AAEA,SAAS,YAAY,WAAyB;AAC5C,MAAI;AACF,iBAAa,WAAW,QAAQ,SAAS,CAAC;AAAA,EAC5C,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,kBAAkB,WAAuC;AACvE,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACJ,MAAI;AACF,UAAM,aAAa,QAAQ,QAAQ,SAAS,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,KAAM,QAAO;AACxB,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,gBAAY,SAAS;AACrB,WAAO;AAAA,EACT;AACA,MAAI,CAAC,gBAAgB,MAAM,GAAG;AAC5B,gBAAY,SAAS;AACrB,WAAO;AAAA,EACT;AACA,MAAI,OAAO,cAAc,KAAK,IAAI,IAAI,KAAM;AAC1C,gBAAY,SAAS;AACrB,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,mBAAmB,WAAmB,SAA4B;AAChF,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI,CAAC,gBAAgB,OAAO,GAAG;AAC7B,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,MAAI;AACF,iBAAa,QAAQ,QAAQ,SAAS,GAAG,KAAK,UAAU,OAAO,CAAC;AAAA,EAClE,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,mBAAmB,WAAyB;AAC1D,MAAI,OAAO,WAAW,YAAa;AACnC,cAAY,SAAS;AACvB;AAEO,SAAS,cAAc,WAA2B;AACvD,SAAO,QAAQ,SAAS;AAC1B;AAMO,SAAS,qBAAqB,eAA6B;AAChE,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI;AACF,UAAM,MAAM,KAAK,IAAI,IAAI;AACzB,UAAM,UAAU,QAAQ,mBAAmB,aAAa,CAAC;AACzD,UAAM,SAAS,GAAG,aAAa;AAC/B,UAAM,OAAiB,CAAC;AACxB,aAAS,IAAI,GAAG,IAAI,aAAa,QAAQ,KAAK,GAAG;AAC/C,YAAM,IAAI,aAAa,IAAI,CAAC;AAC5B,UAAI,KAAK,QAAQ,MAAM,QAAS;AAChC,UAAI,CAAC,EAAE,WAAW,MAAM,KAAK,CAAC,EAAE,SAAS,MAAM,EAAG;AAClD,YAAM,MAAM,aAAa,QAAQ,CAAC;AAClC,UAAI,OAAO,KAAM;AACjB,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,GAAG;AAAA,MACzB,QAAQ;AACN;AAAA,MACF;AACA,UAAI,gBAAgB,MAAM,KAAK,OAAO,cAAc,KAAK;AACvD,aAAK,KAAK,CAAC;AAAA,MACb;AAAA,IACF;AACA,eAAW,KAAK,KAAM,cAAa,WAAW,CAAC;AAAA,EACjD,QAAQ;AAAA,EAER;AACF;;;AH6IS;AAnQT,IAAM,sBAAsB;AAOrB,IAAM,cAAc,cAAuC,IAAI;AAuB/D,SAAS,aACd,OACc;AACd,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,oBAAoB;AAAA,IACpB;AAAA,IACA;AAAA,EACF,IAAI;AAIJ,QAAM,sBAAsB,mBAAmB,gBAAgB;AAE/D,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,MAAM;AACtD,UAAM,SAAS,kBAAkB,mBAAmB;AACpD,WAAO,SACH,EAAE,QAAQ,aAAa,SAAS,QAAQ,aAAa,OAAO,OAAO,KAAK,IACxE,EAAE,QAAQ,gBAAgB,SAAS,MAAM,aAAa,OAAO,OAAO,KAAK;AAAA,EAC/E,CAAC;AAGD,QAAM,mBAAmB,OAAO;AAChC,QAAM,oBAAoB,OAAO;AACjC,QAAM,oBAAoB,OAAO;AACjC,QAAM,sBAAsB,OAAO;AAGnC,QAAM,cAAc,OAAO,MAAM,OAAO;AACxC,cAAY,UAAU,MAAM;AAC5B,QAAM,aAAa,OAAO,MAAM;AAChC,aAAW,UAAU;AAErB,QAAM,YAAY;AAAA,IAChB,CAAC,aAAsC,eAA8B;AACnE,yBAAmB,mBAAmB;AACtC,kBAAY;AACZ,eAAS;AAAA,QACP,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IACA,CAAC,mBAAmB;AAAA,EACtB;AAIA,YAAU,MAAM;AACd,UAAM,UAAU,MAAM;AACtB,QAAI,WAAW,KAAM;AAErB,QAAI,oBAAoB,qBAAqB,MAAM;AACjD,UAAI,sBAAsB,QAAQ,gBAAgB;AAChD,kBAAU,gBAAgB,IAAI;AAC9B;AAAA,MACF;AACA,UAAI,YAAY;AAChB,mBAAa,WAAW,KAAK,QAAQ,KAAK,EACvC,KAAK,MAAM;AACV,YAAI,UAAW;AACf;AAAA,UAAS,CAAC,SACR,KAAK,YAAY,UACb,EAAE,GAAG,MAAM,QAAQ,iBAAiB,aAAa,MAAM,OAAO,KAAK,IACnE;AAAA,QACN;AAAA,MACF,CAAC,EACA,MAAM,CAAC,QAAiB;AACvB,YAAI,UAAW;AACf,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,kBAAU,SAAS,OAAO;AAAA,MAC5B,CAAC;AACH,aAAO,MAAM;AACX,oBAAY;AAAA,MACd;AAAA,IACF;AAEA,QAAI,CAAC,qBAAqB,qBAAqB,sBAAsB;AAGnE;AAAA,QAAS,CAAC,SACR,KAAK,YAAY,UACb,EAAE,GAAG,MAAM,QAAQ,aAAa,aAAa,MAAM,IACnD;AAAA,MACN;AACA;AAAA,IACF;AAIA,cAAU,gBAAgB,IAAI;AAAA,EAChC,GAAG;AAAA,IACD,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,YAAU,MAAM;AACd,QAAI,OAAO,WAAW,YAAa;AACnC,UAAM,MAAM,cAAc,mBAAmB;AAC7C,UAAM,aAAa,CAAC,MAAoB;AACtC,UAAI,EAAE,QAAQ,IAAK;AACnB,YAAM,UAAU,YAAY;AAG5B,UAAI,EAAE,YAAY,MAAM;AACtB,YAAI,WAAW,KAAM,WAAU,gBAAgB,IAAI;AACnD;AAAA,MACF;AAEA,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,EAAE,QAAQ;AAAA,MAChC,QAAQ;AAGN,YAAI,WAAW,KAAM,WAAU,gBAAgB,IAAI;AACnD;AAAA,MACF;AAMA,UAAI,WAAW,KAAM;AAGrB,UACE,OAAO,mBAAmB,QAAQ,kBAClC,OAAO,aAAa,QAAQ,UAC5B;AACA,kBAAU,gBAAgB,IAAI;AAAA,MAChC;AAAA,IAIF;AACA,WAAO,iBAAiB,WAAW,UAAU;AAC7C,WAAO,MAAM;AACX,aAAO,oBAAoB,WAAW,UAAU;AAAA,IAClD;AAAA,EACF,GAAG,CAAC,qBAAqB,SAAS,CAAC;AAGnC,YAAU,MAAM;AACd,yBAAqB,gBAAgB;AAAA,EACvC,GAAG,CAAC,gBAAgB,CAAC;AAErB,QAAM,SAAS,YAAY,YAAY;AACrC,UAAM,IAAI,WAAW;AACrB,QAAI,CAAC,EAAE,aAAa,EAAE,aAAa,MAAM;AACvC,eAAS,CAAC,UAAU,EAAE,GAAG,MAAM,QAAQ,SAAS,OAAO,uBAAuB,EAAE;AAChF;AAAA,IACF;AACA,aAAS,CAAC,UAAU,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,KAAK,EAAE;AAChE,QAAI;AACF,YAAM,UAAU,MAAM,cAAc;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAGD,UAAI,QAAQ,mBAAmB,WAAW,QAAQ,WAAW;AAC3D,cAAM,IAAI,MAAM,+BAA+B;AAAA,MACjD;AACA,yBAAmB,qBAAqB,OAAO;AAC/C,eAAS;AAAA,QACP,QAAQ;AAAA,QACR;AAAA,QACA,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,eAAS;AAAA,QACP,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,UAAU,YAAY,YAAY;AAEtC,QAAI;AACF,YAAM,cAAc,EAAE,OAAO;AAAA,IAC/B,QAAQ;AAAA,IAER;AACA,cAAU,gBAAgB,IAAI;AAAA,EAChC,GAAG,CAAC,SAAS,CAAC;AAEd,QAAM,QAAQ;AAAA,IACZ,OAAO;AAAA,MACL,QAAQ,MAAM;AAAA,MACd,SAAS,MAAM;AAAA,MACf,aAAa,MAAM;AAAA,MACnB,OAAO,MAAM;AAAA,MACb;AAAA,MACA;AAAA,IACF;AAAA,IACA,CAAC,OAAO,QAAQ,OAAO;AAAA,EACzB;AAEA,SAAO,oBAAC,YAAY,UAAZ,EAAqB,OAAe,UAAS;AACvD;;;AIjSA,SAAS,kBAAkB;AAMpB,SAAS,UAA4B;AAC1C,QAAM,MAAM,WAAW,WAAW;AAClC,MAAI,OAAO,MAAM;AACf,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO;AACT;AAEO,SAAS,gBAEH;AACX,QAAM,EAAE,YAAY,IAAI,QAAQ;AAChC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,SAAO,cAAuB;AAChC;;;ACeA,cAAc;AACd,cAAc;","names":[]}

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@reifydb/auth",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "dependencies": {
-    "@reifydb/client": "0.6.0",
-    "@reifydb/core": "0.6.0"
+    "@reifydb/core": "0.7.0",
+    "@reifydb/client": "0.7.0"
   },
   "peerDependencies": {
     "react": ">=16.8.0"
@@ -37,14 +37,13 @@
   "files": [
     "dist/",
     "package.json",
-    "readme.md",
-    "license.md"
+    "readme.md"
   ],
   "publishConfig": {
     "access": "public",
     "linkWorkspacePackages": false
   },
-  "license": "MIT",
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/reifydb/reifydb.git",

package/license.md

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 ReifyDB
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.