@reifydb/auth 0.8.0 → 0.9.0

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { LoginChallengeResult, HttpClient, JsonHttpClient, JsonWsClient, WsClient } from '@reifydb/client';
+import { LoginChallengeResult, LoginResult, HttpClient, JsonHttpClient, JsonWsClient, WsClient } from '@reifydb/client';
 export * from '@reifydb/client';
-export { LoginChallengeResult } from '@reifydb/client';
+export { LoginChallengeResult, LoginResult } from '@reifydb/client';
 import React, { ReactNode, ReactElement } from 'react';
 export * from '@reifydb/core';
 
@@ -10,6 +10,12 @@ interface AuthSession {
     readonly identity: string;
     readonly wallet_address: string;
     readonly expires_at: number;
+    readonly method?: "wallet" | "password";
+    readonly identifier?: string;
+}
+interface PasswordCredentials {
+    readonly identifier: string;
+    readonly password: string;
 }
 interface AuthState {
     readonly status: AuthStatus;
@@ -29,6 +35,9 @@ interface AuthCapableClient {
     login_challenge(method: string, credentials: Record<string, string>): Promise<LoginChallengeResult>;
     logout(): Promise<void>;
 }
+interface CredentialAuthCapableClient extends AuthCapableClient {
+    login_with_password(identifier: string, password: string): Promise<LoginResult>;
+}
 
 interface AuthTransport<TClient extends AuthCapableClient = AuthCapableClient> {
     readonly kind: "ws" | "http";
@@ -41,7 +50,7 @@ declare const json_ws_transport: AuthTransport<JsonWsClient>;
 declare const json_http_transport: AuthTransport<JsonHttpClient>;
 
 interface AuthContextValue extends AuthState {
-    signIn(): Promise<void>;
+    signIn(credentials?: PasswordCredentials): Promise<void>;
     signOut(): Promise<void>;
 }
 declare const AuthContext: React.Context<AuthContextValue | null>;
@@ -49,11 +58,12 @@ interface AuthProviderProps<TClient extends AuthCapableClient = AuthCapableClien
     url: string;
     transport: AuthTransport<TClient>;
     storageNamespace: string;
-    method: string;
-    domain: string;
-    statement: string;
+    method?: string;
+    domain?: string;
+    statement?: string;
     sessionTtlSeconds?: number;
-    wallet: WalletConnector;
+    wallet?: WalletConnector;
+    sessionScope?: "tab" | "browser";
     children: ReactNode;
 }
 declare function AuthProvider<TClient extends AuthCapableClient>(props: AuthProviderProps<TClient>): ReactElement;
@@ -72,6 +82,15 @@ interface SignInArgs<TClient extends AuthCapableClient = AuthCapableClient> {
 }
 declare function performSignIn<TClient extends AuthCapableClient>(args: SignInArgs<TClient>): Promise<AuthSession>;
 
+interface PasswordSignInArgs<TClient extends AuthCapableClient = AuthCapableClient> {
+    url: string;
+    transport: AuthTransport<TClient>;
+    identifier: string;
+    password: string;
+    sessionTtlSeconds: number;
+}
+declare function performPasswordSignIn<TClient extends AuthCapableClient>(args: PasswordSignInArgs<TClient>): Promise<AuthSession>;
+
 declare function readStoredSession(namespace: string): AuthSession | null;
 declare function writeStoredSession(namespace: string, session: AuthSession): void;
 declare function clearStoredSession(namespace: string): void;
@@ -81,4 +100,4 @@ declare function ensureClient<T extends AuthCapableClient>(transport: AuthTransp
 declare function clearClient(): void;
 declare function currentClient<T extends AuthCapableClient = AuthCapableClient>(): T;
 
-export { type AuthCapableClient, AuthContext, type AuthContextValue, AuthProvider, type AuthProviderProps, type AuthSession, type AuthState, type AuthStatus, type AuthTransport, type SignInArgs, type WalletConnector, clearClient, clearStoredSession, currentClient, ensureClient, http_transport, json_http_transport, json_ws_transport, performSignIn, readStoredSession, storageKeyFor, useAuth, useAuthClient, writeStoredSession, ws_transport };
+export { type AuthCapableClient, AuthContext, type AuthContextValue, AuthProvider, type AuthProviderProps, type AuthSession, type AuthState, type AuthStatus, type AuthTransport, type CredentialAuthCapableClient, type PasswordCredentials, type PasswordSignInArgs, type SignInArgs, type WalletConnector, clearClient, clearStoredSession, currentClient, ensureClient, http_transport, json_http_transport, json_ws_transport, performPasswordSignIn, performSignIn, readStoredSession, storageKeyFor, useAuth, useAuthClient, writeStoredSession, ws_transport };

package/dist/index.js

@@ -165,6 +165,42 @@ async function performSignIn(args) {
   }
 }
 
+// src/sign-in-password.ts
+function supports_password_login(client) {
+  return typeof client.login_with_password === "function";
+}
+async function performPasswordSignIn(args) {
+  const { url, transport, identifier, password, sessionTtlSeconds } = args;
+  if (identifier.length === 0) {
+    throw new Error("@reifydb/auth: identifier is required to sign in");
+  }
+  if (password.length === 0) {
+    throw new Error("@reifydb/auth: password is required to sign in");
+  }
+  if (!Number.isFinite(sessionTtlSeconds) || sessionTtlSeconds <= 0) {
+    throw new Error("@reifydb/auth: sessionTtlSeconds must be a positive number");
+  }
+  const client = await transport.connect(url);
+  try {
+    if (!supports_password_login(client)) {
+      throw new Error(
+        "@reifydb/auth: transport client does not support login_with_password"
+      );
+    }
+    const auth = await client.login_with_password(identifier, password);
+    return {
+      token: auth.token,
+      identity: auth.identity,
+      wallet_address: identifier,
+      identifier,
+      method: "password",
+      expires_at: Math.floor(Date.now() / 1e3) + sessionTtlSeconds
+    };
+  } finally {
+    transport.release(client);
+  }
+}
+
 // src/storage.ts
 var SUFFIX = ".auth";
 function key_for(namespace) {
@@ -199,6 +235,12 @@ function tabScopedNamespace(namespace) {
 function is_auth_session(v) {
   if (v === null || typeof v !== "object") return false;
   const o = v;
+  if (o.method !== void 0 && o.method !== "wallet" && o.method !== "password") {
+    return false;
+  }
+  if (o.identifier !== void 0 && typeof o.identifier !== "string") {
+    return false;
+  }
   return typeof o.token === "string" && o.token.length > 0 && typeof o.identity === "string" && o.identity.length > 0 && typeof o.wallet_address === "string" && o.wallet_address.length > 0 && typeof o.expires_at === "number" && Number.isFinite(o.expires_at) && o.expires_at > 0;
 }
 function safe_remove(namespace) {
@@ -292,17 +334,18 @@ function AuthProvider(props) {
     statement,
     sessionTtlSeconds = DEFAULT_TTL_SECONDS,
     wallet,
+    sessionScope = "tab",
     children
   } = props;
-  const effective_namespace = tabScopedNamespace(storageNamespace);
+  const effective_namespace = sessionScope === "browser" ? storageNamespace : tabScopedNamespace(storageNamespace);
   const [state, setState] = useState(() => {
     const stored = readStoredSession(effective_namespace);
     return stored ? { status: "verifying", session: stored, clientReady: false, error: null } : { status: "disconnected", session: null, clientReady: false, error: null };
   });
-  const wallet_connected = wallet.connected;
-  const wallet_connecting = wallet.connecting;
-  const wallet_public_key = wallet.publicKey;
-  const wallet_has_selected = wallet.hasSelectedWallet;
+  const wallet_connected = wallet?.connected ?? false;
+  const wallet_connecting = wallet?.connecting ?? false;
+  const wallet_public_key = wallet?.publicKey ?? null;
+  const wallet_has_selected = wallet?.hasSelectedWallet ?? false;
   const session_ref = useRef(state.session);
   session_ref.current = state.session;
   const wallet_ref = useRef(wallet);
@@ -323,11 +366,7 @@ function AuthProvider(props) {
   useEffect(() => {
     const session = state.session;
     if (session == null) return;
-    if (wallet_connected && wallet_public_key != null) {
-      if (wallet_public_key !== session.wallet_address) {
-        tear_down("disconnected", null);
-        return;
-      }
+    const establish = () => {
       let cancelled = false;
       ensureClient(transport, url, session.token).then(() => {
         if (cancelled) return;
@@ -342,6 +381,16 @@ function AuthProvider(props) {
       return () => {
         cancelled = true;
       };
+    };
+    if (session.method === "password") {
+      return establish();
+    }
+    if (wallet_connected && wallet_public_key != null) {
+      if (wallet_public_key !== session.wallet_address) {
+        tear_down("disconnected", null);
+        return;
+      }
+      return establish();
     }
     if (!wallet_connected && (wallet_connecting || wallet_has_selected)) {
       setState(
@@ -390,12 +439,48 @@ function AuthProvider(props) {
   useEffect(() => {
     sweepExpiredSessions(storageNamespace);
   }, [storageNamespace]);
-  const signIn = useCallback(async () => {
+  const signIn = useCallback(async (credentials) => {
+    if (credentials != null) {
+      setState((prev) => ({ ...prev, status: "signing", error: null }));
+      try {
+        const session = await performPasswordSignIn({
+          url,
+          transport,
+          identifier: credentials.identifier,
+          password: credentials.password,
+          sessionTtlSeconds
+        });
+        writeStoredSession(effective_namespace, session);
+        setState({
+          status: "verifying",
+          session,
+          clientReady: false,
+          error: null
+        });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Sign in failed";
+        setState({
+          status: "error",
+          session: null,
+          clientReady: false,
+          error: message
+        });
+      }
+      return;
+    }
     const w = wallet_ref.current;
-    if (!w.connected || w.publicKey == null) {
+    if (w == null || !w.connected || w.publicKey == null) {
       setState((prev) => ({ ...prev, status: "error", error: "Wallet not connected" }));
       return;
     }
+    if (method == null || domain == null || statement == null) {
+      setState((prev) => ({
+        ...prev,
+        status: "error",
+        error: "Wallet sign in requires method, domain, and statement"
+      }));
+      return;
+    }
     setState((prev) => ({ ...prev, status: "signing", error: null }));
     try {
       const session = await performSignIn({
@@ -407,7 +492,7 @@ function AuthProvider(props) {
         statement,
         sessionTtlSeconds
       });
-      if (session.wallet_address !== wallet_ref.current.publicKey) {
+      if (session.wallet_address !== wallet_ref.current?.publicKey) {
         throw new Error("Wallet changed during sign in");
       }
       writeStoredSession(effective_namespace, session);
@@ -486,6 +571,7 @@ export {
   http_transport,
   json_http_transport,
   json_ws_transport,
+  performPasswordSignIn,
   performSignIn,
   readStoredSession,
   storageKeyFor,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/transport.ts","../src/auth-provider.tsx","../src/client-cache.ts","../src/sign-in.ts","../src/storage.ts","../src/use-auth.ts","../src/index.ts"],"sourcesContent":["// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport {\n  Client,\n  type WsClient,\n  type HttpClient,\n  type JsonWsClient,\n  type JsonHttpClient,\n} from \"@reifydb/client\";\nimport type { AuthCapableClient } from \"./types\";\n\nexport interface AuthTransport<\n  TClient extends AuthCapableClient = AuthCapableClient,\n> {\n  readonly kind: \"ws\" | \"http\";\n  connect(url: string, token?: string): Promise<TClient>;\n  release(client: TClient): void;\n}\n\nfunction release_with_disconnect(client: { disconnect?: () => void }): void {\n  if (typeof client.disconnect === \"function\") {\n    try {\n      client.disconnect();\n    } catch {\n      // disconnect should be idempotent and never throw, but guard anyway\n    }\n  }\n}\n\nexport const ws_transport: AuthTransport<WsClient> = {\n  kind: \"ws\",\n  async connect(url, token) {\n    return Client.connect_ws(\n      url,\n      token != null ? { format: \"rbcf\", token } : { format: \"rbcf\" },\n    );\n  },\n  release(client) {\n    release_with_disconnect(client);\n  },\n};\n\nexport const http_transport: AuthTransport<HttpClient> = {\n  kind: \"http\",\n  async connect(url, token) {\n    return Client.connect_http(\n      url,\n      token != null ? { format: \"rbcf\", token } : { format: \"rbcf\" },\n    );\n  },\n  release(_client) {\n    // HttpClient has no persistent socket; nothing to release.\n  },\n};\n\nexport const json_ws_transport: AuthTransport<JsonWsClient> = {\n  kind: \"ws\",\n  async connect(url, token) {\n    return Client.connect_json_ws(url, token != null ? { token } : undefined);\n  },\n  release(client) {\n    release_with_disconnect(client);\n  },\n};\n\nexport const json_http_transport: AuthTransport<JsonHttpClient> = {\n  kind: \"http\",\n  async connect(url, token) {\n    return Client.connect_json_http(url, token != null ? { token } : undefined);\n  },\n  release(_client) {\n    // JsonHttpClient has no persistent socket; nothing to release.\n  },\n};\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport React, {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactElement,\n  type ReactNode,\n} from \"react\";\n\nimport { clearClient, currentClient, ensureClient } from \"./client-cache\";\nimport { performSignIn } from \"./sign-in\";\nimport {\n  clearStoredSession,\n  readStoredSession,\n  storageKeyFor,\n  sweepExpiredSessions,\n  tabScopedNamespace,\n  writeStoredSession,\n} from \"./storage\";\nimport type {\n  AuthCapableClient,\n  AuthSession,\n  AuthState,\n  WalletConnector,\n} from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\nconst DEFAULT_TTL_SECONDS = 86400;\n\nexport interface AuthContextValue extends AuthState {\n  signIn(): Promise<void>;\n  signOut(): Promise<void>;\n}\n\nexport const AuthContext = createContext<AuthContextValue | null>(null);\n\nexport interface AuthProviderProps<\n  TClient extends AuthCapableClient = AuthCapableClient,\n> {\n  url: string;\n  transport: AuthTransport<TClient>;\n  storageNamespace: string;\n  method: string;\n  domain: string;\n  statement: string;\n  sessionTtlSeconds?: number;\n  wallet: WalletConnector;\n  children: ReactNode;\n}\n\ninterface InternalState {\n  status: AuthState[\"status\"];\n  session: AuthSession | null;\n  clientReady: boolean;\n  error: string | null;\n}\n\nexport function AuthProvider<TClient extends AuthCapableClient>(\n  props: AuthProviderProps<TClient>,\n): ReactElement {\n  const {\n    url,\n    transport,\n    storageNamespace,\n    method,\n    domain,\n    statement,\n    sessionTtlSeconds = DEFAULT_TTL_SECONDS,\n    wallet,\n    children,\n  } = props;\n\n  // Per-tab storage slot: each tab gets its own localStorage key so concurrent\n  // sign-ins in different tabs cannot stomp each other's session.\n  const effective_namespace = tabScopedNamespace(storageNamespace);\n\n  const [state, setState] = useState<InternalState>(() => {\n    const stored = readStoredSession(effective_namespace);\n    return stored\n      ? { status: \"verifying\", session: stored, clientReady: false, error: null }\n      : { status: \"disconnected\", session: null, clientReady: false, error: null };\n  });\n\n  // Pull live wallet fields into stable primitives for effect deps.\n  const wallet_connected = wallet.connected;\n  const wallet_connecting = wallet.connecting;\n  const wallet_public_key = wallet.publicKey;\n  const wallet_has_selected = wallet.hasSelectedWallet;\n\n  // Refs so callbacks can read latest values without re-binding.\n  const session_ref = useRef(state.session);\n  session_ref.current = state.session;\n  const wallet_ref = useRef(wallet);\n  wallet_ref.current = wallet;\n\n  const tear_down = useCallback(\n    (next_status: InternalState[\"status\"], next_error: string | null) => {\n      clearStoredSession(effective_namespace);\n      clearClient();\n      setState({\n        status: next_status,\n        session: null,\n        clientReady: false,\n        error: next_error,\n      });\n    },\n    [effective_namespace],\n  );\n\n  // Wallet-match gate: the security invariant. The authenticated client is only\n  // ever constructed when the connected wallet matches the persisted session.\n  useEffect(() => {\n    const session = state.session;\n    if (session == null) return;\n\n    if (wallet_connected && wallet_public_key != null) {\n      if (wallet_public_key !== session.wallet_address) {\n        tear_down(\"disconnected\", null);\n        return;\n      }\n      let cancelled = false;\n      ensureClient(transport, url, session.token)\n        .then(() => {\n          if (cancelled) return;\n          setState((prev) =>\n            prev.session === session\n              ? { ...prev, status: \"authenticated\", clientReady: true, error: null }\n              : prev,\n          );\n        })\n        .catch((err: unknown) => {\n          if (cancelled) return;\n          const message = err instanceof Error ? err.message : \"Failed to connect client\";\n          tear_down(\"error\", message);\n        });\n      return () => {\n        cancelled = true;\n      };\n    }\n\n    if (!wallet_connected && (wallet_connecting || wallet_has_selected)) {\n      // Wallet adapter is autoConnecting; stay in verifying. Do NOT construct\n      // the client yet - we must not authenticate before the match is confirmed.\n      setState((prev) =>\n        prev.session === session\n          ? { ...prev, status: \"verifying\", clientReady: false }\n          : prev,\n      );\n      return;\n    }\n\n    // Wallet is definitively absent (no selected wallet, not connecting). User\n    // explicitly disconnected, so the session can no longer be proven; tear down.\n    tear_down(\"disconnected\", null);\n  }, [\n    state.session,\n    wallet_connected,\n    wallet_connecting,\n    wallet_public_key,\n    wallet_has_selected,\n    transport,\n    url,\n    tear_down,\n  ]);\n\n  useEffect(() => {\n    if (typeof window === \"undefined\") return;\n    const key = storageKeyFor(effective_namespace);\n    const on_storage = (e: StorageEvent) => {\n      if (e.key !== key) return;\n      const current = session_ref.current;\n\n      // Another tab signed out / cleared the session.\n      if (e.newValue == null) {\n        if (current != null) tear_down(\"disconnected\", null);\n        return;\n      }\n\n      let parsed: Partial<AuthSession>;\n      try {\n        parsed = JSON.parse(e.newValue) as Partial<AuthSession>;\n      } catch {\n        // Corrupt entry written by another tab. Only react if we actually hold\n        // a session; otherwise there is nothing to defend.\n        if (current != null) tear_down(\"disconnected\", null);\n        return;\n      }\n\n      // We hold no session of our own: nothing to defend. Clearing storage here\n      // would clobber the session the other tab just wrote (and bounce it back\n      // out through this same handler). Let our own sign-in / autoConnect flow\n      // converge independently.\n      if (current == null) return;\n\n      // A genuinely different principal took over our storage slot.\n      if (\n        parsed.wallet_address !== current.wallet_address ||\n        parsed.identity !== current.identity\n      ) {\n        tear_down(\"disconnected\", null);\n      }\n\n      // Same principal, different token: a concurrent sign-in in another tab,\n      // not an intrusion. Keep our own still-valid client.\n    };\n    window.addEventListener(\"storage\", on_storage);\n    return () => {\n      window.removeEventListener(\"storage\", on_storage);\n    };\n  }, [effective_namespace, tear_down]);\n\n  // Housekeeping: drop expired per-tab slots left behind by closed tabs.\n  useEffect(() => {\n    sweepExpiredSessions(storageNamespace);\n  }, [storageNamespace]);\n\n  const signIn = useCallback(async () => {\n    const w = wallet_ref.current;\n    if (!w.connected || w.publicKey == null) {\n      setState((prev) => ({ ...prev, status: \"error\", error: \"Wallet not connected\" }));\n      return;\n    }\n    setState((prev) => ({ ...prev, status: \"signing\", error: null }));\n    try {\n      const session = await performSignIn({\n        url,\n        transport,\n        method,\n        wallet: w,\n        domain,\n        statement,\n        sessionTtlSeconds,\n      });\n      // Sanity: signed-in wallet must match the live publicKey. If the user\n      // swapped wallets while the signature was in flight, refuse the session.\n      if (session.wallet_address !== wallet_ref.current.publicKey) {\n        throw new Error(\"Wallet changed during sign in\");\n      }\n      writeStoredSession(effective_namespace, session);\n      setState({\n        status: \"verifying\",\n        session,\n        clientReady: false,\n        error: null,\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Sign in failed\";\n      setState({\n        status: \"error\",\n        session: null,\n        clientReady: false,\n        error: message,\n      });\n    }\n  }, [\n    url,\n    transport,\n    method,\n    domain,\n    statement,\n    sessionTtlSeconds,\n    effective_namespace,\n  ]);\n\n  const signOut = useCallback(async () => {\n    // Best-effort server-side logout via the currently-cached client.\n    try {\n      await currentClient().logout();\n    } catch {\n      // no current client, or server-side logout failed; tear down regardless\n    }\n    tear_down(\"disconnected\", null);\n  }, [tear_down]);\n\n  const value = useMemo<AuthContextValue>(\n    () => ({\n      status: state.status,\n      session: state.session,\n      clientReady: state.clientReady,\n      error: state.error,\n      signIn,\n      signOut,\n    }),\n    [state, signIn, signOut],\n  );\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthCapableClient } from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\n// Module-level dedupe: in React StrictMode (dev) the AuthProvider effect runs\n// twice with the same inputs, which previously opened two sockets. We cache the\n// in-flight promise so both runs share one connection.\n\nlet current_key: string | null = null;\nlet current_client: AuthCapableClient | null = null;\nlet current_transport: AuthTransport | null = null;\nlet pending_promise: Promise<AuthCapableClient> | null = null;\n\nfunction key_of(kind: string, url: string, token: string): string {\n  return `${kind}|${url}|${token}`;\n}\n\nexport async function ensureClient<T extends AuthCapableClient>(\n  transport: AuthTransport<T>,\n  url: string,\n  token: string,\n): Promise<T> {\n  const key = key_of(transport.kind, url, token);\n\n  if (current_key === key) {\n    if (current_client) return current_client as T;\n    if (pending_promise) return pending_promise as Promise<T>;\n  }\n\n  // New (kind, url, token) — release any prior client, start fresh.\n  if (current_client && current_transport) {\n    try {\n      (current_transport as AuthTransport<AuthCapableClient>).release(current_client);\n    } catch {\n      // release must be idempotent; ignore\n    }\n    current_client = null;\n  }\n  current_key = key;\n  current_transport = transport as AuthTransport;\n\n  const p = transport.connect(url, token).then((client) => {\n    // Another ensure/clear ran while we were connecting — drop this one.\n    if (current_key !== key) {\n      try {\n        transport.release(client);\n      } catch {\n        // ignore\n      }\n      throw new Error(\"@reifydb/auth: client connect superseded\");\n    }\n    current_client = client;\n    pending_promise = null;\n    return client;\n  });\n  pending_promise = p as Promise<AuthCapableClient>;\n  return p;\n}\n\nexport function clearClient(): void {\n  if (current_client && current_transport) {\n    try {\n      (current_transport as AuthTransport<AuthCapableClient>).release(current_client);\n    } catch {\n      // ignore\n    }\n  }\n  current_key = null;\n  current_client = null;\n  current_transport = null;\n  pending_promise = null;\n}\n\nexport function currentClient<T extends AuthCapableClient = AuthCapableClient>(): T {\n  if (!current_client) {\n    throw new Error(\"@reifydb/auth: no authenticated client; call ensureClient first\");\n  }\n  return current_client as T;\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthCapableClient, AuthSession, WalletConnector } from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\nexport interface SignInArgs<TClient extends AuthCapableClient = AuthCapableClient> {\n  url: string;\n  transport: AuthTransport<TClient>;\n  method: string;\n  wallet: Pick<WalletConnector, \"publicKey\" | \"signMessage\" | \"encodeSignature\">;\n  domain: string;\n  statement: string;\n  sessionTtlSeconds: number;\n}\n\nexport async function performSignIn<TClient extends AuthCapableClient>(\n  args: SignInArgs<TClient>,\n): Promise<AuthSession> {\n  const { url, transport, method, wallet, domain, statement, sessionTtlSeconds } = args;\n\n  const wallet_address = wallet.publicKey;\n  if (wallet_address == null || wallet_address.length === 0) {\n    throw new Error(\"@reifydb/auth: wallet.publicKey is required to sign in\");\n  }\n  if (!Number.isFinite(sessionTtlSeconds) || sessionTtlSeconds <= 0) {\n    throw new Error(\"@reifydb/auth: sessionTtlSeconds must be a positive number\");\n  }\n\n  const client = await transport.connect(url);\n  try {\n    const challenge = await client.login_challenge(method, {\n      identifier: wallet_address,\n      public_key: wallet_address,\n      domain,\n      statement,\n    });\n    if (challenge.kind !== \"challenge\") {\n      throw new Error(\n        `@reifydb/auth: expected challenge response, got ${challenge.kind}`,\n      );\n    }\n\n    const messageBytes = new TextEncoder().encode(challenge.message);\n    const signatureBytes = await wallet.signMessage(messageBytes);\n    const signature = wallet.encodeSignature(signatureBytes);\n\n    const auth = await client.login_challenge(method, {\n      challenge_id: challenge.challenge_id,\n      signature,\n      signed_message: challenge.message,\n    });\n    if (auth.kind !== \"authenticated\") {\n      throw new Error(\n        `@reifydb/auth: expected authenticated response, got ${auth.kind}`,\n      );\n    }\n\n    return {\n      token: auth.token,\n      identity: auth.identity,\n      wallet_address,\n      expires_at: Math.floor(Date.now() / 1000) + sessionTtlSeconds,\n    };\n  } finally {\n    transport.release(client);\n  }\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthSession } from \"./types\";\n\nconst SUFFIX = \".auth\";\n\nfunction key_for(namespace: string): string {\n  return `${namespace}${SUFFIX}`;\n}\n\n// A per-tab id so two tabs never share one localStorage slot and stomp each\n// other's session. Backed by sessionStorage: stable across reloads within a\n// tab, unique per tab, gone when the tab closes. Falls back to an ephemeral\n// in-memory id when sessionStorage or crypto.randomUUID is unavailable\n// (degraded: the session will not survive a reload).\nconst TAB_ID_KEY = \"reifydb.auth.tab\";\n\nfunction new_tab_id(): string {\n  try {\n    if (typeof crypto !== \"undefined\" && typeof crypto.randomUUID === \"function\") {\n      return crypto.randomUUID();\n    }\n  } catch {\n    // crypto unavailable; fall through to the cheap fallback\n  }\n  return `t-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;\n}\n\nfunction resolve_tab_id(): string {\n  if (typeof window === \"undefined\") return \"ssr\";\n  try {\n    const existing = sessionStorage.getItem(TAB_ID_KEY);\n    if (existing) return existing;\n    const id = new_tab_id();\n    sessionStorage.setItem(TAB_ID_KEY, id);\n    return id;\n  } catch {\n    // sessionStorage unavailable (private mode, disabled): ephemeral id.\n    return new_tab_id();\n  }\n}\n\nconst TAB_ID = resolve_tab_id();\n\n// Scopes a caller's namespace to this browser tab. AuthProvider feeds the\n// result into every storage operation so each tab gets its own slot and the\n// cross-tab `storage` listener filters other tabs out by key.\nexport function tabScopedNamespace(namespace: string): string {\n  return `${namespace}.${TAB_ID}`;\n}\n\nfunction is_auth_session(v: unknown): v is AuthSession {\n  if (v === null || typeof v !== \"object\") return false;\n  const o = v as Record<string, unknown>;\n  return (\n    typeof o.token === \"string\" && o.token.length > 0 &&\n    typeof o.identity === \"string\" && o.identity.length > 0 &&\n    typeof o.wallet_address === \"string\" && o.wallet_address.length > 0 &&\n    typeof o.expires_at === \"number\" && Number.isFinite(o.expires_at) && o.expires_at > 0\n  );\n}\n\nfunction safe_remove(namespace: string): void {\n  try {\n    localStorage.removeItem(key_for(namespace));\n  } catch {\n    // localStorage may be unavailable; ignore\n  }\n}\n\nexport function readStoredSession(namespace: string): AuthSession | null {\n  if (typeof window === \"undefined\") return null;\n  let raw: string | null;\n  try {\n    raw = localStorage.getItem(key_for(namespace));\n  } catch {\n    return null;\n  }\n  if (raw == null) return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    safe_remove(namespace);\n    return null;\n  }\n  if (!is_auth_session(parsed)) {\n    safe_remove(namespace);\n    return null;\n  }\n  if (parsed.expires_at <= Date.now() / 1000) {\n    safe_remove(namespace);\n    return null;\n  }\n  return parsed;\n}\n\nexport function writeStoredSession(namespace: string, session: AuthSession): void {\n  if (typeof window === \"undefined\") return;\n  if (!is_auth_session(session)) {\n    throw new Error(\"@reifydb/auth: refusing to persist malformed session\");\n  }\n  try {\n    localStorage.setItem(key_for(namespace), JSON.stringify(session));\n  } catch {\n    // localStorage may be unavailable (private mode, full quota); ignore.\n  }\n}\n\nexport function clearStoredSession(namespace: string): void {\n  if (typeof window === \"undefined\") return;\n  safe_remove(namespace);\n}\n\nexport function storageKeyFor(namespace: string): string {\n  return key_for(namespace);\n}\n\n// Closed tabs leave their per-tab slot in localStorage forever - nothing ever\n// reads that namespace again. Sweep once on mount: drop slots under\n// `baseNamespace` that belong to other tabs and have already expired. Live\n// tabs' slots have a future `expires_at` and are never touched.\nexport function sweepExpiredSessions(baseNamespace: string): void {\n  if (typeof window === \"undefined\") return;\n  try {\n    const now = Date.now() / 1000;\n    const own_key = key_for(tabScopedNamespace(baseNamespace));\n    const prefix = `${baseNamespace}.`;\n    const dead: string[] = [];\n    for (let i = 0; i < localStorage.length; i += 1) {\n      const k = localStorage.key(i);\n      if (k == null || k === own_key) continue;\n      if (!k.startsWith(prefix) || !k.endsWith(SUFFIX)) continue;\n      const raw = localStorage.getItem(k);\n      if (raw == null) continue;\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(raw);\n      } catch {\n        continue;\n      }\n      if (is_auth_session(parsed) && parsed.expires_at <= now) {\n        dead.push(k);\n      }\n    }\n    for (const k of dead) localStorage.removeItem(k);\n  } catch {\n    // localStorage unavailable; nothing to sweep.\n  }\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport { useContext } from \"react\";\n\nimport { AuthContext, type AuthContextValue } from \"./auth-provider\";\nimport { currentClient } from \"./client-cache\";\nimport type { AuthCapableClient } from \"./types\";\n\nexport function useAuth(): AuthContextValue {\n  const ctx = useContext(AuthContext);\n  if (ctx == null) {\n    throw new Error(\"@reifydb/auth: useAuth must be used inside <AuthProvider>\");\n  }\n  return ctx;\n}\n\nexport function useAuthClient<\n  TClient extends AuthCapableClient = AuthCapableClient,\n>(): TClient {\n  const { clientReady } = useAuth();\n  if (!clientReady) {\n    throw new Error(\"@reifydb/auth: useAuthClient called before clientReady\");\n  }\n  return currentClient<TClient>();\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nexport type {\n  AuthCapableClient,\n  AuthSession,\n  AuthState,\n  AuthStatus,\n  LoginChallengeResult,\n  WalletConnector,\n} from \"./types\";\n\nexport type { AuthTransport } from \"./transport\";\nexport {\n  http_transport,\n  json_http_transport,\n  json_ws_transport,\n  ws_transport,\n} from \"./transport\";\n\nexport {\n  AuthContext,\n  AuthProvider,\n  type AuthContextValue,\n  type AuthProviderProps,\n} from \"./auth-provider\";\n\nexport { useAuth, useAuthClient } from \"./use-auth\";\n\nexport { performSignIn, type SignInArgs } from \"./sign-in\";\n\nexport {\n  clearStoredSession,\n  readStoredSession,\n  storageKeyFor,\n  writeStoredSession,\n} from \"./storage\";\n\nexport { clearClient, currentClient, ensureClient } from \"./client-cache\";\n\nexport * from \"@reifydb/core\";\nexport * from \"@reifydb/client\";\n"],"mappings":";AAGA;AAAA,EACE;AAAA,OAKK;AAWP,SAAS,wBAAwB,QAA2C;AAC1E,MAAI,OAAO,OAAO,eAAe,YAAY;AAC3C,QAAI;AACF,aAAO,WAAW;AAAA,IACpB,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAEO,IAAM,eAAwC;AAAA,EACnD,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO;AAAA,MACZ;AAAA,MACA,SAAS,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI,EAAE,QAAQ,OAAO;AAAA,IAC/D;AAAA,EACF;AAAA,EACA,QAAQ,QAAQ;AACd,4BAAwB,MAAM;AAAA,EAChC;AACF;AAEO,IAAM,iBAA4C;AAAA,EACvD,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO;AAAA,MACZ;AAAA,MACA,SAAS,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI,EAAE,QAAQ,OAAO;AAAA,IAC/D;AAAA,EACF;AAAA,EACA,QAAQ,SAAS;AAAA,EAEjB;AACF;AAEO,IAAM,oBAAiD;AAAA,EAC5D,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO,gBAAgB,KAAK,SAAS,OAAO,EAAE,MAAM,IAAI,MAAS;AAAA,EAC1E;AAAA,EACA,QAAQ,QAAQ;AACd,4BAAwB,MAAM;AAAA,EAChC;AACF;AAEO,IAAM,sBAAqD;AAAA,EAChE,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO,kBAAkB,KAAK,SAAS,OAAO,EAAE,MAAM,IAAI,MAAS;AAAA,EAC5E;AAAA,EACA,QAAQ,SAAS;AAAA,EAEjB;AACF;;;ACvEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;;;ACFP,IAAI,cAA6B;AACjC,IAAI,iBAA2C;AAC/C,IAAI,oBAA0C;AAC9C,IAAI,kBAAqD;AAEzD,SAAS,OAAO,MAAc,KAAa,OAAuB;AAChE,SAAO,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK;AAChC;AAEA,eAAsB,aACpB,WACA,KACA,OACY;AACZ,QAAM,MAAM,OAAO,UAAU,MAAM,KAAK,KAAK;AAE7C,MAAI,gBAAgB,KAAK;AACvB,QAAI,eAAgB,QAAO;AAC3B,QAAI,gBAAiB,QAAO;AAAA,EAC9B;AAGA,MAAI,kBAAkB,mBAAmB;AACvC,QAAI;AACF,MAAC,kBAAuD,QAAQ,cAAc;AAAA,IAChF,QAAQ;AAAA,IAER;AACA,qBAAiB;AAAA,EACnB;AACA,gBAAc;AACd,sBAAoB;AAEpB,QAAM,IAAI,UAAU,QAAQ,KAAK,KAAK,EAAE,KAAK,CAAC,WAAW;AAEvD,QAAI,gBAAgB,KAAK;AACvB,UAAI;AACF,kBAAU,QAAQ,MAAM;AAAA,MAC1B,QAAQ;AAAA,MAER;AACA,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AACA,qBAAiB;AACjB,sBAAkB;AAClB,WAAO;AAAA,EACT,CAAC;AACD,oBAAkB;AAClB,SAAO;AACT;AAEO,SAAS,cAAoB;AAClC,MAAI,kBAAkB,mBAAmB;AACvC,QAAI;AACF,MAAC,kBAAuD,QAAQ,cAAc;AAAA,IAChF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,gBAAc;AACd,mBAAiB;AACjB,sBAAoB;AACpB,oBAAkB;AACpB;AAEO,SAAS,gBAAoE;AAClF,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,SAAO;AACT;;;AChEA,eAAsB,cACpB,MACsB;AACtB,QAAM,EAAE,KAAK,WAAW,QAAQ,QAAQ,QAAQ,WAAW,kBAAkB,IAAI;AAEjF,QAAM,iBAAiB,OAAO;AAC9B,MAAI,kBAAkB,QAAQ,eAAe,WAAW,GAAG;AACzD,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,MAAI,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,GAAG;AACjE,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAEA,QAAM,SAAS,MAAM,UAAU,QAAQ,GAAG;AAC1C,MAAI;AACF,UAAM,YAAY,MAAM,OAAO,gBAAgB,QAAQ;AAAA,MACrD,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,UAAU,SAAS,aAAa;AAClC,YAAM,IAAI;AAAA,QACR,mDAAmD,UAAU,IAAI;AAAA,MACnE;AAAA,IACF;AAEA,UAAM,eAAe,IAAI,YAAY,EAAE,OAAO,UAAU,OAAO;AAC/D,UAAM,iBAAiB,MAAM,OAAO,YAAY,YAAY;AAC5D,UAAM,YAAY,OAAO,gBAAgB,cAAc;AAEvD,UAAM,OAAO,MAAM,OAAO,gBAAgB,QAAQ;AAAA,MAChD,cAAc,UAAU;AAAA,MACxB;AAAA,MACA,gBAAgB,UAAU;AAAA,IAC5B,CAAC;AACD,QAAI,KAAK,SAAS,iBAAiB;AACjC,YAAM,IAAI;AAAA,QACR,uDAAuD,KAAK,IAAI;AAAA,MAClE;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf;AAAA,MACA,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,IAC9C;AAAA,EACF,UAAE;AACA,cAAU,QAAQ,MAAM;AAAA,EAC1B;AACF;;;AC9DA,IAAM,SAAS;AAEf,SAAS,QAAQ,WAA2B;AAC1C,SAAO,GAAG,SAAS,GAAG,MAAM;AAC9B;AAOA,IAAM,aAAa;AAEnB,SAAS,aAAqB;AAC5B,MAAI;AACF,QAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe,YAAY;AAC5E,aAAO,OAAO,WAAW;AAAA,IAC3B;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,KAAK,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5E;AAEA,SAAS,iBAAyB;AAChC,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACF,UAAM,WAAW,eAAe,QAAQ,UAAU;AAClD,QAAI,SAAU,QAAO;AACrB,UAAM,KAAK,WAAW;AACtB,mBAAe,QAAQ,YAAY,EAAE;AACrC,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO,WAAW;AAAA,EACpB;AACF;AAEA,IAAM,SAAS,eAAe;AAKvB,SAAS,mBAAmB,WAA2B;AAC5D,SAAO,GAAG,SAAS,IAAI,MAAM;AAC/B;AAEA,SAAS,gBAAgB,GAA8B;AACrD,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,QAAM,IAAI;AACV,SACE,OAAO,EAAE,UAAU,YAAY,EAAE,MAAM,SAAS,KAChD,OAAO,EAAE,aAAa,YAAY,EAAE,SAAS,SAAS,KACtD,OAAO,EAAE,mBAAmB,YAAY,EAAE,eAAe,SAAS,KAClE,OAAO,EAAE,eAAe,YAAY,OAAO,SAAS,EAAE,UAAU,KAAK,EAAE,aAAa;AAExF;AAEA,SAAS,YAAY,WAAyB;AAC5C,MAAI;AACF,iBAAa,WAAW,QAAQ,SAAS,CAAC;AAAA,EAC5C,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,kBAAkB,WAAuC;AACvE,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACJ,MAAI;AACF,UAAM,aAAa,QAAQ,QAAQ,SAAS,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,KAAM,QAAO;AACxB,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,gBAAY,SAAS;AACrB,WAAO;AAAA,EACT;AACA,MAAI,CAAC,gBAAgB,MAAM,GAAG;AAC5B,gBAAY,SAAS;AACrB,WAAO;AAAA,EACT;AACA,MAAI,OAAO,cAAc,KAAK,IAAI,IAAI,KAAM;AAC1C,gBAAY,SAAS;AACrB,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,mBAAmB,WAAmB,SAA4B;AAChF,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI,CAAC,gBAAgB,OAAO,GAAG;AAC7B,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,MAAI;AACF,iBAAa,QAAQ,QAAQ,SAAS,GAAG,KAAK,UAAU,OAAO,CAAC;AAAA,EAClE,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,mBAAmB,WAAyB;AAC1D,MAAI,OAAO,WAAW,YAAa;AACnC,cAAY,SAAS;AACvB;AAEO,SAAS,cAAc,WAA2B;AACvD,SAAO,QAAQ,SAAS;AAC1B;AAMO,SAAS,qBAAqB,eAA6B;AAChE,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI;AACF,UAAM,MAAM,KAAK,IAAI,IAAI;AACzB,UAAM,UAAU,QAAQ,mBAAmB,aAAa,CAAC;AACzD,UAAM,SAAS,GAAG,aAAa;AAC/B,UAAM,OAAiB,CAAC;AACxB,aAAS,IAAI,GAAG,IAAI,aAAa,QAAQ,KAAK,GAAG;AAC/C,YAAM,IAAI,aAAa,IAAI,CAAC;AAC5B,UAAI,KAAK,QAAQ,MAAM,QAAS;AAChC,UAAI,CAAC,EAAE,WAAW,MAAM,KAAK,CAAC,EAAE,SAAS,MAAM,EAAG;AAClD,YAAM,MAAM,aAAa,QAAQ,CAAC;AAClC,UAAI,OAAO,KAAM;AACjB,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,GAAG;AAAA,MACzB,QAAQ;AACN;AAAA,MACF;AACA,UAAI,gBAAgB,MAAM,KAAK,OAAO,cAAc,KAAK;AACvD,aAAK,KAAK,CAAC;AAAA,MACb;AAAA,IACF;AACA,eAAW,KAAK,KAAM,cAAa,WAAW,CAAC;AAAA,EACjD,QAAQ;AAAA,EAER;AACF;;;AH6IS;AAnQT,IAAM,sBAAsB;AAOrB,IAAM,cAAc,cAAuC,IAAI;AAuB/D,SAAS,aACd,OACc;AACd,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,oBAAoB;AAAA,IACpB;AAAA,IACA;AAAA,EACF,IAAI;AAIJ,QAAM,sBAAsB,mBAAmB,gBAAgB;AAE/D,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,MAAM;AACtD,UAAM,SAAS,kBAAkB,mBAAmB;AACpD,WAAO,SACH,EAAE,QAAQ,aAAa,SAAS,QAAQ,aAAa,OAAO,OAAO,KAAK,IACxE,EAAE,QAAQ,gBAAgB,SAAS,MAAM,aAAa,OAAO,OAAO,KAAK;AAAA,EAC/E,CAAC;AAGD,QAAM,mBAAmB,OAAO;AAChC,QAAM,oBAAoB,OAAO;AACjC,QAAM,oBAAoB,OAAO;AACjC,QAAM,sBAAsB,OAAO;AAGnC,QAAM,cAAc,OAAO,MAAM,OAAO;AACxC,cAAY,UAAU,MAAM;AAC5B,QAAM,aAAa,OAAO,MAAM;AAChC,aAAW,UAAU;AAErB,QAAM,YAAY;AAAA,IAChB,CAAC,aAAsC,eAA8B;AACnE,yBAAmB,mBAAmB;AACtC,kBAAY;AACZ,eAAS;AAAA,QACP,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IACA,CAAC,mBAAmB;AAAA,EACtB;AAIA,YAAU,MAAM;AACd,UAAM,UAAU,MAAM;AACtB,QAAI,WAAW,KAAM;AAErB,QAAI,oBAAoB,qBAAqB,MAAM;AACjD,UAAI,sBAAsB,QAAQ,gBAAgB;AAChD,kBAAU,gBAAgB,IAAI;AAC9B;AAAA,MACF;AACA,UAAI,YAAY;AAChB,mBAAa,WAAW,KAAK,QAAQ,KAAK,EACvC,KAAK,MAAM;AACV,YAAI,UAAW;AACf;AAAA,UAAS,CAAC,SACR,KAAK,YAAY,UACb,EAAE,GAAG,MAAM,QAAQ,iBAAiB,aAAa,MAAM,OAAO,KAAK,IACnE;AAAA,QACN;AAAA,MACF,CAAC,EACA,MAAM,CAAC,QAAiB;AACvB,YAAI,UAAW;AACf,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,kBAAU,SAAS,OAAO;AAAA,MAC5B,CAAC;AACH,aAAO,MAAM;AACX,oBAAY;AAAA,MACd;AAAA,IACF;AAEA,QAAI,CAAC,qBAAqB,qBAAqB,sBAAsB;AAGnE;AAAA,QAAS,CAAC,SACR,KAAK,YAAY,UACb,EAAE,GAAG,MAAM,QAAQ,aAAa,aAAa,MAAM,IACnD;AAAA,MACN;AACA;AAAA,IACF;AAIA,cAAU,gBAAgB,IAAI;AAAA,EAChC,GAAG;AAAA,IACD,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,YAAU,MAAM;AACd,QAAI,OAAO,WAAW,YAAa;AACnC,UAAM,MAAM,cAAc,mBAAmB;AAC7C,UAAM,aAAa,CAAC,MAAoB;AACtC,UAAI,EAAE,QAAQ,IAAK;AACnB,YAAM,UAAU,YAAY;AAG5B,UAAI,EAAE,YAAY,MAAM;AACtB,YAAI,WAAW,KAAM,WAAU,gBAAgB,IAAI;AACnD;AAAA,MACF;AAEA,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,EAAE,QAAQ;AAAA,MAChC,QAAQ;AAGN,YAAI,WAAW,KAAM,WAAU,gBAAgB,IAAI;AACnD;AAAA,MACF;AAMA,UAAI,WAAW,KAAM;AAGrB,UACE,OAAO,mBAAmB,QAAQ,kBAClC,OAAO,aAAa,QAAQ,UAC5B;AACA,kBAAU,gBAAgB,IAAI;AAAA,MAChC;AAAA,IAIF;AACA,WAAO,iBAAiB,WAAW,UAAU;AAC7C,WAAO,MAAM;AACX,aAAO,oBAAoB,WAAW,UAAU;AAAA,IAClD;AAAA,EACF,GAAG,CAAC,qBAAqB,SAAS,CAAC;AAGnC,YAAU,MAAM;AACd,yBAAqB,gBAAgB;AAAA,EACvC,GAAG,CAAC,gBAAgB,CAAC;AAErB,QAAM,SAAS,YAAY,YAAY;AACrC,UAAM,IAAI,WAAW;AACrB,QAAI,CAAC,EAAE,aAAa,EAAE,aAAa,MAAM;AACvC,eAAS,CAAC,UAAU,EAAE,GAAG,MAAM,QAAQ,SAAS,OAAO,uBAAuB,EAAE;AAChF;AAAA,IACF;AACA,aAAS,CAAC,UAAU,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,KAAK,EAAE;AAChE,QAAI;AACF,YAAM,UAAU,MAAM,cAAc;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAGD,UAAI,QAAQ,mBAAmB,WAAW,QAAQ,WAAW;AAC3D,cAAM,IAAI,MAAM,+BAA+B;AAAA,MACjD;AACA,yBAAmB,qBAAqB,OAAO;AAC/C,eAAS;AAAA,QACP,QAAQ;AAAA,QACR;AAAA,QACA,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,eAAS;AAAA,QACP,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,UAAU,YAAY,YAAY;AAEtC,QAAI;AACF,YAAM,cAAc,EAAE,OAAO;AAAA,IAC/B,QAAQ;AAAA,IAER;AACA,cAAU,gBAAgB,IAAI;AAAA,EAChC,GAAG,CAAC,SAAS,CAAC;AAEd,QAAM,QAAQ;AAAA,IACZ,OAAO;AAAA,MACL,QAAQ,MAAM;AAAA,MACd,SAAS,MAAM;AAAA,MACf,aAAa,MAAM;AAAA,MACnB,OAAO,MAAM;AAAA,MACb;AAAA,MACA;AAAA,IACF;AAAA,IACA,CAAC,OAAO,QAAQ,OAAO;AAAA,EACzB;AAEA,SAAO,oBAAC,YAAY,UAAZ,EAAqB,OAAe,UAAS;AACvD;;;AIjSA,SAAS,kBAAkB;AAMpB,SAAS,UAA4B;AAC1C,QAAM,MAAM,WAAW,WAAW;AAClC,MAAI,OAAO,MAAM;AACf,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO;AACT;AAEO,SAAS,gBAEH;AACX,QAAM,EAAE,YAAY,IAAI,QAAQ;AAChC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,SAAO,cAAuB;AAChC;;;ACeA,cAAc;AACd,cAAc;","names":[]}
+{"version":3,"sources":["../src/transport.ts","../src/auth-provider.tsx","../src/client-cache.ts","../src/sign-in.ts","../src/sign-in-password.ts","../src/storage.ts","../src/use-auth.ts","../src/index.ts"],"sourcesContent":["// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport {\n  Client,\n  type WsClient,\n  type HttpClient,\n  type JsonWsClient,\n  type JsonHttpClient,\n} from \"@reifydb/client\";\nimport type { AuthCapableClient } from \"./types\";\n\nexport interface AuthTransport<\n  TClient extends AuthCapableClient = AuthCapableClient,\n> {\n  readonly kind: \"ws\" | \"http\";\n  connect(url: string, token?: string): Promise<TClient>;\n  release(client: TClient): void;\n}\n\nfunction release_with_disconnect(client: { disconnect?: () => void }): void {\n  if (typeof client.disconnect === \"function\") {\n    try {\n      client.disconnect();\n    } catch {\n      // disconnect should be idempotent and never throw, but guard anyway\n    }\n  }\n}\n\nexport const ws_transport: AuthTransport<WsClient> = {\n  kind: \"ws\",\n  async connect(url, token) {\n    return Client.connect_ws(\n      url,\n      token != null ? { format: \"rbcf\", token } : { format: \"rbcf\" },\n    );\n  },\n  release(client) {\n    release_with_disconnect(client);\n  },\n};\n\nexport const http_transport: AuthTransport<HttpClient> = {\n  kind: \"http\",\n  async connect(url, token) {\n    return Client.connect_http(\n      url,\n      token != null ? { format: \"rbcf\", token } : { format: \"rbcf\" },\n    );\n  },\n  release(_client) {\n    // HttpClient has no persistent socket; nothing to release.\n  },\n};\n\nexport const json_ws_transport: AuthTransport<JsonWsClient> = {\n  kind: \"ws\",\n  async connect(url, token) {\n    return Client.connect_json_ws(url, token != null ? { token } : undefined);\n  },\n  release(client) {\n    release_with_disconnect(client);\n  },\n};\n\nexport const json_http_transport: AuthTransport<JsonHttpClient> = {\n  kind: \"http\",\n  async connect(url, token) {\n    return Client.connect_json_http(url, token != null ? { token } : undefined);\n  },\n  release(_client) {\n    // JsonHttpClient has no persistent socket; nothing to release.\n  },\n};\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport React, {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactElement,\n  type ReactNode,\n} from \"react\";\n\nimport { clearClient, currentClient, ensureClient } from \"./client-cache\";\nimport { performSignIn } from \"./sign-in\";\nimport { performPasswordSignIn } from \"./sign-in-password\";\nimport {\n  clearStoredSession,\n  readStoredSession,\n  storageKeyFor,\n  sweepExpiredSessions,\n  tabScopedNamespace,\n  writeStoredSession,\n} from \"./storage\";\nimport type {\n  AuthCapableClient,\n  AuthSession,\n  AuthState,\n  PasswordCredentials,\n  WalletConnector,\n} from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\nconst DEFAULT_TTL_SECONDS = 86400;\n\nexport interface AuthContextValue extends AuthState {\n  signIn(credentials?: PasswordCredentials): Promise<void>;\n  signOut(): Promise<void>;\n}\n\nexport const AuthContext = createContext<AuthContextValue | null>(null);\n\nexport interface AuthProviderProps<\n  TClient extends AuthCapableClient = AuthCapableClient,\n> {\n  url: string;\n  transport: AuthTransport<TClient>;\n  storageNamespace: string;\n  method?: string;\n  domain?: string;\n  statement?: string;\n  sessionTtlSeconds?: number;\n  wallet?: WalletConnector;\n  sessionScope?: \"tab\" | \"browser\";\n  children: ReactNode;\n}\n\ninterface InternalState {\n  status: AuthState[\"status\"];\n  session: AuthSession | null;\n  clientReady: boolean;\n  error: string | null;\n}\n\nexport function AuthProvider<TClient extends AuthCapableClient>(\n  props: AuthProviderProps<TClient>,\n): ReactElement {\n  const {\n    url,\n    transport,\n    storageNamespace,\n    method,\n    domain,\n    statement,\n    sessionTtlSeconds = DEFAULT_TTL_SECONDS,\n    wallet,\n    sessionScope = \"tab\",\n    children,\n  } = props;\n\n  // Per-tab storage slot: each tab gets its own localStorage key so concurrent\n  // sign-ins in different tabs cannot stomp each other's session. With\n  // sessionScope \"browser\" all tabs deliberately share one slot instead.\n  const effective_namespace =\n    sessionScope === \"browser\"\n      ? storageNamespace\n      : tabScopedNamespace(storageNamespace);\n\n  const [state, setState] = useState<InternalState>(() => {\n    const stored = readStoredSession(effective_namespace);\n    return stored\n      ? { status: \"verifying\", session: stored, clientReady: false, error: null }\n      : { status: \"disconnected\", session: null, clientReady: false, error: null };\n  });\n\n  // Pull live wallet fields into stable primitives for effect deps.\n  const wallet_connected = wallet?.connected ?? false;\n  const wallet_connecting = wallet?.connecting ?? false;\n  const wallet_public_key = wallet?.publicKey ?? null;\n  const wallet_has_selected = wallet?.hasSelectedWallet ?? false;\n\n  // Refs so callbacks can read latest values without re-binding.\n  const session_ref = useRef(state.session);\n  session_ref.current = state.session;\n  const wallet_ref = useRef(wallet);\n  wallet_ref.current = wallet;\n\n  const tear_down = useCallback(\n    (next_status: InternalState[\"status\"], next_error: string | null) => {\n      clearStoredSession(effective_namespace);\n      clearClient();\n      setState({\n        status: next_status,\n        session: null,\n        clientReady: false,\n        error: next_error,\n      });\n    },\n    [effective_namespace],\n  );\n\n  // Session gate. Password sessions connect directly; wallet sessions keep the\n  // security invariant: the authenticated client is only ever constructed when\n  // the connected wallet matches the persisted session.\n  useEffect(() => {\n    const session = state.session;\n    if (session == null) return;\n\n    const establish = () => {\n      let cancelled = false;\n      ensureClient(transport, url, session.token)\n        .then(() => {\n          if (cancelled) return;\n          setState((prev) =>\n            prev.session === session\n              ? { ...prev, status: \"authenticated\", clientReady: true, error: null }\n              : prev,\n          );\n        })\n        .catch((err: unknown) => {\n          if (cancelled) return;\n          const message = err instanceof Error ? err.message : \"Failed to connect client\";\n          tear_down(\"error\", message);\n        });\n      return () => {\n        cancelled = true;\n      };\n    };\n\n    if (session.method === \"password\") {\n      return establish();\n    }\n\n    if (wallet_connected && wallet_public_key != null) {\n      if (wallet_public_key !== session.wallet_address) {\n        tear_down(\"disconnected\", null);\n        return;\n      }\n      return establish();\n    }\n\n    if (!wallet_connected && (wallet_connecting || wallet_has_selected)) {\n      // Wallet adapter is autoConnecting; stay in verifying. Do NOT construct\n      // the client yet - we must not authenticate before the match is confirmed.\n      setState((prev) =>\n        prev.session === session\n          ? { ...prev, status: \"verifying\", clientReady: false }\n          : prev,\n      );\n      return;\n    }\n\n    // Wallet is definitively absent (no selected wallet, not connecting). User\n    // explicitly disconnected, so the session can no longer be proven; tear down.\n    tear_down(\"disconnected\", null);\n  }, [\n    state.session,\n    wallet_connected,\n    wallet_connecting,\n    wallet_public_key,\n    wallet_has_selected,\n    transport,\n    url,\n    tear_down,\n  ]);\n\n  useEffect(() => {\n    if (typeof window === \"undefined\") return;\n    const key = storageKeyFor(effective_namespace);\n    const on_storage = (e: StorageEvent) => {\n      if (e.key !== key) return;\n      const current = session_ref.current;\n\n      // Another tab signed out / cleared the session.\n      if (e.newValue == null) {\n        if (current != null) tear_down(\"disconnected\", null);\n        return;\n      }\n\n      let parsed: Partial<AuthSession>;\n      try {\n        parsed = JSON.parse(e.newValue) as Partial<AuthSession>;\n      } catch {\n        // Corrupt entry written by another tab. Only react if we actually hold\n        // a session; otherwise there is nothing to defend.\n        if (current != null) tear_down(\"disconnected\", null);\n        return;\n      }\n\n      // We hold no session of our own: nothing to defend. Clearing storage here\n      // would clobber the session the other tab just wrote (and bounce it back\n      // out through this same handler). Let our own sign-in / autoConnect flow\n      // converge independently.\n      if (current == null) return;\n\n      // A genuinely different principal took over our storage slot.\n      if (\n        parsed.wallet_address !== current.wallet_address ||\n        parsed.identity !== current.identity\n      ) {\n        tear_down(\"disconnected\", null);\n      }\n\n      // Same principal, different token: a concurrent sign-in in another tab,\n      // not an intrusion. Keep our own still-valid client.\n    };\n    window.addEventListener(\"storage\", on_storage);\n    return () => {\n      window.removeEventListener(\"storage\", on_storage);\n    };\n  }, [effective_namespace, tear_down]);\n\n  // Housekeeping: drop expired per-tab slots left behind by closed tabs.\n  useEffect(() => {\n    sweepExpiredSessions(storageNamespace);\n  }, [storageNamespace]);\n\n  const signIn = useCallback(async (credentials?: PasswordCredentials) => {\n    if (credentials != null) {\n      setState((prev) => ({ ...prev, status: \"signing\", error: null }));\n      try {\n        const session = await performPasswordSignIn({\n          url,\n          transport,\n          identifier: credentials.identifier,\n          password: credentials.password,\n          sessionTtlSeconds,\n        });\n        writeStoredSession(effective_namespace, session);\n        setState({\n          status: \"verifying\",\n          session,\n          clientReady: false,\n          error: null,\n        });\n      } catch (err) {\n        const message = err instanceof Error ? err.message : \"Sign in failed\";\n        setState({\n          status: \"error\",\n          session: null,\n          clientReady: false,\n          error: message,\n        });\n      }\n      return;\n    }\n\n    const w = wallet_ref.current;\n    if (w == null || !w.connected || w.publicKey == null) {\n      setState((prev) => ({ ...prev, status: \"error\", error: \"Wallet not connected\" }));\n      return;\n    }\n    if (method == null || domain == null || statement == null) {\n      setState((prev) => ({\n        ...prev,\n        status: \"error\",\n        error: \"Wallet sign in requires method, domain, and statement\",\n      }));\n      return;\n    }\n    setState((prev) => ({ ...prev, status: \"signing\", error: null }));\n    try {\n      const session = await performSignIn({\n        url,\n        transport,\n        method,\n        wallet: w,\n        domain,\n        statement,\n        sessionTtlSeconds,\n      });\n      // Sanity: signed-in wallet must match the live publicKey. If the user\n      // swapped wallets while the signature was in flight, refuse the session.\n      if (session.wallet_address !== wallet_ref.current?.publicKey) {\n        throw new Error(\"Wallet changed during sign in\");\n      }\n      writeStoredSession(effective_namespace, session);\n      setState({\n        status: \"verifying\",\n        session,\n        clientReady: false,\n        error: null,\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Sign in failed\";\n      setState({\n        status: \"error\",\n        session: null,\n        clientReady: false,\n        error: message,\n      });\n    }\n  }, [\n    url,\n    transport,\n    method,\n    domain,\n    statement,\n    sessionTtlSeconds,\n    effective_namespace,\n  ]);\n\n  const signOut = useCallback(async () => {\n    // Best-effort server-side logout via the currently-cached client.\n    try {\n      await currentClient().logout();\n    } catch {\n      // no current client, or server-side logout failed; tear down regardless\n    }\n    tear_down(\"disconnected\", null);\n  }, [tear_down]);\n\n  const value = useMemo<AuthContextValue>(\n    () => ({\n      status: state.status,\n      session: state.session,\n      clientReady: state.clientReady,\n      error: state.error,\n      signIn,\n      signOut,\n    }),\n    [state, signIn, signOut],\n  );\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthCapableClient } from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\n// Module-level dedupe: in React StrictMode (dev) the AuthProvider effect runs\n// twice with the same inputs, which previously opened two sockets. We cache the\n// in-flight promise so both runs share one connection.\n\nlet current_key: string | null = null;\nlet current_client: AuthCapableClient | null = null;\nlet current_transport: AuthTransport | null = null;\nlet pending_promise: Promise<AuthCapableClient> | null = null;\n\nfunction key_of(kind: string, url: string, token: string): string {\n  return `${kind}|${url}|${token}`;\n}\n\nexport async function ensureClient<T extends AuthCapableClient>(\n  transport: AuthTransport<T>,\n  url: string,\n  token: string,\n): Promise<T> {\n  const key = key_of(transport.kind, url, token);\n\n  if (current_key === key) {\n    if (current_client) return current_client as T;\n    if (pending_promise) return pending_promise as Promise<T>;\n  }\n\n  // New (kind, url, token) — release any prior client, start fresh.\n  if (current_client && current_transport) {\n    try {\n      (current_transport as AuthTransport<AuthCapableClient>).release(current_client);\n    } catch {\n      // release must be idempotent; ignore\n    }\n    current_client = null;\n  }\n  current_key = key;\n  current_transport = transport as AuthTransport;\n\n  const p = transport.connect(url, token).then((client) => {\n    // Another ensure/clear ran while we were connecting — drop this one.\n    if (current_key !== key) {\n      try {\n        transport.release(client);\n      } catch {\n        // ignore\n      }\n      throw new Error(\"@reifydb/auth: client connect superseded\");\n    }\n    current_client = client;\n    pending_promise = null;\n    return client;\n  });\n  pending_promise = p as Promise<AuthCapableClient>;\n  return p;\n}\n\nexport function clearClient(): void {\n  if (current_client && current_transport) {\n    try {\n      (current_transport as AuthTransport<AuthCapableClient>).release(current_client);\n    } catch {\n      // ignore\n    }\n  }\n  current_key = null;\n  current_client = null;\n  current_transport = null;\n  pending_promise = null;\n}\n\nexport function currentClient<T extends AuthCapableClient = AuthCapableClient>(): T {\n  if (!current_client) {\n    throw new Error(\"@reifydb/auth: no authenticated client; call ensureClient first\");\n  }\n  return current_client as T;\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthCapableClient, AuthSession, WalletConnector } from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\nexport interface SignInArgs<TClient extends AuthCapableClient = AuthCapableClient> {\n  url: string;\n  transport: AuthTransport<TClient>;\n  method: string;\n  wallet: Pick<WalletConnector, \"publicKey\" | \"signMessage\" | \"encodeSignature\">;\n  domain: string;\n  statement: string;\n  sessionTtlSeconds: number;\n}\n\nexport async function performSignIn<TClient extends AuthCapableClient>(\n  args: SignInArgs<TClient>,\n): Promise<AuthSession> {\n  const { url, transport, method, wallet, domain, statement, sessionTtlSeconds } = args;\n\n  const wallet_address = wallet.publicKey;\n  if (wallet_address == null || wallet_address.length === 0) {\n    throw new Error(\"@reifydb/auth: wallet.publicKey is required to sign in\");\n  }\n  if (!Number.isFinite(sessionTtlSeconds) || sessionTtlSeconds <= 0) {\n    throw new Error(\"@reifydb/auth: sessionTtlSeconds must be a positive number\");\n  }\n\n  const client = await transport.connect(url);\n  try {\n    const challenge = await client.login_challenge(method, {\n      identifier: wallet_address,\n      public_key: wallet_address,\n      domain,\n      statement,\n    });\n    if (challenge.kind !== \"challenge\") {\n      throw new Error(\n        `@reifydb/auth: expected challenge response, got ${challenge.kind}`,\n      );\n    }\n\n    const messageBytes = new TextEncoder().encode(challenge.message);\n    const signatureBytes = await wallet.signMessage(messageBytes);\n    const signature = wallet.encodeSignature(signatureBytes);\n\n    const auth = await client.login_challenge(method, {\n      challenge_id: challenge.challenge_id,\n      signature,\n      signed_message: challenge.message,\n    });\n    if (auth.kind !== \"authenticated\") {\n      throw new Error(\n        `@reifydb/auth: expected authenticated response, got ${auth.kind}`,\n      );\n    }\n\n    return {\n      token: auth.token,\n      identity: auth.identity,\n      wallet_address,\n      expires_at: Math.floor(Date.now() / 1000) + sessionTtlSeconds,\n    };\n  } finally {\n    transport.release(client);\n  }\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type {\n  AuthCapableClient,\n  AuthSession,\n  CredentialAuthCapableClient,\n} from \"./types\";\nimport type { AuthTransport } from \"./transport\";\n\nexport interface PasswordSignInArgs<\n  TClient extends AuthCapableClient = AuthCapableClient,\n> {\n  url: string;\n  transport: AuthTransport<TClient>;\n  identifier: string;\n  password: string;\n  sessionTtlSeconds: number;\n}\n\nfunction supports_password_login(\n  client: AuthCapableClient,\n): client is CredentialAuthCapableClient {\n  return (\n    typeof (client as CredentialAuthCapableClient).login_with_password ===\n    \"function\"\n  );\n}\n\nexport async function performPasswordSignIn<TClient extends AuthCapableClient>(\n  args: PasswordSignInArgs<TClient>,\n): Promise<AuthSession> {\n  const { url, transport, identifier, password, sessionTtlSeconds } = args;\n\n  if (identifier.length === 0) {\n    throw new Error(\"@reifydb/auth: identifier is required to sign in\");\n  }\n  if (password.length === 0) {\n    throw new Error(\"@reifydb/auth: password is required to sign in\");\n  }\n  if (!Number.isFinite(sessionTtlSeconds) || sessionTtlSeconds <= 0) {\n    throw new Error(\"@reifydb/auth: sessionTtlSeconds must be a positive number\");\n  }\n\n  const client = await transport.connect(url);\n  try {\n    if (!supports_password_login(client)) {\n      throw new Error(\n        \"@reifydb/auth: transport client does not support login_with_password\",\n      );\n    }\n    const auth = await client.login_with_password(identifier, password);\n    return {\n      token: auth.token,\n      identity: auth.identity,\n      wallet_address: identifier,\n      identifier,\n      method: \"password\",\n      expires_at: Math.floor(Date.now() / 1000) + sessionTtlSeconds,\n    };\n  } finally {\n    transport.release(client);\n  }\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport type { AuthSession } from \"./types\";\n\nconst SUFFIX = \".auth\";\n\nfunction key_for(namespace: string): string {\n  return `${namespace}${SUFFIX}`;\n}\n\n// A per-tab id so two tabs never share one localStorage slot and stomp each\n// other's session. Backed by sessionStorage: stable across reloads within a\n// tab, unique per tab, gone when the tab closes. Falls back to an ephemeral\n// in-memory id when sessionStorage or crypto.randomUUID is unavailable\n// (degraded: the session will not survive a reload).\nconst TAB_ID_KEY = \"reifydb.auth.tab\";\n\nfunction new_tab_id(): string {\n  try {\n    if (typeof crypto !== \"undefined\" && typeof crypto.randomUUID === \"function\") {\n      return crypto.randomUUID();\n    }\n  } catch {\n    // crypto unavailable; fall through to the cheap fallback\n  }\n  return `t-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;\n}\n\nfunction resolve_tab_id(): string {\n  if (typeof window === \"undefined\") return \"ssr\";\n  try {\n    const existing = sessionStorage.getItem(TAB_ID_KEY);\n    if (existing) return existing;\n    const id = new_tab_id();\n    sessionStorage.setItem(TAB_ID_KEY, id);\n    return id;\n  } catch {\n    // sessionStorage unavailable (private mode, disabled): ephemeral id.\n    return new_tab_id();\n  }\n}\n\nconst TAB_ID = resolve_tab_id();\n\n// Scopes a caller's namespace to this browser tab. AuthProvider feeds the\n// result into every storage operation so each tab gets its own slot and the\n// cross-tab `storage` listener filters other tabs out by key.\nexport function tabScopedNamespace(namespace: string): string {\n  return `${namespace}.${TAB_ID}`;\n}\n\nfunction is_auth_session(v: unknown): v is AuthSession {\n  if (v === null || typeof v !== \"object\") return false;\n  const o = v as Record<string, unknown>;\n  if (o.method !== undefined && o.method !== \"wallet\" && o.method !== \"password\") {\n    return false;\n  }\n  if (o.identifier !== undefined && typeof o.identifier !== \"string\") {\n    return false;\n  }\n  return (\n    typeof o.token === \"string\" && o.token.length > 0 &&\n    typeof o.identity === \"string\" && o.identity.length > 0 &&\n    typeof o.wallet_address === \"string\" && o.wallet_address.length > 0 &&\n    typeof o.expires_at === \"number\" && Number.isFinite(o.expires_at) && o.expires_at > 0\n  );\n}\n\nfunction safe_remove(namespace: string): void {\n  try {\n    localStorage.removeItem(key_for(namespace));\n  } catch {\n    // localStorage may be unavailable; ignore\n  }\n}\n\nexport function readStoredSession(namespace: string): AuthSession | null {\n  if (typeof window === \"undefined\") return null;\n  let raw: string | null;\n  try {\n    raw = localStorage.getItem(key_for(namespace));\n  } catch {\n    return null;\n  }\n  if (raw == null) return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    safe_remove(namespace);\n    return null;\n  }\n  if (!is_auth_session(parsed)) {\n    safe_remove(namespace);\n    return null;\n  }\n  if (parsed.expires_at <= Date.now() / 1000) {\n    safe_remove(namespace);\n    return null;\n  }\n  return parsed;\n}\n\nexport function writeStoredSession(namespace: string, session: AuthSession): void {\n  if (typeof window === \"undefined\") return;\n  if (!is_auth_session(session)) {\n    throw new Error(\"@reifydb/auth: refusing to persist malformed session\");\n  }\n  try {\n    localStorage.setItem(key_for(namespace), JSON.stringify(session));\n  } catch {\n    // localStorage may be unavailable (private mode, full quota); ignore.\n  }\n}\n\nexport function clearStoredSession(namespace: string): void {\n  if (typeof window === \"undefined\") return;\n  safe_remove(namespace);\n}\n\nexport function storageKeyFor(namespace: string): string {\n  return key_for(namespace);\n}\n\n// Closed tabs leave their per-tab slot in localStorage forever - nothing ever\n// reads that namespace again. Sweep once on mount: drop slots under\n// `baseNamespace` that belong to other tabs and have already expired. Live\n// tabs' slots have a future `expires_at` and are never touched.\nexport function sweepExpiredSessions(baseNamespace: string): void {\n  if (typeof window === \"undefined\") return;\n  try {\n    const now = Date.now() / 1000;\n    const own_key = key_for(tabScopedNamespace(baseNamespace));\n    const prefix = `${baseNamespace}.`;\n    const dead: string[] = [];\n    for (let i = 0; i < localStorage.length; i += 1) {\n      const k = localStorage.key(i);\n      if (k == null || k === own_key) continue;\n      if (!k.startsWith(prefix) || !k.endsWith(SUFFIX)) continue;\n      const raw = localStorage.getItem(k);\n      if (raw == null) continue;\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(raw);\n      } catch {\n        continue;\n      }\n      if (is_auth_session(parsed) && parsed.expires_at <= now) {\n        dead.push(k);\n      }\n    }\n    for (const k of dead) localStorage.removeItem(k);\n  } catch {\n    // localStorage unavailable; nothing to sweep.\n  }\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nimport { useContext } from \"react\";\n\nimport { AuthContext, type AuthContextValue } from \"./auth-provider\";\nimport { currentClient } from \"./client-cache\";\nimport type { AuthCapableClient } from \"./types\";\n\nexport function useAuth(): AuthContextValue {\n  const ctx = useContext(AuthContext);\n  if (ctx == null) {\n    throw new Error(\"@reifydb/auth: useAuth must be used inside <AuthProvider>\");\n  }\n  return ctx;\n}\n\nexport function useAuthClient<\n  TClient extends AuthCapableClient = AuthCapableClient,\n>(): TClient {\n  const { clientReady } = useAuth();\n  if (!clientReady) {\n    throw new Error(\"@reifydb/auth: useAuthClient called before clientReady\");\n  }\n  return currentClient<TClient>();\n}\n","// SPDX-License-Identifier: Apache-2.0\n// Copyright (c) 2026 ReifyDB\n\nexport type {\n  AuthCapableClient,\n  AuthSession,\n  AuthState,\n  AuthStatus,\n  CredentialAuthCapableClient,\n  LoginChallengeResult,\n  LoginResult,\n  PasswordCredentials,\n  WalletConnector,\n} from \"./types\";\n\nexport type { AuthTransport } from \"./transport\";\nexport {\n  http_transport,\n  json_http_transport,\n  json_ws_transport,\n  ws_transport,\n} from \"./transport\";\n\nexport {\n  AuthContext,\n  AuthProvider,\n  type AuthContextValue,\n  type AuthProviderProps,\n} from \"./auth-provider\";\n\nexport { useAuth, useAuthClient } from \"./use-auth\";\n\nexport { performSignIn, type SignInArgs } from \"./sign-in\";\n\nexport {\n  performPasswordSignIn,\n  type PasswordSignInArgs,\n} from \"./sign-in-password\";\n\nexport {\n  clearStoredSession,\n  readStoredSession,\n  storageKeyFor,\n  writeStoredSession,\n} from \"./storage\";\n\nexport { clearClient, currentClient, ensureClient } from \"./client-cache\";\n\nexport * from \"@reifydb/core\";\nexport * from \"@reifydb/client\";\n"],"mappings":";AAGA;AAAA,EACE;AAAA,OAKK;AAWP,SAAS,wBAAwB,QAA2C;AAC1E,MAAI,OAAO,OAAO,eAAe,YAAY;AAC3C,QAAI;AACF,aAAO,WAAW;AAAA,IACpB,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAEO,IAAM,eAAwC;AAAA,EACnD,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO;AAAA,MACZ;AAAA,MACA,SAAS,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI,EAAE,QAAQ,OAAO;AAAA,IAC/D;AAAA,EACF;AAAA,EACA,QAAQ,QAAQ;AACd,4BAAwB,MAAM;AAAA,EAChC;AACF;AAEO,IAAM,iBAA4C;AAAA,EACvD,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO;AAAA,MACZ;AAAA,MACA,SAAS,OAAO,EAAE,QAAQ,QAAQ,MAAM,IAAI,EAAE,QAAQ,OAAO;AAAA,IAC/D;AAAA,EACF;AAAA,EACA,QAAQ,SAAS;AAAA,EAEjB;AACF;AAEO,IAAM,oBAAiD;AAAA,EAC5D,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO,gBAAgB,KAAK,SAAS,OAAO,EAAE,MAAM,IAAI,MAAS;AAAA,EAC1E;AAAA,EACA,QAAQ,QAAQ;AACd,4BAAwB,MAAM;AAAA,EAChC;AACF;AAEO,IAAM,sBAAqD;AAAA,EAChE,MAAM;AAAA,EACN,MAAM,QAAQ,KAAK,OAAO;AACxB,WAAO,OAAO,kBAAkB,KAAK,SAAS,OAAO,EAAE,MAAM,IAAI,MAAS;AAAA,EAC5E;AAAA,EACA,QAAQ,SAAS;AAAA,EAEjB;AACF;;;ACvEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;;;ACFP,IAAI,cAA6B;AACjC,IAAI,iBAA2C;AAC/C,IAAI,oBAA0C;AAC9C,IAAI,kBAAqD;AAEzD,SAAS,OAAO,MAAc,KAAa,OAAuB;AAChE,SAAO,GAAG,IAAI,IAAI,GAAG,IAAI,KAAK;AAChC;AAEA,eAAsB,aACpB,WACA,KACA,OACY;AACZ,QAAM,MAAM,OAAO,UAAU,MAAM,KAAK,KAAK;AAE7C,MAAI,gBAAgB,KAAK;AACvB,QAAI,eAAgB,QAAO;AAC3B,QAAI,gBAAiB,QAAO;AAAA,EAC9B;AAGA,MAAI,kBAAkB,mBAAmB;AACvC,QAAI;AACF,MAAC,kBAAuD,QAAQ,cAAc;AAAA,IAChF,QAAQ;AAAA,IAER;AACA,qBAAiB;AAAA,EACnB;AACA,gBAAc;AACd,sBAAoB;AAEpB,QAAM,IAAI,UAAU,QAAQ,KAAK,KAAK,EAAE,KAAK,CAAC,WAAW;AAEvD,QAAI,gBAAgB,KAAK;AACvB,UAAI;AACF,kBAAU,QAAQ,MAAM;AAAA,MAC1B,QAAQ;AAAA,MAER;AACA,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AACA,qBAAiB;AACjB,sBAAkB;AAClB,WAAO;AAAA,EACT,CAAC;AACD,oBAAkB;AAClB,SAAO;AACT;AAEO,SAAS,cAAoB;AAClC,MAAI,kBAAkB,mBAAmB;AACvC,QAAI;AACF,MAAC,kBAAuD,QAAQ,cAAc;AAAA,IAChF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,gBAAc;AACd,mBAAiB;AACjB,sBAAoB;AACpB,oBAAkB;AACpB;AAEO,SAAS,gBAAoE;AAClF,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,SAAO;AACT;;;AChEA,eAAsB,cACpB,MACsB;AACtB,QAAM,EAAE,KAAK,WAAW,QAAQ,QAAQ,QAAQ,WAAW,kBAAkB,IAAI;AAEjF,QAAM,iBAAiB,OAAO;AAC9B,MAAI,kBAAkB,QAAQ,eAAe,WAAW,GAAG;AACzD,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,MAAI,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,GAAG;AACjE,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAEA,QAAM,SAAS,MAAM,UAAU,QAAQ,GAAG;AAC1C,MAAI;AACF,UAAM,YAAY,MAAM,OAAO,gBAAgB,QAAQ;AAAA,MACrD,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,UAAU,SAAS,aAAa;AAClC,YAAM,IAAI;AAAA,QACR,mDAAmD,UAAU,IAAI;AAAA,MACnE;AAAA,IACF;AAEA,UAAM,eAAe,IAAI,YAAY,EAAE,OAAO,UAAU,OAAO;AAC/D,UAAM,iBAAiB,MAAM,OAAO,YAAY,YAAY;AAC5D,UAAM,YAAY,OAAO,gBAAgB,cAAc;AAEvD,UAAM,OAAO,MAAM,OAAO,gBAAgB,QAAQ;AAAA,MAChD,cAAc,UAAU;AAAA,MACxB;AAAA,MACA,gBAAgB,UAAU;AAAA,IAC5B,CAAC;AACD,QAAI,KAAK,SAAS,iBAAiB;AACjC,YAAM,IAAI;AAAA,QACR,uDAAuD,KAAK,IAAI;AAAA,MAClE;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf;AAAA,MACA,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,IAC9C;AAAA,EACF,UAAE;AACA,cAAU,QAAQ,MAAM;AAAA,EAC1B;AACF;;;AC/CA,SAAS,wBACP,QACuC;AACvC,SACE,OAAQ,OAAuC,wBAC/C;AAEJ;AAEA,eAAsB,sBACpB,MACsB;AACtB,QAAM,EAAE,KAAK,WAAW,YAAY,UAAU,kBAAkB,IAAI;AAEpE,MAAI,WAAW,WAAW,GAAG;AAC3B,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AACA,MAAI,SAAS,WAAW,GAAG;AACzB,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAI,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,GAAG;AACjE,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAEA,QAAM,SAAS,MAAM,UAAU,QAAQ,GAAG;AAC1C,MAAI;AACF,QAAI,CAAC,wBAAwB,MAAM,GAAG;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,OAAO,MAAM,OAAO,oBAAoB,YAAY,QAAQ;AAClE,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf,gBAAgB;AAAA,MAChB;AAAA,MACA,QAAQ;AAAA,MACR,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,IAC9C;AAAA,EACF,UAAE;AACA,cAAU,QAAQ,MAAM;AAAA,EAC1B;AACF;;;AC1DA,IAAM,SAAS;AAEf,SAAS,QAAQ,WAA2B;AAC1C,SAAO,GAAG,SAAS,GAAG,MAAM;AAC9B;AAOA,IAAM,aAAa;AAEnB,SAAS,aAAqB;AAC5B,MAAI;AACF,QAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe,YAAY;AAC5E,aAAO,OAAO,WAAW;AAAA,IAC3B;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,KAAK,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5E;AAEA,SAAS,iBAAyB;AAChC,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACF,UAAM,WAAW,eAAe,QAAQ,UAAU;AAClD,QAAI,SAAU,QAAO;AACrB,UAAM,KAAK,WAAW;AACtB,mBAAe,QAAQ,YAAY,EAAE;AACrC,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO,WAAW;AAAA,EACpB;AACF;AAEA,IAAM,SAAS,eAAe;AAKvB,SAAS,mBAAmB,WAA2B;AAC5D,SAAO,GAAG,SAAS,IAAI,MAAM;AAC/B;AAEA,SAAS,gBAAgB,GAA8B;AACrD,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,QAAM,IAAI;AACV,MAAI,EAAE,WAAW,UAAa,EAAE,WAAW,YAAY,EAAE,WAAW,YAAY;AAC9E,WAAO;AAAA,EACT;AACA,MAAI,EAAE,eAAe,UAAa,OAAO,EAAE,eAAe,UAAU;AAClE,WAAO;AAAA,EACT;AACA,SACE,OAAO,EAAE,UAAU,YAAY,EAAE,MAAM,SAAS,KAChD,OAAO,EAAE,aAAa,YAAY,EAAE,SAAS,SAAS,KACtD,OAAO,EAAE,mBAAmB,YAAY,EAAE,eAAe,SAAS,KAClE,OAAO,EAAE,eAAe,YAAY,OAAO,SAAS,EAAE,UAAU,KAAK,EAAE,aAAa;AAExF;AAEA,SAAS,YAAY,WAAyB;AAC5C,MAAI;AACF,iBAAa,WAAW,QAAQ,SAAS,CAAC;AAAA,EAC5C,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,kBAAkB,WAAuC;AACvE,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACJ,MAAI;AACF,UAAM,aAAa,QAAQ,QAAQ,SAAS,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,KAAM,QAAO;AACxB,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,gBAAY,SAAS;AACrB,WAAO;AAAA,EACT;AACA,MAAI,CAAC,gBAAgB,MAAM,GAAG;AAC5B,gBAAY,SAAS;AACrB,WAAO;AAAA,EACT;AACA,MAAI,OAAO,cAAc,KAAK,IAAI,IAAI,KAAM;AAC1C,gBAAY,SAAS;AACrB,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,mBAAmB,WAAmB,SAA4B;AAChF,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI,CAAC,gBAAgB,OAAO,GAAG;AAC7B,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,MAAI;AACF,iBAAa,QAAQ,QAAQ,SAAS,GAAG,KAAK,UAAU,OAAO,CAAC;AAAA,EAClE,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,mBAAmB,WAAyB;AAC1D,MAAI,OAAO,WAAW,YAAa;AACnC,cAAY,SAAS;AACvB;AAEO,SAAS,cAAc,WAA2B;AACvD,SAAO,QAAQ,SAAS;AAC1B;AAMO,SAAS,qBAAqB,eAA6B;AAChE,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI;AACF,UAAM,MAAM,KAAK,IAAI,IAAI;AACzB,UAAM,UAAU,QAAQ,mBAAmB,aAAa,CAAC;AACzD,UAAM,SAAS,GAAG,aAAa;AAC/B,UAAM,OAAiB,CAAC;AACxB,aAAS,IAAI,GAAG,IAAI,aAAa,QAAQ,KAAK,GAAG;AAC/C,YAAM,IAAI,aAAa,IAAI,CAAC;AAC5B,UAAI,KAAK,QAAQ,MAAM,QAAS;AAChC,UAAI,CAAC,EAAE,WAAW,MAAM,KAAK,CAAC,EAAE,SAAS,MAAM,EAAG;AAClD,YAAM,MAAM,aAAa,QAAQ,CAAC;AAClC,UAAI,OAAO,KAAM;AACjB,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,GAAG;AAAA,MACzB,QAAQ;AACN;AAAA,MACF;AACA,UAAI,gBAAgB,MAAM,KAAK,OAAO,cAAc,KAAK;AACvD,aAAK,KAAK,CAAC;AAAA,MACb;AAAA,IACF;AACA,eAAW,KAAK,KAAM,cAAa,WAAW,CAAC;AAAA,EACjD,QAAQ;AAAA,EAER;AACF;;;AJ6LS;AAvTT,IAAM,sBAAsB;AAOrB,IAAM,cAAc,cAAuC,IAAI;AAwB/D,SAAS,aACd,OACc;AACd,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,oBAAoB;AAAA,IACpB;AAAA,IACA,eAAe;AAAA,IACf;AAAA,EACF,IAAI;AAKJ,QAAM,sBACJ,iBAAiB,YACb,mBACA,mBAAmB,gBAAgB;AAEzC,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,MAAM;AACtD,UAAM,SAAS,kBAAkB,mBAAmB;AACpD,WAAO,SACH,EAAE,QAAQ,aAAa,SAAS,QAAQ,aAAa,OAAO,OAAO,KAAK,IACxE,EAAE,QAAQ,gBAAgB,SAAS,MAAM,aAAa,OAAO,OAAO,KAAK;AAAA,EAC/E,CAAC;AAGD,QAAM,mBAAmB,QAAQ,aAAa;AAC9C,QAAM,oBAAoB,QAAQ,cAAc;AAChD,QAAM,oBAAoB,QAAQ,aAAa;AAC/C,QAAM,sBAAsB,QAAQ,qBAAqB;AAGzD,QAAM,cAAc,OAAO,MAAM,OAAO;AACxC,cAAY,UAAU,MAAM;AAC5B,QAAM,aAAa,OAAO,MAAM;AAChC,aAAW,UAAU;AAErB,QAAM,YAAY;AAAA,IAChB,CAAC,aAAsC,eAA8B;AACnE,yBAAmB,mBAAmB;AACtC,kBAAY;AACZ,eAAS;AAAA,QACP,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IACA,CAAC,mBAAmB;AAAA,EACtB;AAKA,YAAU,MAAM;AACd,UAAM,UAAU,MAAM;AACtB,QAAI,WAAW,KAAM;AAErB,UAAM,YAAY,MAAM;AACtB,UAAI,YAAY;AAChB,mBAAa,WAAW,KAAK,QAAQ,KAAK,EACvC,KAAK,MAAM;AACV,YAAI,UAAW;AACf;AAAA,UAAS,CAAC,SACR,KAAK,YAAY,UACb,EAAE,GAAG,MAAM,QAAQ,iBAAiB,aAAa,MAAM,OAAO,KAAK,IACnE;AAAA,QACN;AAAA,MACF,CAAC,EACA,MAAM,CAAC,QAAiB;AACvB,YAAI,UAAW;AACf,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,kBAAU,SAAS,OAAO;AAAA,MAC5B,CAAC;AACH,aAAO,MAAM;AACX,oBAAY;AAAA,MACd;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,YAAY;AACjC,aAAO,UAAU;AAAA,IACnB;AAEA,QAAI,oBAAoB,qBAAqB,MAAM;AACjD,UAAI,sBAAsB,QAAQ,gBAAgB;AAChD,kBAAU,gBAAgB,IAAI;AAC9B;AAAA,MACF;AACA,aAAO,UAAU;AAAA,IACnB;AAEA,QAAI,CAAC,qBAAqB,qBAAqB,sBAAsB;AAGnE;AAAA,QAAS,CAAC,SACR,KAAK,YAAY,UACb,EAAE,GAAG,MAAM,QAAQ,aAAa,aAAa,MAAM,IACnD;AAAA,MACN;AACA;AAAA,IACF;AAIA,cAAU,gBAAgB,IAAI;AAAA,EAChC,GAAG;AAAA,IACD,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,YAAU,MAAM;AACd,QAAI,OAAO,WAAW,YAAa;AACnC,UAAM,MAAM,cAAc,mBAAmB;AAC7C,UAAM,aAAa,CAAC,MAAoB;AACtC,UAAI,EAAE,QAAQ,IAAK;AACnB,YAAM,UAAU,YAAY;AAG5B,UAAI,EAAE,YAAY,MAAM;AACtB,YAAI,WAAW,KAAM,WAAU,gBAAgB,IAAI;AACnD;AAAA,MACF;AAEA,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,EAAE,QAAQ;AAAA,MAChC,QAAQ;AAGN,YAAI,WAAW,KAAM,WAAU,gBAAgB,IAAI;AACnD;AAAA,MACF;AAMA,UAAI,WAAW,KAAM;AAGrB,UACE,OAAO,mBAAmB,QAAQ,kBAClC,OAAO,aAAa,QAAQ,UAC5B;AACA,kBAAU,gBAAgB,IAAI;AAAA,MAChC;AAAA,IAIF;AACA,WAAO,iBAAiB,WAAW,UAAU;AAC7C,WAAO,MAAM;AACX,aAAO,oBAAoB,WAAW,UAAU;AAAA,IAClD;AAAA,EACF,GAAG,CAAC,qBAAqB,SAAS,CAAC;AAGnC,YAAU,MAAM;AACd,yBAAqB,gBAAgB;AAAA,EACvC,GAAG,CAAC,gBAAgB,CAAC;AAErB,QAAM,SAAS,YAAY,OAAO,gBAAsC;AACtE,QAAI,eAAe,MAAM;AACvB,eAAS,CAAC,UAAU,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,KAAK,EAAE;AAChE,UAAI;AACF,cAAM,UAAU,MAAM,sBAAsB;AAAA,UAC1C;AAAA,UACA;AAAA,UACA,YAAY,YAAY;AAAA,UACxB,UAAU,YAAY;AAAA,UACtB;AAAA,QACF,CAAC;AACD,2BAAmB,qBAAqB,OAAO;AAC/C,iBAAS;AAAA,UACP,QAAQ;AAAA,UACR;AAAA,UACA,aAAa;AAAA,UACb,OAAO;AAAA,QACT,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,iBAAS;AAAA,UACP,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,aAAa;AAAA,UACb,OAAO;AAAA,QACT,CAAC;AAAA,MACH;AACA;AAAA,IACF;AAEA,UAAM,IAAI,WAAW;AACrB,QAAI,KAAK,QAAQ,CAAC,EAAE,aAAa,EAAE,aAAa,MAAM;AACpD,eAAS,CAAC,UAAU,EAAE,GAAG,MAAM,QAAQ,SAAS,OAAO,uBAAuB,EAAE;AAChF;AAAA,IACF;AACA,QAAI,UAAU,QAAQ,UAAU,QAAQ,aAAa,MAAM;AACzD,eAAS,CAAC,UAAU;AAAA,QAClB,GAAG;AAAA,QACH,QAAQ;AAAA,QACR,OAAO;AAAA,MACT,EAAE;AACF;AAAA,IACF;AACA,aAAS,CAAC,UAAU,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,KAAK,EAAE;AAChE,QAAI;AACF,YAAM,UAAU,MAAM,cAAc;AAAA,QAClC;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAGD,UAAI,QAAQ,mBAAmB,WAAW,SAAS,WAAW;AAC5D,cAAM,IAAI,MAAM,+BAA+B;AAAA,MACjD;AACA,yBAAmB,qBAAqB,OAAO;AAC/C,eAAS;AAAA,QACP,QAAQ;AAAA,QACR;AAAA,QACA,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,eAAS;AAAA,QACP,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,aAAa;AAAA,QACb,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,UAAU,YAAY,YAAY;AAEtC,QAAI;AACF,YAAM,cAAc,EAAE,OAAO;AAAA,IAC/B,QAAQ;AAAA,IAER;AACA,cAAU,gBAAgB,IAAI;AAAA,EAChC,GAAG,CAAC,SAAS,CAAC;AAEd,QAAM,QAAQ;AAAA,IACZ,OAAO;AAAA,MACL,QAAQ,MAAM;AAAA,MACd,SAAS,MAAM;AAAA,MACf,aAAa,MAAM;AAAA,MACnB,OAAO,MAAM;AAAA,MACb;AAAA,MACA;AAAA,IACF;AAAA,IACA,CAAC,OAAO,QAAQ,OAAO;AAAA,EACzB;AAEA,SAAO,oBAAC,YAAY,UAAZ,EAAqB,OAAe,UAAS;AACvD;;;AKvVA,SAAS,kBAAkB;AAMpB,SAAS,UAA4B;AAC1C,QAAM,MAAM,WAAW,WAAW;AAClC,MAAI,OAAO,MAAM;AACf,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,SAAO;AACT;AAEO,SAAS,gBAEH;AACX,QAAM,EAAE,YAAY,IAAI,QAAQ;AAChC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,SAAO,cAAuB;AAChC;;;ACuBA,cAAc;AACd,cAAc;","names":[]}

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@reifydb/auth",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "dependencies": {
-    "@reifydb/core": "0.8.0",
-    "@reifydb/client": "0.8.0"
+    "@reifydb/core": "0.9.0",
+    "@reifydb/client": "0.9.0"
   },
   "peerDependencies": {
     "react": ">=16.8.0"