@auxilium/datalynk-client 1.5.1 → 1.6.0

package/dist/index.cjs

@@ -1553,7 +1553,10 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
         }
       });
       if ((_a = this.api.options.offline) == null ? void 0 : _a.length)
-        this.user$.pipe(filter((u) => u !== void 0)).subscribe((u) => localStorage.setItem("datalynk-user", JSON.stringify(u)));
+        this.user$.pipe(filter((u) => u !== void 0)).subscribe((u) => {
+          if (u == null) localStorage.removeItem("datalynk-user");
+          else localStorage.setItem("datalynk-user", JSON.stringify(u));
+        });
     }
     /** Current user */
     get user() {
@@ -1589,7 +1592,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
      * @return {Promise<void>} Login complete
      */
     async handleLogin(spoke, options) {
-      var _a, _b;
+      var _a, _b, _c;
       if (this.onlinePrompt) window.removeEventListener("online", this.onlinePrompt);
       if ((_a = this.api.options.offline) == null ? void 0 : _a.length) window.removeEventListener("online", this.onlinePrompt = () => this.handleLogin(spoke, options));
       const urlParams = new URLSearchParams(location.search);
@@ -1598,8 +1601,10 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
         this.api.token = urlToken;
         urlParams.delete("datalynkToken");
         location.href = location.pathname + (urlParams.toString() ? "?" + urlParams.toString() : "") + location.hash;
+      } else if (this.api.reauthenticationPending && !this.api.online && ((_b = this.api.jwtPayload) == null ? void 0 : _b.realm) == spoke) {
+        return;
       } else if (this.api.token && !this.api.expired) {
-        if (((_b = this.api.jwtPayload) == null ? void 0 : _b.realm) != spoke) {
+        if (((_c = this.api.jwtPayload) == null ? void 0 : _c.realm) != spoke) {
           this.api.token = null;
           location.reload();
         }
@@ -3101,6 +3106,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       // [ Callback, Re-subscribe ]
       __publicField(this, "retry");
       __publicField(this, "socket");
+      __publicField(this, "connectGeneration", 0);
       __publicField(this, "open", false);
       this.api = api;
       this.options = options;
@@ -3109,7 +3115,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
         this.options.url = origin.replace("http", "ws").replace(/:\d+/g, "") + `/s/`;
       }
       if (this.options.url !== false)
-        api.token$.pipe(filter((u) => u !== void 0), distinctUntilChanged()).subscribe(() => this.connect());
+        api.token$.pipe(filter((u) => u !== void 0), distinctUntilChanged()).subscribe(() => void this.connect());
     }
     /**
      * Add listener for all socket events
@@ -3131,6 +3137,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
      */
     close() {
       var _a;
+      if (this.options.authentication === "ticket") this.connectGeneration++;
       if (this.open) console.debug("Datalynk socket: disconnected");
       this.open = false;
       (_a = this.socket) == null ? void 0 : _a.close();
@@ -3143,6 +3150,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
      * @param {number} timeout Retry to connect every x seconds
      */
     connect(timeout = 30) {
+      if (this.options.authentication === "ticket") return this.connectWithTicket(timeout);
       if (this.options.url === false) return console.warn("Datalynk socket disabled");
       if (this.open) this.close();
       this.retry = setTimeout(() => {
@@ -3172,6 +3180,80 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
         };
       }
     }
+    /**
+     * Ticket-authenticated connection path, used only once a chat-capable host switches
+     * this instance to `authentication: 'ticket'` (see Api.openChat). Entirely separate
+     * from the token path above so existing non-chat consumers are never affected.
+     */
+    async connectWithTicket(timeout = 30) {
+      var _a;
+      if (this.options.url === false) return console.warn("Datalynk socket disabled");
+      const generation = ++this.connectGeneration;
+      if (this.open || this.socket) {
+        this.open = false;
+        (_a = this.socket) == null ? void 0 : _a.close();
+        this.socket = void 0;
+      }
+      if (this.retry) clearTimeout(this.retry);
+      this.retry = setTimeout(() => {
+        if (this.open || generation !== this.connectGeneration) return;
+        void this.connect(timeout);
+      }, timeout * 1e3);
+      if (!this.api.online || !this.api.token) return;
+      let socketUrl = this.normalizeUrl(String(this.options.url || ""));
+      try {
+        const response = await this.api.request({ "$/chat/socketTicket": {} }, { noOptimize: true });
+        if (generation !== this.connectGeneration) return;
+        if (response == null ? void 0 : response.ticket) socketUrl += `${socketUrl.includes("?") ? "&" : "?"}ticket=${encodeURIComponent(response.ticket)}`;
+        else throw new Error("Missing socket ticket");
+      } catch (_) {
+        if (generation !== this.connectGeneration) return;
+        this.scheduleReconnect(generation, timeout);
+        return;
+      }
+      if (generation !== this.connectGeneration) return;
+      this.socket = new WebSocket(socketUrl);
+      this.socket.onopen = () => void 0;
+      this.socket.onclose = () => {
+        this.open = false;
+        this.socket = void 0;
+        this.scheduleReconnect(generation, timeout);
+      };
+      this.socket.onerror = () => {
+      };
+      this.socket.onmessage = (message) => {
+        var _a2;
+        let payload;
+        try {
+          payload = JSON.parse(message.data);
+        } catch {
+          return;
+        }
+        if (payload.connected != void 0) {
+          if (payload.connected) {
+            this.open = true;
+            if (this.retry) clearTimeout(this.retry);
+            this.retry = null;
+            console.debug("Datalynk socket: connected");
+            this.listeners.forEach((l) => l[1]());
+          } else {
+            this.open = false;
+            console.warn(`Datalynk socket failed: ${payload.error || "authentication failed"}`);
+            (_a2 = this.socket) == null ? void 0 : _a2.close();
+          }
+        } else {
+          this.listeners.forEach((l) => l[0](payload));
+        }
+      };
+    }
+    scheduleReconnect(generation, timeout) {
+      if (generation !== this.connectGeneration || this.options.url === false) return;
+      if (this.retry) clearTimeout(this.retry);
+      this.retry = setTimeout(() => {
+        if (generation !== this.connectGeneration) return;
+        void this.connect(timeout);
+      }, timeout * 1e3);
+    }
     /**
      * Send data to socket server
      *
@@ -3198,6 +3280,17 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
         unsubscribe();
       };
     }
+    normalizeUrl(value) {
+      let url = value.replace(/^http:\/\//i, "ws://").replace(/^https:\/\//i, "wss://");
+      try {
+        const parsed = new URL(url);
+        if (parsed.pathname === "/" || parsed.pathname === "") parsed.pathname = "/s/";
+        else if (parsed.pathname === "/s") parsed.pathname = "/s/";
+        url = parsed.toString();
+      } catch {
+      }
+      return url;
+    }
   }
   class Superuser {
     constructor(api) {
@@ -3229,7 +3322,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       } });
     }
   }
-  const version = "1.5.1";
+  const version = "1.6.0";
   class WebRtc {
     constructor(api) {
       __publicField(this, "ice");
@@ -3776,7 +3869,14 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
         timeout: 6e4
       });
       __publicField(this, "authenticationInvalid", false);
+      /** Token reached exp while the client could not reach Datalynk; keep the offline session alive until reconnect. */
+      __publicField(this, "offlineAuthenticationExpired", false);
       __publicField(this, "tokenExpiryTimeout", null);
+      __publicField(this, "unauthorizedLogout", null);
+      __publicField(this, "replayingPending", false);
+      /** If replay is requested while a replay pass is already active, run another pass when it finishes. */
+      __publicField(this, "pendingReplayRequested", false);
+      __publicField(this, "offlineSessionOwner", null);
       /** Request-specific recovery after a server response proves an API call is broken. */
       __publicField(this, "recovery", null);
       /** Retry the failed request twice immediately, then this long after each failed recovery response. */
@@ -3784,9 +3884,15 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       __publicField(this, "recoveryImmediateRetries", 2);
       /** LocalStorage key for persisting logins */
       __publicField(this, "localStorageKey", "datalynk-token");
+      /** Persisted owner of an offline queue so another login cannot inherit queued writes. */
+      __publicField(this, "offlineSessionOwnerKey", "datalynk-offline-owner");
       __publicField(this, "tokenStorageListener", null);
       /** Pending requests cache */
       __publicField(this, "pending", {});
+      __publicField(this, "chatModulePromise", null);
+      __publicField(this, "chatInstance", null);
+      __publicField(this, "chatLauncherHost", null);
+      __publicField(this, "chatLauncherButton", null);
       /** Helpers */
       /** Authentication */
       __publicField(this, "auth");
@@ -3841,6 +3947,9 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
         offline: [],
         origin: typeof location !== "undefined" ? location.host : "Unknown",
         saveSession: true,
+        manageSession: true,
+        chat: false,
+        replayOfflineQueue: true,
         watchTokenExpiry: true,
         serviceWorker: "/service.worker.mjs",
         ...options,
@@ -3871,9 +3980,9 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
           window.addEventListener("storage", this.tokenStorageListener);
         }
       }
-      if (this.options.watchTokenExpiry)
+      if (this.options.manageSession !== false && this.options.watchTokenExpiry)
         this.token$.pipe(distinctUntilChanged()).subscribe((token) => this.scheduleTokenExpiry(token));
-      this.socket = new Socket(this, { url: options.socket });
+      this.socket = new Socket(this, { url: options.socket, authentication: options.socketAuthentication, realm: options.socketRealm });
       this.gps = new Gps(this, options.gps);
       this.auth = new Auth(this);
       this.files = new Files(this);
@@ -3883,21 +3992,13 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       this.webrtc = new WebRtc(this);
       if (typeof indexedDB != "undefined") {
         this.database = new Database("datalynk", ["pending", ...this.options.offline || []]);
-        this.online$.subscribe(async (online) => {
-          var _a2;
-          if (!online) return;
-          const table = (_a2 = this.database) == null ? void 0 : _a2.table("pending");
-          const keys = await (table == null ? void 0 : table.getAllKeys());
-          await Promise.allSettled(keys.map(async (k) => {
-            const r = await (table == null ? void 0 : table.get(k));
-            await this.request(r).then(() => table == null ? void 0 : table.delete(k));
-          }));
+        if (this.options.replayOfflineQueue !== false) this.online$.subscribe((online) => {
+          if (online) void this.replayPendingQueue();
         });
       }
       if (typeof window !== "undefined") {
         window.addEventListener("online", () => this.checkConnection());
         window.addEventListener("offline", () => this.setConnectionStatus("offline"));
-        this.online$.subscribe(() => this.offlineBanner());
         this.startHeartbeat();
       }
       if ((_a = this.options.offline) == null ? void 0 : _a.length) {
@@ -3922,12 +4023,17 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
           })();
         }
       }
+      this.setupChatLauncher();
     }
     /** Is token expired */
     get expired() {
       var _a;
       return (((_a = this.jwtPayload) == null ? void 0 : _a.exp) ?? Infinity) * 1e3 <= Date.now();
     }
+    /** Whether authentication expired while offline and must be renewed before replaying queued work. */
+    get reauthenticationPending() {
+      return this.offlineAuthenticationExpired;
+    }
     /** Get session info from JWT payload */
     get jwtPayload() {
       if (!this.token) return null;
@@ -3986,21 +4092,158 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       return this.token$.getValue();
     }
     set token(token) {
+      var _a;
       if (this.recovery && token !== this.recovery.token)
         this.cancelRecovery(errorFromCode(401, "Session changed during API recovery"));
-      if (token && this.isTokenExpired(token)) {
+      if (this.options.manageSession !== false && token && this.isTokenExpired(token)) {
         if (this.adoptStoredToken(token)) return;
-        this.authenticationInvalid = true;
-        this.token$.next(null);
-        this.setConnectionStatus("unauthorized");
+        if (this.shouldDeferLocalExpiry()) {
+          this.deferOfflineExpiry(token);
+          return;
+        }
+        this.markUnauthorized(void 0, this.hasOwnedOfflineSession(token));
         return;
       }
       this.authenticationInvalid = false;
+      this.offlineAuthenticationExpired = false;
       this.token$.next(token);
       if (token && !this.online && !this.recovery) {
         const browserOnline = typeof navigator == "undefined" || typeof navigator.onLine == "undefined" || navigator.onLine;
         this.setConnectionStatus(browserOnline ? "online" : "offline");
       }
+      if (token && ((_a = this.options) == null ? void 0 : _a.replayOfflineQueue) !== false) void this.replayPendingQueue();
+    }
+    /** Mount the optional launcher without loading or initializing the chat bundle. */
+    setupChatLauncher() {
+      if (!this.options.chat || typeof document === "undefined") return;
+      const mount = () => {
+        if (this.chatLauncherHost || !document.body || document.querySelector("[data-datalynk-chat-launcher]")) return;
+        const host = document.createElement("div");
+        host.setAttribute("data-datalynk-chat-launcher", "");
+        const root = host.attachShadow({ mode: "open" });
+        root.innerHTML = `
+				<style>
+					:host {
+						all: initial;
+						position: fixed;
+						right: 20px;
+						bottom: 20px;
+						z-index: 2147482999;
+						pointer-events: none;
+					}
+					button {
+						display: grid;
+						place-items: center;
+						width: 52px;
+						height: 52px;
+						padding: 0;
+						border: 1px solid #2f596d;
+						border-radius: 50%;
+						background: #3f6f85;
+						color: #fff;
+						box-shadow: 0 4px 14px rgb(15 42 54 / 24%);
+						cursor: pointer;
+						pointer-events: auto;
+						transition: background-color 120ms ease-out, box-shadow 120ms ease-out, transform 120ms ease-out;
+					}
+					button:hover { background: #315d71; box-shadow: 0 6px 18px rgb(15 42 54 / 30%); }
+					button:active { transform: translateY(1px); }
+					button:focus-visible { outline: 3px solid #f2c94c; outline-offset: 3px; }
+					button:disabled { cursor: wait; opacity: .72; }
+					.status {
+						position: absolute;
+						right: 62px;
+						bottom: 7px;
+						width: max-content;
+						max-width: min(260px, calc(100vw - 94px));
+						padding: 9px 11px;
+						border: 1px solid #c6d3d9;
+						border-radius: 6px;
+						background: #fff;
+						box-shadow: 0 3px 12px rgb(15 42 54 / 16%);
+						color: #263942;
+						font: 600 13px/1.35 "Segoe UI", Arial, sans-serif;
+						pointer-events: none;
+					}
+					.status:empty { display: none; }
+					svg { width: 25px; height: 25px; }
+					@media (max-width: 600px) { :host { right: 12px; bottom: 12px; } }
+					@media (prefers-reduced-motion: reduce) { button { transition: none; } }
+				</style>
+				<button type="button" aria-label="Open Datalynk Chat" title="Chat">
+					<svg viewBox="0 0 24 24" aria-hidden="true" focusable="false">
+						<path fill="currentColor" d="M4 4h16a2 2 0 0 1 2 2v10a2 2 0 0 1-2 2H9l-5 3v-3a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2Zm2.5 8.25a1.25 1.25 0 1 0 0-2.5 1.25 1.25 0 0 0 0 2.5Zm5.5 0a1.25 1.25 0 1 0 0-2.5 1.25 1.25 0 0 0 0 2.5Zm5.5 0a1.25 1.25 0 1 0 0-2.5 1.25 1.25 0 0 0 0 2.5Z"/>
+					</svg>
+				</button>
+				<span class="status" role="status" aria-live="polite"></span>`;
+        const button = root.querySelector("button");
+        button.addEventListener("click", () => void this.openChatFromLauncher());
+        document.body.appendChild(host);
+        this.chatLauncherHost = host;
+        this.chatLauncherButton = button;
+      };
+      if (document.body) mount();
+      else document.addEventListener("DOMContentLoaded", mount, { once: true });
+    }
+    async openChatFromLauncher() {
+      const button = this.chatLauncherButton;
+      if (!button) return;
+      const status = button.getRootNode().querySelector(".status");
+      button.disabled = true;
+      button.setAttribute("aria-busy", "true");
+      status.textContent = "Opening chat…";
+      try {
+        await this.openChat();
+        status.textContent = "";
+      } catch (error) {
+        button.disabled = false;
+        button.removeAttribute("aria-busy");
+        status.textContent = "Chat is unavailable for this session.";
+        console.error("Unable to open Datalynk Chat.", error);
+      }
+    }
+    restoreChatLauncher() {
+      if (!this.chatLauncherHost || !this.chatLauncherButton) return;
+      this.chatLauncherHost.hidden = false;
+      this.chatLauncherButton.disabled = false;
+      this.chatLauncherButton.removeAttribute("aria-busy");
+      this.chatLauncherButton.focus();
+    }
+    /** Lazily load and construct chat. No chat code or requests run before this call. */
+    async chat() {
+      if (this.chatInstance) return this.chatInstance;
+      const client = await this.loadChatModule();
+      return this.chatInstance || (this.chatInstance = new client.Chat(this));
+    }
+    /** Lazily load, authorize, and open the reusable chat window. */
+    async openChat(options = {}) {
+      const client = await this.loadChatModule();
+      const chat = await this.chat();
+      if (!await chat.available()) throw new Error("Chat is disabled or this session is not authorized.");
+      if (this.socket.options.authentication !== "ticket") {
+        this.socket.options.authentication = "ticket";
+        void this.socket.connect();
+      }
+      const onClose = options.onClose;
+      const chatWindow = client.openChat(chat, {
+        ...options,
+        onClose: () => {
+          this.restoreChatLauncher();
+          onClose == null ? void 0 : onClose();
+        }
+      });
+      if (this.chatLauncherHost) this.chatLauncherHost.hidden = true;
+      return chatWindow;
+    }
+    loadChatModule() {
+      if (!this.chatModulePromise) {
+        const moduleUrl = this.options.chatModule || "./chat.mjs";
+        this.chatModulePromise = import(
+          /* @vite-ignore */
+          moduleUrl
+        );
+      }
+      return this.chatModulePromise;
     }
     async _request(req, options = {}) {
       if (this.recovery) throw errorFromCode(503, "Datalynk is unavailable");
@@ -4018,8 +4261,8 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
     /** Execute exactly one HTTP API attempt. Recovery uses this directly to avoid recursive retry loops. */
     async _requestOnce(req, options = {}, recoveryAttempt = false) {
       const token = options.token || this.token;
-      if (token && this.isTokenExpired(token)) {
-        this.markUnauthorized(token);
+      if (this.options.manageSession !== false && token && this.isTokenExpired(token)) {
+        if (token === this.token) this.expireToken(token);
         throw errorFromCode(401, "Session token expired");
       }
       let resp;
@@ -4055,7 +4298,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       if (!resp.ok || (data == null ? void 0 : data.error)) {
         const error = Object.assign(errorFromCode(resp.status, data == null ? void 0 : data.error), data);
         Object.defineProperty(error, "response", { value: resp, configurable: true });
-        if (!recoveryAttempt && resp.status < 500 && resp.status !== 401 && !this.isMysqlError(error))
+        if (!recoveryAttempt && resp.status !== 401 && !this.isSqlStateError(error))
           this.setConnectionStatus("online");
         throw error;
       }
@@ -4063,17 +4306,22 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       if (!recoveryAttempt) this.setConnectionStatus("online");
       return data;
     }
-    /** Only server-response failures own global recovery; auth and ordinary 4xx errors do not. */
+    /**
+     * Only failures which indicate Datalynk as a service is unavailable own global
+     * recovery. A request-specific application failure must not take the whole
+     * client offline: another unrelated API request may still be perfectly healthy.
+     */
     isRecoverableResponseError(error) {
       var _a;
-      if (error instanceof UnexpectedApiResponseError) return true;
       if ((error == null ? void 0 : error.code) === 401) return false;
       const status = ((_a = error == null ? void 0 : error.response) == null ? void 0 : _a.status) ?? (error == null ? void 0 : error.code);
-      return status >= 500 || this.isMysqlError(error);
+      if (this.isGatewayUnavailableStatus(status)) return true;
+      return this.isSqlStateError(error);
     }
-    isMysqlError(error) {
-      const message = String((error == null ? void 0 : error.error) ?? (error == null ? void 0 : error.message) ?? "");
-      return /\bSQLSTATE\[[A-Z0-9]+\]/i.test(message);
+    /** Any API error returned in PDO SQLSTATE form uses the offline/recovery path. */
+    isSqlStateError(error) {
+      const message = String((error == null ? void 0 : error.error) ?? (error == null ? void 0 : error.message) ?? "").trim();
+      return /^SQLSTATE\[/i.test(message);
     }
     /**
      * A returned server failure immediately makes the client unavailable. The exact
@@ -4166,8 +4414,22 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
         this.setConnectionStatus("unauthorized");
         return;
       }
-      if (this.token && this.isTokenExpired(this.token)) {
-        this.markUnauthorized(this.token);
+      if (this.offlineAuthenticationExpired) {
+        const controller2 = new AbortController();
+        const timeout2 = setTimeout(() => controller2.abort(), this.heartbeat.timeout);
+        try {
+          const response = await fetch(this.url + this.heartbeat.target, { signal: controller2.signal });
+          if (this.isGatewayUnavailableStatus(response.status)) this.setConnectionStatus("unavailable");
+          else this.markUnauthorized(this.token, true);
+        } catch {
+          this.setConnectionStatus("offline");
+        } finally {
+          clearTimeout(timeout2);
+        }
+        return;
+      }
+      if (this.options.manageSession !== false && this.token && this.isTokenExpired(this.token)) {
+        this.expireToken(this.token);
         return;
       }
       const controller = new AbortController();
@@ -4175,13 +4437,16 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       try {
         const response = await fetch(this.url + this.heartbeat.target, { signal: controller.signal });
         if (this.recovery) return;
-        this.setConnectionStatus(response.ok ? "online" : "unavailable");
+        this.setConnectionStatus(this.isGatewayUnavailableStatus(response.status) ? "unavailable" : "online");
       } catch (error) {
         if (!this.recovery) this.setConnectionStatus("offline");
       } finally {
         clearTimeout(timeout);
       }
     }
+    isGatewayUnavailableStatus(status) {
+      return status === 502 || status === 503 || status === 504;
+    }
     isTokenExpired(token) {
       var _a;
       try {
@@ -4231,45 +4496,242 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       try {
         expiresAt = (((_a = decodeJwt(token)) == null ? void 0 : _a.exp) ?? 0) * 1e3;
       } catch {
-        if (!this.adoptStoredToken(token)) this.markUnauthorized(token);
+        if (!this.adoptStoredToken(token)) this.expireToken(token);
         return;
       }
       const delay = expiresAt - Date.now();
       if (delay <= 0) {
-        if (!this.adoptStoredToken(token)) this.markUnauthorized(token);
+        if (!this.adoptStoredToken(token)) this.expireToken(token);
         return;
       }
       this.tokenExpiryTimeout = setTimeout(() => {
         if (delay > 2147e6) this.scheduleTokenExpiry(token);
-        else if (!this.adoptStoredToken(token)) this.markUnauthorized(token);
+        else if (!this.adoptStoredToken(token)) this.expireToken(token);
       }, Math.min(delay, 2147e6));
       (_c = (_b = this.tokenExpiryTimeout) == null ? void 0 : _b.unref) == null ? void 0 : _c.call(_b);
     }
-    markUnauthorized(token) {
+    /** Handle local JWT expiry without treating an offline device like a rejected online session. */
+    expireToken(token) {
+      if (token !== this.token) return;
+      if (this.shouldDeferLocalExpiry()) {
+        this.deferOfflineExpiry(token);
+        return;
+      }
+      this.markUnauthorized(token, this.hasOwnedOfflineSession(token));
+    }
+    shouldDeferLocalExpiry() {
+      if (this.authenticationInvalid) return false;
+      if (typeof navigator != "undefined" && typeof navigator.onLine != "undefined" && !navigator.onLine) return true;
+      return this.status === "offline" || this.status === "unavailable";
+    }
+    deferOfflineExpiry(token) {
+      this.authenticationInvalid = false;
+      this.offlineAuthenticationExpired = true;
+      this.cancelRecovery(errorFromCode(401, "Session expired while offline"));
+      this.rememberOfflineSessionOwner(token);
+      if (this.token !== token) this.token$.next(token);
+      if (this.status === "online") this.setConnectionStatus("offline");
+    }
+    markUnauthorized(token, preservePending = this.hasOwnedOfflineSession(token || this.token)) {
       if (token && token !== this.token) return;
       if (this.adoptStoredToken(token)) return;
+      if (this.authenticationInvalid && this.unauthorizedLogout) return;
       this.authenticationInvalid = true;
+      this.offlineAuthenticationExpired = false;
       this.cancelRecovery(errorFromCode(401, "Session expired"));
-      if (this.token != null) this.token$.next(null);
+      if (this.token !== null) this.token$.next(null);
       this.setConnectionStatus("unauthorized");
+      this.unauthorizedLogout ?? (this.unauthorizedLogout = Promise.resolve().then(() => this.finishUnauthorizedLogout(preservePending)).finally(() => {
+        this.unauthorizedLogout = null;
+      }));
+    }
+    async finishUnauthorizedLogout(preservePending = false) {
+      var _a;
+      if (this.options.manageSession === false) return;
+      if (typeof localStorage != "undefined") {
+        localStorage.removeItem(this.localStorageKey);
+        localStorage.removeItem("datalynk-user");
+        if (!preservePending) localStorage.removeItem(this.offlineSessionOwnerKey);
+      }
+      if (!preservePending) this.offlineSessionOwner = null;
+      for (const slice of this.sliceCache.values()) {
+        try {
+          slice.sync(false);
+        } catch {
+        }
+      }
+      await this.clearOfflineSessionCache(preservePending);
+      if (typeof caches != "undefined") {
+        try {
+          await Promise.all([caches.delete("datalynk"), caches.delete("api-settings")]);
+        } catch (error) {
+          console.error("Unable to clear Datalynk service worker cache", error);
+        }
+      }
+      if (typeof navigator != "undefined" && ((_a = navigator.serviceWorker) == null ? void 0 : _a.controller)) {
+        navigator.serviceWorker.controller.postMessage({ token: null, clearCache: true });
+      }
+      if (typeof location != "undefined" && typeof location.reload == "function")
+        location.reload();
+    }
+    async clearOfflineSessionCache(preservePending = false) {
+      if (typeof indexedDB == "undefined") return;
+      try {
+        if (this.database) {
+          const db = await this.database.connection;
+          const stores = Array.from(db.objectStoreNames).filter((name) => !(preservePending && name === "pending"));
+          if (!stores.length) return;
+          await new Promise((resolve, reject) => {
+            const tx = db.transaction(stores, "readwrite");
+            stores.forEach((name) => tx.objectStore(name).clear());
+            tx.oncomplete = () => resolve();
+            tx.onerror = () => reject(tx.error);
+            tx.onabort = () => reject(tx.error);
+          });
+          return;
+        }
+        await new Promise((resolve, reject) => {
+          const request = indexedDB.open("datalynk");
+          request.onerror = () => reject(request.error);
+          request.onsuccess = () => {
+            const db = request.result;
+            const stores = Array.from(db.objectStoreNames).filter((name) => !(preservePending && name === "pending"));
+            if (!stores.length) {
+              db.close();
+              resolve();
+              return;
+            }
+            const tx = db.transaction(stores, "readwrite");
+            stores.forEach((name) => tx.objectStore(name).clear());
+            tx.oncomplete = () => {
+              db.close();
+              resolve();
+            };
+            tx.onerror = () => {
+              const error = tx.error;
+              db.close();
+              reject(error);
+            };
+            tx.onabort = () => {
+              const error = tx.error;
+              db.close();
+              reject(error);
+            };
+          };
+        });
+      } catch (error) {
+        console.error("Unable to clear Datalynk offline session cache", error);
+      }
+    }
+    tokenIdentity(token) {
+      if (!token) return null;
+      try {
+        const payload = decodeJwt(token);
+        const user = (payload == null ? void 0 : payload.uid) ?? (payload == null ? void 0 : payload.sub);
+        return {
+          realm: (payload == null ? void 0 : payload.realm) == null ? void 0 : String(payload.realm),
+          user: user == null ? void 0 : String(user)
+        };
+      } catch {
+        return null;
+      }
+    }
+    readOfflineSessionOwner() {
+      if (this.offlineSessionOwner) return this.offlineSessionOwner;
+      if (typeof localStorage == "undefined") return null;
+      try {
+        const value = localStorage.getItem(this.offlineSessionOwnerKey);
+        if (!value) return null;
+        const owner = JSON.parse(value);
+        if (!owner || typeof owner !== "object") return null;
+        return this.offlineSessionOwner = owner;
+      } catch {
+        return null;
+      }
+    }
+    ownersMatch(owner, identity2) {
+      if (!identity2) return false;
+      if (owner.realm != null && owner.realm !== identity2.realm) return false;
+      if (owner.user != null && owner.user !== identity2.user) return false;
+      return true;
+    }
+    rememberOfflineSessionOwner(token) {
+      const identity2 = this.tokenIdentity(token);
+      if (!identity2) return;
+      const existing = this.readOfflineSessionOwner();
+      if (existing && !this.ownersMatch(existing, identity2)) return;
+      this.offlineSessionOwner = identity2;
+      if (typeof localStorage != "undefined") {
+        try {
+          localStorage.setItem(this.offlineSessionOwnerKey, JSON.stringify(identity2));
+        } catch {
+        }
+      }
+    }
+    ensureOfflineSessionOwner(token) {
+      const existing = this.readOfflineSessionOwner();
+      const identity2 = this.tokenIdentity(token);
+      if (existing) return this.ownersMatch(existing, identity2);
+      if (!identity2) return true;
+      this.rememberOfflineSessionOwner(token);
+      return true;
+    }
+    hasOwnedOfflineSession(token) {
+      const owner = this.readOfflineSessionOwner();
+      return !!owner && this.ownersMatch(owner, this.tokenIdentity(token));
+    }
+    clearOfflineSessionOwner() {
+      this.offlineSessionOwner = null;
+      if (typeof localStorage != "undefined") {
+        try {
+          localStorage.removeItem(this.offlineSessionOwnerKey);
+        } catch {
+        }
+      }
+    }
+    /** Replay queued writes only after a matching authenticated session is online. */
+    async replayPendingQueue() {
+      if (!this.database || !this.online || this.authenticationInvalid || this.offlineAuthenticationExpired) return;
+      if (this.replayingPending) {
+        this.pendingReplayRequested = true;
+        return;
+      }
+      const table = this.database.table("pending");
+      const owner = this.readOfflineSessionOwner();
+      if (owner && !this.ownersMatch(owner, this.tokenIdentity(this.token))) {
+        if (this.token) console.warn("Datalynk offline queue is quarantined because it belongs to another authenticated user");
+        return;
+      }
+      this.replayingPending = true;
+      try {
+        const keys = await table.getAllKeys();
+        for (const key of keys) {
+          if (!this.online || this.authenticationInvalid || this.offlineAuthenticationExpired) break;
+          if (owner && !this.ownersMatch(owner, this.tokenIdentity(this.token))) break;
+          const request = await table.get(key);
+          if (request == null) continue;
+          try {
+            await this.request(request);
+            await table.delete(key);
+          } catch (error) {
+            break;
+          }
+        }
+        if (await table.count() === 0) this.clearOfflineSessionOwner();
+      } finally {
+        this.replayingPending = false;
+        if (this.pendingReplayRequested) {
+          this.pendingReplayRequested = false;
+          if (this.online && !this.authenticationInvalid && !this.offlineAuthenticationExpired)
+            void this.replayPendingQueue();
+        }
+      }
     }
     setConnectionStatus(status) {
       if (this.status !== status) this.status$.next(status);
       const online = status === "online";
       if (this.online !== online) this.online$.next(online);
     }
-    offlineBanner() {
-      if (this.options.offlineBanner === false || typeof document == "undefined") return;
-      if (this.status === "online") {
-        removeBanner("datalynk-offline-banner");
-      } else {
-        const message = this.status === "unauthorized" ? "⚠️ Your session expired, please sign in again" : this.status === "unavailable" ? "⚠️ Datalynk is currently unavailable" : "⚠️ You are offline, please reconnect to sync changes";
-        createBanner(message, {
-          id: "datalynk-offline-banner",
-          position: this.options.offlineBanner === "top" ? "top" : "bottom"
-        });
-      }
-    }
     startHeartbeat() {
       this.stopHeartbeat();
       this.heartbeat.interval = setInterval(() => this.checkConnection(), this.heartbeat.timeout / 2);
@@ -4379,6 +4841,8 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
       if (this.offline && typeof navigator != "undefined") {
         if (this.status === "unauthorized") return Promise.reject(errorFromCode(401, "Session expired"));
         if (options.offline) {
+          if (!this.ensureOfflineSessionOwner(this.token))
+            return Promise.reject(errorFromCode(409, "Offline queue belongs to another authenticated user"));
           (_b = (_a = this.database) == null ? void 0 : _a.table("pending")) == null ? void 0 : _b.add(data, key);
           return Promise.resolve();
         }