@auxilium/datalynk-client 1.5.1 → 1.6.0

package/dist/index.mjs

@@ -1549,7 +1549,10 @@ class Auth {
       }
     });
     if ((_a = this.api.options.offline) == null ? void 0 : _a.length)
-      this.user$.pipe(filter((u) => u !== void 0)).subscribe((u) => localStorage.setItem("datalynk-user", JSON.stringify(u)));
+      this.user$.pipe(filter((u) => u !== void 0)).subscribe((u) => {
+        if (u == null) localStorage.removeItem("datalynk-user");
+        else localStorage.setItem("datalynk-user", JSON.stringify(u));
+      });
   }
   /** Current user */
   get user() {
@@ -1585,7 +1588,7 @@ class Auth {
    * @return {Promise<void>} Login complete
    */
   async handleLogin(spoke, options) {
-    var _a, _b;
+    var _a, _b, _c;
     if (this.onlinePrompt) window.removeEventListener("online", this.onlinePrompt);
     if ((_a = this.api.options.offline) == null ? void 0 : _a.length) window.removeEventListener("online", this.onlinePrompt = () => this.handleLogin(spoke, options));
     const urlParams = new URLSearchParams(location.search);
@@ -1594,8 +1597,10 @@ class Auth {
       this.api.token = urlToken;
       urlParams.delete("datalynkToken");
       location.href = location.pathname + (urlParams.toString() ? "?" + urlParams.toString() : "") + location.hash;
+    } else if (this.api.reauthenticationPending && !this.api.online && ((_b = this.api.jwtPayload) == null ? void 0 : _b.realm) == spoke) {
+      return;
     } else if (this.api.token && !this.api.expired) {
-      if (((_b = this.api.jwtPayload) == null ? void 0 : _b.realm) != spoke) {
+      if (((_c = this.api.jwtPayload) == null ? void 0 : _c.realm) != spoke) {
         this.api.token = null;
         location.reload();
       }
@@ -3097,6 +3102,7 @@ class Socket {
     // [ Callback, Re-subscribe ]
     __publicField(this, "retry");
     __publicField(this, "socket");
+    __publicField(this, "connectGeneration", 0);
     __publicField(this, "open", false);
     this.api = api;
     this.options = options;
@@ -3105,7 +3111,7 @@ class Socket {
       this.options.url = origin.replace("http", "ws").replace(/:\d+/g, "") + `/s/`;
     }
     if (this.options.url !== false)
-      api.token$.pipe(filter((u) => u !== void 0), distinctUntilChanged()).subscribe(() => this.connect());
+      api.token$.pipe(filter((u) => u !== void 0), distinctUntilChanged()).subscribe(() => void this.connect());
   }
   /**
    * Add listener for all socket events
@@ -3127,6 +3133,7 @@ class Socket {
    */
   close() {
     var _a;
+    if (this.options.authentication === "ticket") this.connectGeneration++;
     if (this.open) console.debug("Datalynk socket: disconnected");
     this.open = false;
     (_a = this.socket) == null ? void 0 : _a.close();
@@ -3139,6 +3146,7 @@ class Socket {
    * @param {number} timeout Retry to connect every x seconds
    */
   connect(timeout = 30) {
+    if (this.options.authentication === "ticket") return this.connectWithTicket(timeout);
     if (this.options.url === false) return console.warn("Datalynk socket disabled");
     if (this.open) this.close();
     this.retry = setTimeout(() => {
@@ -3168,6 +3176,80 @@ class Socket {
       };
     }
   }
+  /**
+   * Ticket-authenticated connection path, used only once a chat-capable host switches
+   * this instance to `authentication: 'ticket'` (see Api.openChat). Entirely separate
+   * from the token path above so existing non-chat consumers are never affected.
+   */
+  async connectWithTicket(timeout = 30) {
+    var _a;
+    if (this.options.url === false) return console.warn("Datalynk socket disabled");
+    const generation = ++this.connectGeneration;
+    if (this.open || this.socket) {
+      this.open = false;
+      (_a = this.socket) == null ? void 0 : _a.close();
+      this.socket = void 0;
+    }
+    if (this.retry) clearTimeout(this.retry);
+    this.retry = setTimeout(() => {
+      if (this.open || generation !== this.connectGeneration) return;
+      void this.connect(timeout);
+    }, timeout * 1e3);
+    if (!this.api.online || !this.api.token) return;
+    let socketUrl = this.normalizeUrl(String(this.options.url || ""));
+    try {
+      const response = await this.api.request({ "$/chat/socketTicket": {} }, { noOptimize: true });
+      if (generation !== this.connectGeneration) return;
+      if (response == null ? void 0 : response.ticket) socketUrl += `${socketUrl.includes("?") ? "&" : "?"}ticket=${encodeURIComponent(response.ticket)}`;
+      else throw new Error("Missing socket ticket");
+    } catch (_) {
+      if (generation !== this.connectGeneration) return;
+      this.scheduleReconnect(generation, timeout);
+      return;
+    }
+    if (generation !== this.connectGeneration) return;
+    this.socket = new WebSocket(socketUrl);
+    this.socket.onopen = () => void 0;
+    this.socket.onclose = () => {
+      this.open = false;
+      this.socket = void 0;
+      this.scheduleReconnect(generation, timeout);
+    };
+    this.socket.onerror = () => {
+    };
+    this.socket.onmessage = (message) => {
+      var _a2;
+      let payload;
+      try {
+        payload = JSON.parse(message.data);
+      } catch {
+        return;
+      }
+      if (payload.connected != void 0) {
+        if (payload.connected) {
+          this.open = true;
+          if (this.retry) clearTimeout(this.retry);
+          this.retry = null;
+          console.debug("Datalynk socket: connected");
+          this.listeners.forEach((l) => l[1]());
+        } else {
+          this.open = false;
+          console.warn(`Datalynk socket failed: ${payload.error || "authentication failed"}`);
+          (_a2 = this.socket) == null ? void 0 : _a2.close();
+        }
+      } else {
+        this.listeners.forEach((l) => l[0](payload));
+      }
+    };
+  }
+  scheduleReconnect(generation, timeout) {
+    if (generation !== this.connectGeneration || this.options.url === false) return;
+    if (this.retry) clearTimeout(this.retry);
+    this.retry = setTimeout(() => {
+      if (generation !== this.connectGeneration) return;
+      void this.connect(timeout);
+    }, timeout * 1e3);
+  }
   /**
    * Send data to socket server
    *
@@ -3194,6 +3276,17 @@ class Socket {
       unsubscribe();
     };
   }
+  normalizeUrl(value) {
+    let url = value.replace(/^http:\/\//i, "ws://").replace(/^https:\/\//i, "wss://");
+    try {
+      const parsed = new URL(url);
+      if (parsed.pathname === "/" || parsed.pathname === "") parsed.pathname = "/s/";
+      else if (parsed.pathname === "/s") parsed.pathname = "/s/";
+      url = parsed.toString();
+    } catch {
+    }
+    return url;
+  }
 }
 class Superuser {
   constructor(api) {
@@ -3225,7 +3318,7 @@ class Superuser {
     } });
   }
 }
-const version = "1.5.1";
+const version = "1.6.0";
 class WebRtc {
   constructor(api) {
     __publicField(this, "ice");
@@ -3772,7 +3865,14 @@ const _Api = class _Api {
       timeout: 6e4
     });
     __publicField(this, "authenticationInvalid", false);
+    /** Token reached exp while the client could not reach Datalynk; keep the offline session alive until reconnect. */
+    __publicField(this, "offlineAuthenticationExpired", false);
     __publicField(this, "tokenExpiryTimeout", null);
+    __publicField(this, "unauthorizedLogout", null);
+    __publicField(this, "replayingPending", false);
+    /** If replay is requested while a replay pass is already active, run another pass when it finishes. */
+    __publicField(this, "pendingReplayRequested", false);
+    __publicField(this, "offlineSessionOwner", null);
     /** Request-specific recovery after a server response proves an API call is broken. */
     __publicField(this, "recovery", null);
     /** Retry the failed request twice immediately, then this long after each failed recovery response. */
@@ -3780,9 +3880,15 @@ const _Api = class _Api {
     __publicField(this, "recoveryImmediateRetries", 2);
     /** LocalStorage key for persisting logins */
     __publicField(this, "localStorageKey", "datalynk-token");
+    /** Persisted owner of an offline queue so another login cannot inherit queued writes. */
+    __publicField(this, "offlineSessionOwnerKey", "datalynk-offline-owner");
     __publicField(this, "tokenStorageListener", null);
     /** Pending requests cache */
     __publicField(this, "pending", {});
+    __publicField(this, "chatModulePromise", null);
+    __publicField(this, "chatInstance", null);
+    __publicField(this, "chatLauncherHost", null);
+    __publicField(this, "chatLauncherButton", null);
     /** Helpers */
     /** Authentication */
     __publicField(this, "auth");
@@ -3837,6 +3943,9 @@ const _Api = class _Api {
       offline: [],
       origin: typeof location !== "undefined" ? location.host : "Unknown",
       saveSession: true,
+      manageSession: true,
+      chat: false,
+      replayOfflineQueue: true,
       watchTokenExpiry: true,
       serviceWorker: "/service.worker.mjs",
       ...options,
@@ -3867,9 +3976,9 @@ const _Api = class _Api {
         window.addEventListener("storage", this.tokenStorageListener);
       }
     }
-    if (this.options.watchTokenExpiry)
+    if (this.options.manageSession !== false && this.options.watchTokenExpiry)
       this.token$.pipe(distinctUntilChanged()).subscribe((token) => this.scheduleTokenExpiry(token));
-    this.socket = new Socket(this, { url: options.socket });
+    this.socket = new Socket(this, { url: options.socket, authentication: options.socketAuthentication, realm: options.socketRealm });
     this.gps = new Gps(this, options.gps);
     this.auth = new Auth(this);
     this.files = new Files(this);
@@ -3879,21 +3988,13 @@ const _Api = class _Api {
     this.webrtc = new WebRtc(this);
     if (typeof indexedDB != "undefined") {
       this.database = new Database("datalynk", ["pending", ...this.options.offline || []]);
-      this.online$.subscribe(async (online) => {
-        var _a2;
-        if (!online) return;
-        const table = (_a2 = this.database) == null ? void 0 : _a2.table("pending");
-        const keys = await (table == null ? void 0 : table.getAllKeys());
-        await Promise.allSettled(keys.map(async (k) => {
-          const r = await (table == null ? void 0 : table.get(k));
-          await this.request(r).then(() => table == null ? void 0 : table.delete(k));
-        }));
+      if (this.options.replayOfflineQueue !== false) this.online$.subscribe((online) => {
+        if (online) void this.replayPendingQueue();
       });
     }
     if (typeof window !== "undefined") {
       window.addEventListener("online", () => this.checkConnection());
       window.addEventListener("offline", () => this.setConnectionStatus("offline"));
-      this.online$.subscribe(() => this.offlineBanner());
       this.startHeartbeat();
     }
     if ((_a = this.options.offline) == null ? void 0 : _a.length) {
@@ -3918,12 +4019,17 @@ const _Api = class _Api {
         })();
       }
     }
+    this.setupChatLauncher();
   }
   /** Is token expired */
   get expired() {
     var _a;
     return (((_a = this.jwtPayload) == null ? void 0 : _a.exp) ?? Infinity) * 1e3 <= Date.now();
   }
+  /** Whether authentication expired while offline and must be renewed before replaying queued work. */
+  get reauthenticationPending() {
+    return this.offlineAuthenticationExpired;
+  }
   /** Get session info from JWT payload */
   get jwtPayload() {
     if (!this.token) return null;
@@ -3982,21 +4088,158 @@ const _Api = class _Api {
     return this.token$.getValue();
   }
   set token(token) {
+    var _a;
     if (this.recovery && token !== this.recovery.token)
       this.cancelRecovery(errorFromCode(401, "Session changed during API recovery"));
-    if (token && this.isTokenExpired(token)) {
+    if (this.options.manageSession !== false && token && this.isTokenExpired(token)) {
       if (this.adoptStoredToken(token)) return;
-      this.authenticationInvalid = true;
-      this.token$.next(null);
-      this.setConnectionStatus("unauthorized");
+      if (this.shouldDeferLocalExpiry()) {
+        this.deferOfflineExpiry(token);
+        return;
+      }
+      this.markUnauthorized(void 0, this.hasOwnedOfflineSession(token));
       return;
     }
     this.authenticationInvalid = false;
+    this.offlineAuthenticationExpired = false;
     this.token$.next(token);
     if (token && !this.online && !this.recovery) {
       const browserOnline = typeof navigator == "undefined" || typeof navigator.onLine == "undefined" || navigator.onLine;
       this.setConnectionStatus(browserOnline ? "online" : "offline");
     }
+    if (token && ((_a = this.options) == null ? void 0 : _a.replayOfflineQueue) !== false) void this.replayPendingQueue();
+  }
+  /** Mount the optional launcher without loading or initializing the chat bundle. */
+  setupChatLauncher() {
+    if (!this.options.chat || typeof document === "undefined") return;
+    const mount = () => {
+      if (this.chatLauncherHost || !document.body || document.querySelector("[data-datalynk-chat-launcher]")) return;
+      const host = document.createElement("div");
+      host.setAttribute("data-datalynk-chat-launcher", "");
+      const root = host.attachShadow({ mode: "open" });
+      root.innerHTML = `
+				<style>
+					:host {
+						all: initial;
+						position: fixed;
+						right: 20px;
+						bottom: 20px;
+						z-index: 2147482999;
+						pointer-events: none;
+					}
+					button {
+						display: grid;
+						place-items: center;
+						width: 52px;
+						height: 52px;
+						padding: 0;
+						border: 1px solid #2f596d;
+						border-radius: 50%;
+						background: #3f6f85;
+						color: #fff;
+						box-shadow: 0 4px 14px rgb(15 42 54 / 24%);
+						cursor: pointer;
+						pointer-events: auto;
+						transition: background-color 120ms ease-out, box-shadow 120ms ease-out, transform 120ms ease-out;
+					}
+					button:hover { background: #315d71; box-shadow: 0 6px 18px rgb(15 42 54 / 30%); }
+					button:active { transform: translateY(1px); }
+					button:focus-visible { outline: 3px solid #f2c94c; outline-offset: 3px; }
+					button:disabled { cursor: wait; opacity: .72; }
+					.status {
+						position: absolute;
+						right: 62px;
+						bottom: 7px;
+						width: max-content;
+						max-width: min(260px, calc(100vw - 94px));
+						padding: 9px 11px;
+						border: 1px solid #c6d3d9;
+						border-radius: 6px;
+						background: #fff;
+						box-shadow: 0 3px 12px rgb(15 42 54 / 16%);
+						color: #263942;
+						font: 600 13px/1.35 "Segoe UI", Arial, sans-serif;
+						pointer-events: none;
+					}
+					.status:empty { display: none; }
+					svg { width: 25px; height: 25px; }
+					@media (max-width: 600px) { :host { right: 12px; bottom: 12px; } }
+					@media (prefers-reduced-motion: reduce) { button { transition: none; } }
+				</style>
+				<button type="button" aria-label="Open Datalynk Chat" title="Chat">
+					<svg viewBox="0 0 24 24" aria-hidden="true" focusable="false">
+						<path fill="currentColor" d="M4 4h16a2 2 0 0 1 2 2v10a2 2 0 0 1-2 2H9l-5 3v-3a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2Zm2.5 8.25a1.25 1.25 0 1 0 0-2.5 1.25 1.25 0 0 0 0 2.5Zm5.5 0a1.25 1.25 0 1 0 0-2.5 1.25 1.25 0 0 0 0 2.5Zm5.5 0a1.25 1.25 0 1 0 0-2.5 1.25 1.25 0 0 0 0 2.5Z"/>
+					</svg>
+				</button>
+				<span class="status" role="status" aria-live="polite"></span>`;
+      const button = root.querySelector("button");
+      button.addEventListener("click", () => void this.openChatFromLauncher());
+      document.body.appendChild(host);
+      this.chatLauncherHost = host;
+      this.chatLauncherButton = button;
+    };
+    if (document.body) mount();
+    else document.addEventListener("DOMContentLoaded", mount, { once: true });
+  }
+  async openChatFromLauncher() {
+    const button = this.chatLauncherButton;
+    if (!button) return;
+    const status = button.getRootNode().querySelector(".status");
+    button.disabled = true;
+    button.setAttribute("aria-busy", "true");
+    status.textContent = "Opening chat…";
+    try {
+      await this.openChat();
+      status.textContent = "";
+    } catch (error) {
+      button.disabled = false;
+      button.removeAttribute("aria-busy");
+      status.textContent = "Chat is unavailable for this session.";
+      console.error("Unable to open Datalynk Chat.", error);
+    }
+  }
+  restoreChatLauncher() {
+    if (!this.chatLauncherHost || !this.chatLauncherButton) return;
+    this.chatLauncherHost.hidden = false;
+    this.chatLauncherButton.disabled = false;
+    this.chatLauncherButton.removeAttribute("aria-busy");
+    this.chatLauncherButton.focus();
+  }
+  /** Lazily load and construct chat. No chat code or requests run before this call. */
+  async chat() {
+    if (this.chatInstance) return this.chatInstance;
+    const client = await this.loadChatModule();
+    return this.chatInstance || (this.chatInstance = new client.Chat(this));
+  }
+  /** Lazily load, authorize, and open the reusable chat window. */
+  async openChat(options = {}) {
+    const client = await this.loadChatModule();
+    const chat = await this.chat();
+    if (!await chat.available()) throw new Error("Chat is disabled or this session is not authorized.");
+    if (this.socket.options.authentication !== "ticket") {
+      this.socket.options.authentication = "ticket";
+      void this.socket.connect();
+    }
+    const onClose = options.onClose;
+    const chatWindow = client.openChat(chat, {
+      ...options,
+      onClose: () => {
+        this.restoreChatLauncher();
+        onClose == null ? void 0 : onClose();
+      }
+    });
+    if (this.chatLauncherHost) this.chatLauncherHost.hidden = true;
+    return chatWindow;
+  }
+  loadChatModule() {
+    if (!this.chatModulePromise) {
+      const moduleUrl = this.options.chatModule || "./chat.mjs";
+      this.chatModulePromise = import(
+        /* @vite-ignore */
+        moduleUrl
+      );
+    }
+    return this.chatModulePromise;
   }
   async _request(req, options = {}) {
     if (this.recovery) throw errorFromCode(503, "Datalynk is unavailable");
@@ -4014,8 +4257,8 @@ const _Api = class _Api {
   /** Execute exactly one HTTP API attempt. Recovery uses this directly to avoid recursive retry loops. */
   async _requestOnce(req, options = {}, recoveryAttempt = false) {
     const token = options.token || this.token;
-    if (token && this.isTokenExpired(token)) {
-      this.markUnauthorized(token);
+    if (this.options.manageSession !== false && token && this.isTokenExpired(token)) {
+      if (token === this.token) this.expireToken(token);
       throw errorFromCode(401, "Session token expired");
     }
     let resp;
@@ -4051,7 +4294,7 @@ const _Api = class _Api {
     if (!resp.ok || (data == null ? void 0 : data.error)) {
       const error = Object.assign(errorFromCode(resp.status, data == null ? void 0 : data.error), data);
       Object.defineProperty(error, "response", { value: resp, configurable: true });
-      if (!recoveryAttempt && resp.status < 500 && resp.status !== 401 && !this.isMysqlError(error))
+      if (!recoveryAttempt && resp.status !== 401 && !this.isSqlStateError(error))
         this.setConnectionStatus("online");
       throw error;
     }
@@ -4059,17 +4302,22 @@ const _Api = class _Api {
     if (!recoveryAttempt) this.setConnectionStatus("online");
     return data;
   }
-  /** Only server-response failures own global recovery; auth and ordinary 4xx errors do not. */
+  /**
+   * Only failures which indicate Datalynk as a service is unavailable own global
+   * recovery. A request-specific application failure must not take the whole
+   * client offline: another unrelated API request may still be perfectly healthy.
+   */
   isRecoverableResponseError(error) {
     var _a;
-    if (error instanceof UnexpectedApiResponseError) return true;
     if ((error == null ? void 0 : error.code) === 401) return false;
     const status = ((_a = error == null ? void 0 : error.response) == null ? void 0 : _a.status) ?? (error == null ? void 0 : error.code);
-    return status >= 500 || this.isMysqlError(error);
+    if (this.isGatewayUnavailableStatus(status)) return true;
+    return this.isSqlStateError(error);
   }
-  isMysqlError(error) {
-    const message = String((error == null ? void 0 : error.error) ?? (error == null ? void 0 : error.message) ?? "");
-    return /\bSQLSTATE\[[A-Z0-9]+\]/i.test(message);
+  /** Any API error returned in PDO SQLSTATE form uses the offline/recovery path. */
+  isSqlStateError(error) {
+    const message = String((error == null ? void 0 : error.error) ?? (error == null ? void 0 : error.message) ?? "").trim();
+    return /^SQLSTATE\[/i.test(message);
   }
   /**
    * A returned server failure immediately makes the client unavailable. The exact
@@ -4162,8 +4410,22 @@ const _Api = class _Api {
       this.setConnectionStatus("unauthorized");
       return;
     }
-    if (this.token && this.isTokenExpired(this.token)) {
-      this.markUnauthorized(this.token);
+    if (this.offlineAuthenticationExpired) {
+      const controller2 = new AbortController();
+      const timeout2 = setTimeout(() => controller2.abort(), this.heartbeat.timeout);
+      try {
+        const response = await fetch(this.url + this.heartbeat.target, { signal: controller2.signal });
+        if (this.isGatewayUnavailableStatus(response.status)) this.setConnectionStatus("unavailable");
+        else this.markUnauthorized(this.token, true);
+      } catch {
+        this.setConnectionStatus("offline");
+      } finally {
+        clearTimeout(timeout2);
+      }
+      return;
+    }
+    if (this.options.manageSession !== false && this.token && this.isTokenExpired(this.token)) {
+      this.expireToken(this.token);
       return;
     }
     const controller = new AbortController();
@@ -4171,13 +4433,16 @@ const _Api = class _Api {
     try {
       const response = await fetch(this.url + this.heartbeat.target, { signal: controller.signal });
       if (this.recovery) return;
-      this.setConnectionStatus(response.ok ? "online" : "unavailable");
+      this.setConnectionStatus(this.isGatewayUnavailableStatus(response.status) ? "unavailable" : "online");
     } catch (error) {
       if (!this.recovery) this.setConnectionStatus("offline");
     } finally {
       clearTimeout(timeout);
     }
   }
+  isGatewayUnavailableStatus(status) {
+    return status === 502 || status === 503 || status === 504;
+  }
   isTokenExpired(token) {
     var _a;
     try {
@@ -4227,45 +4492,242 @@ const _Api = class _Api {
     try {
       expiresAt = (((_a = decodeJwt(token)) == null ? void 0 : _a.exp) ?? 0) * 1e3;
     } catch {
-      if (!this.adoptStoredToken(token)) this.markUnauthorized(token);
+      if (!this.adoptStoredToken(token)) this.expireToken(token);
       return;
     }
     const delay = expiresAt - Date.now();
     if (delay <= 0) {
-      if (!this.adoptStoredToken(token)) this.markUnauthorized(token);
+      if (!this.adoptStoredToken(token)) this.expireToken(token);
       return;
     }
     this.tokenExpiryTimeout = setTimeout(() => {
       if (delay > 2147e6) this.scheduleTokenExpiry(token);
-      else if (!this.adoptStoredToken(token)) this.markUnauthorized(token);
+      else if (!this.adoptStoredToken(token)) this.expireToken(token);
     }, Math.min(delay, 2147e6));
     (_c = (_b = this.tokenExpiryTimeout) == null ? void 0 : _b.unref) == null ? void 0 : _c.call(_b);
   }
-  markUnauthorized(token) {
+  /** Handle local JWT expiry without treating an offline device like a rejected online session. */
+  expireToken(token) {
+    if (token !== this.token) return;
+    if (this.shouldDeferLocalExpiry()) {
+      this.deferOfflineExpiry(token);
+      return;
+    }
+    this.markUnauthorized(token, this.hasOwnedOfflineSession(token));
+  }
+  shouldDeferLocalExpiry() {
+    if (this.authenticationInvalid) return false;
+    if (typeof navigator != "undefined" && typeof navigator.onLine != "undefined" && !navigator.onLine) return true;
+    return this.status === "offline" || this.status === "unavailable";
+  }
+  deferOfflineExpiry(token) {
+    this.authenticationInvalid = false;
+    this.offlineAuthenticationExpired = true;
+    this.cancelRecovery(errorFromCode(401, "Session expired while offline"));
+    this.rememberOfflineSessionOwner(token);
+    if (this.token !== token) this.token$.next(token);
+    if (this.status === "online") this.setConnectionStatus("offline");
+  }
+  markUnauthorized(token, preservePending = this.hasOwnedOfflineSession(token || this.token)) {
     if (token && token !== this.token) return;
     if (this.adoptStoredToken(token)) return;
+    if (this.authenticationInvalid && this.unauthorizedLogout) return;
     this.authenticationInvalid = true;
+    this.offlineAuthenticationExpired = false;
     this.cancelRecovery(errorFromCode(401, "Session expired"));
-    if (this.token != null) this.token$.next(null);
+    if (this.token !== null) this.token$.next(null);
     this.setConnectionStatus("unauthorized");
+    this.unauthorizedLogout ?? (this.unauthorizedLogout = Promise.resolve().then(() => this.finishUnauthorizedLogout(preservePending)).finally(() => {
+      this.unauthorizedLogout = null;
+    }));
+  }
+  async finishUnauthorizedLogout(preservePending = false) {
+    var _a;
+    if (this.options.manageSession === false) return;
+    if (typeof localStorage != "undefined") {
+      localStorage.removeItem(this.localStorageKey);
+      localStorage.removeItem("datalynk-user");
+      if (!preservePending) localStorage.removeItem(this.offlineSessionOwnerKey);
+    }
+    if (!preservePending) this.offlineSessionOwner = null;
+    for (const slice of this.sliceCache.values()) {
+      try {
+        slice.sync(false);
+      } catch {
+      }
+    }
+    await this.clearOfflineSessionCache(preservePending);
+    if (typeof caches != "undefined") {
+      try {
+        await Promise.all([caches.delete("datalynk"), caches.delete("api-settings")]);
+      } catch (error) {
+        console.error("Unable to clear Datalynk service worker cache", error);
+      }
+    }
+    if (typeof navigator != "undefined" && ((_a = navigator.serviceWorker) == null ? void 0 : _a.controller)) {
+      navigator.serviceWorker.controller.postMessage({ token: null, clearCache: true });
+    }
+    if (typeof location != "undefined" && typeof location.reload == "function")
+      location.reload();
+  }
+  async clearOfflineSessionCache(preservePending = false) {
+    if (typeof indexedDB == "undefined") return;
+    try {
+      if (this.database) {
+        const db = await this.database.connection;
+        const stores = Array.from(db.objectStoreNames).filter((name) => !(preservePending && name === "pending"));
+        if (!stores.length) return;
+        await new Promise((resolve, reject) => {
+          const tx = db.transaction(stores, "readwrite");
+          stores.forEach((name) => tx.objectStore(name).clear());
+          tx.oncomplete = () => resolve();
+          tx.onerror = () => reject(tx.error);
+          tx.onabort = () => reject(tx.error);
+        });
+        return;
+      }
+      await new Promise((resolve, reject) => {
+        const request = indexedDB.open("datalynk");
+        request.onerror = () => reject(request.error);
+        request.onsuccess = () => {
+          const db = request.result;
+          const stores = Array.from(db.objectStoreNames).filter((name) => !(preservePending && name === "pending"));
+          if (!stores.length) {
+            db.close();
+            resolve();
+            return;
+          }
+          const tx = db.transaction(stores, "readwrite");
+          stores.forEach((name) => tx.objectStore(name).clear());
+          tx.oncomplete = () => {
+            db.close();
+            resolve();
+          };
+          tx.onerror = () => {
+            const error = tx.error;
+            db.close();
+            reject(error);
+          };
+          tx.onabort = () => {
+            const error = tx.error;
+            db.close();
+            reject(error);
+          };
+        };
+      });
+    } catch (error) {
+      console.error("Unable to clear Datalynk offline session cache", error);
+    }
+  }
+  tokenIdentity(token) {
+    if (!token) return null;
+    try {
+      const payload = decodeJwt(token);
+      const user = (payload == null ? void 0 : payload.uid) ?? (payload == null ? void 0 : payload.sub);
+      return {
+        realm: (payload == null ? void 0 : payload.realm) == null ? void 0 : String(payload.realm),
+        user: user == null ? void 0 : String(user)
+      };
+    } catch {
+      return null;
+    }
+  }
+  readOfflineSessionOwner() {
+    if (this.offlineSessionOwner) return this.offlineSessionOwner;
+    if (typeof localStorage == "undefined") return null;
+    try {
+      const value = localStorage.getItem(this.offlineSessionOwnerKey);
+      if (!value) return null;
+      const owner = JSON.parse(value);
+      if (!owner || typeof owner !== "object") return null;
+      return this.offlineSessionOwner = owner;
+    } catch {
+      return null;
+    }
+  }
+  ownersMatch(owner, identity2) {
+    if (!identity2) return false;
+    if (owner.realm != null && owner.realm !== identity2.realm) return false;
+    if (owner.user != null && owner.user !== identity2.user) return false;
+    return true;
+  }
+  rememberOfflineSessionOwner(token) {
+    const identity2 = this.tokenIdentity(token);
+    if (!identity2) return;
+    const existing = this.readOfflineSessionOwner();
+    if (existing && !this.ownersMatch(existing, identity2)) return;
+    this.offlineSessionOwner = identity2;
+    if (typeof localStorage != "undefined") {
+      try {
+        localStorage.setItem(this.offlineSessionOwnerKey, JSON.stringify(identity2));
+      } catch {
+      }
+    }
+  }
+  ensureOfflineSessionOwner(token) {
+    const existing = this.readOfflineSessionOwner();
+    const identity2 = this.tokenIdentity(token);
+    if (existing) return this.ownersMatch(existing, identity2);
+    if (!identity2) return true;
+    this.rememberOfflineSessionOwner(token);
+    return true;
+  }
+  hasOwnedOfflineSession(token) {
+    const owner = this.readOfflineSessionOwner();
+    return !!owner && this.ownersMatch(owner, this.tokenIdentity(token));
+  }
+  clearOfflineSessionOwner() {
+    this.offlineSessionOwner = null;
+    if (typeof localStorage != "undefined") {
+      try {
+        localStorage.removeItem(this.offlineSessionOwnerKey);
+      } catch {
+      }
+    }
+  }
+  /** Replay queued writes only after a matching authenticated session is online. */
+  async replayPendingQueue() {
+    if (!this.database || !this.online || this.authenticationInvalid || this.offlineAuthenticationExpired) return;
+    if (this.replayingPending) {
+      this.pendingReplayRequested = true;
+      return;
+    }
+    const table = this.database.table("pending");
+    const owner = this.readOfflineSessionOwner();
+    if (owner && !this.ownersMatch(owner, this.tokenIdentity(this.token))) {
+      if (this.token) console.warn("Datalynk offline queue is quarantined because it belongs to another authenticated user");
+      return;
+    }
+    this.replayingPending = true;
+    try {
+      const keys = await table.getAllKeys();
+      for (const key of keys) {
+        if (!this.online || this.authenticationInvalid || this.offlineAuthenticationExpired) break;
+        if (owner && !this.ownersMatch(owner, this.tokenIdentity(this.token))) break;
+        const request = await table.get(key);
+        if (request == null) continue;
+        try {
+          await this.request(request);
+          await table.delete(key);
+        } catch (error) {
+          break;
+        }
+      }
+      if (await table.count() === 0) this.clearOfflineSessionOwner();
+    } finally {
+      this.replayingPending = false;
+      if (this.pendingReplayRequested) {
+        this.pendingReplayRequested = false;
+        if (this.online && !this.authenticationInvalid && !this.offlineAuthenticationExpired)
+          void this.replayPendingQueue();
+      }
+    }
   }
   setConnectionStatus(status) {
     if (this.status !== status) this.status$.next(status);
     const online = status === "online";
     if (this.online !== online) this.online$.next(online);
   }
-  offlineBanner() {
-    if (this.options.offlineBanner === false || typeof document == "undefined") return;
-    if (this.status === "online") {
-      removeBanner("datalynk-offline-banner");
-    } else {
-      const message = this.status === "unauthorized" ? "⚠️ Your session expired, please sign in again" : this.status === "unavailable" ? "⚠️ Datalynk is currently unavailable" : "⚠️ You are offline, please reconnect to sync changes";
-      createBanner(message, {
-        id: "datalynk-offline-banner",
-        position: this.options.offlineBanner === "top" ? "top" : "bottom"
-      });
-    }
-  }
   startHeartbeat() {
     this.stopHeartbeat();
     this.heartbeat.interval = setInterval(() => this.checkConnection(), this.heartbeat.timeout / 2);
@@ -4375,6 +4837,8 @@ const _Api = class _Api {
     if (this.offline && typeof navigator != "undefined") {
       if (this.status === "unauthorized") return Promise.reject(errorFromCode(401, "Session expired"));
       if (options.offline) {
+        if (!this.ensureOfflineSessionOwner(this.token))
+          return Promise.reject(errorFromCode(409, "Offline queue belongs to another authenticated user"));
         (_b = (_a = this.database) == null ? void 0 : _a.table("pending")) == null ? void 0 : _b.add(data, key);
         return Promise.resolve();
       }