@basictech/react 0.7.0 → 0.8.0-beta.1

package/dist/index.js

@@ -46,11 +46,36 @@ var init_config = __esm({
   }
 });
 
+// src/sync/tokenRegistry.ts
+function setTokenGetter(url, fn) {
+  registry.set(url, fn);
+}
+function getTokenGetter(url) {
+  return registry.get(url);
+}
+var registry;
+var init_tokenRegistry = __esm({
+  "src/sync/tokenRegistry.ts"() {
+    "use strict";
+    registry = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/sync/syncProtocol.js
 var syncProtocol_exports = {};
 __export(syncProtocol_exports, {
   syncProtocol: () => syncProtocol
 });
+function decodeJwtExp(token) {
+  try {
+    var parts = token.split(".");
+    if (parts.length !== 3) return null;
+    var payload = JSON.parse(atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")));
+    return typeof payload.exp === "number" ? payload.exp : null;
+  } catch (_) {
+    return null;
+  }
+}
 var import_dexie, syncProtocol;
 var init_syncProtocol = __esm({
   "src/sync/syncProtocol.js"() {
@@ -58,13 +83,16 @@ var init_syncProtocol = __esm({
     "use client";
     import_dexie = require("dexie");
     init_config();
+    init_tokenRegistry();
     syncProtocol = function() {
       log("Initializing syncProtocol");
       var RECONNECT_DELAY = 5e3;
+      var TOKEN_REFRESH_BUFFER = 60;
       import_dexie.Dexie.Syncable.registerSyncProtocol("websocket", {
         sync: function(context, url, options, baseRevision, syncedRevision, changes, partial, applyRemoteChanges, onChangesAccepted, onSuccess, onError) {
           var requestId = 0;
           var acceptCallbacks = {};
+          var refreshTimer = null;
           log("Connecting to", url);
           var ws = new WebSocket(url);
           function sendChanges(changes2, baseRevision2, partial2, onChangesAccepted2) {
@@ -81,30 +109,71 @@ var init_syncProtocol = __esm({
               })
             );
           }
-          ws.onopen = function(event) {
-            log("Opening socket - sending clientIdentity", context.clientIdentity);
-            ws.send(
-              JSON.stringify({
-                type: "clientIdentity",
-                clientIdentity: context.clientIdentity || null,
-                authToken: options.authToken,
-                schema: options.schema
-              })
-            );
+          function clearRefreshTimer() {
+            if (refreshTimer) {
+              clearTimeout(refreshTimer);
+              refreshTimer = null;
+            }
+          }
+          function resolveGetToken() {
+            var fn = getTokenGetter(url);
+            if (!fn) throw new Error("No token getter registered for " + url);
+            return fn;
+          }
+          function scheduleTokenRefresh(tokenStr) {
+            clearRefreshTimer();
+            var exp = decodeJwtExp(tokenStr);
+            if (!exp) return;
+            var msUntilRefresh = (exp - TOKEN_REFRESH_BUFFER) * 1e3 - Date.now();
+            if (msUntilRefresh <= 0) return;
+            log("Scheduling proactive token refresh in", Math.round(msUntilRefresh / 1e3), "s");
+            refreshTimer = setTimeout(async function() {
+              try {
+                var newToken = await resolveGetToken()({ forceRefresh: true });
+                if (ws.readyState === WebSocket.OPEN) {
+                  log("Sending tokenUpdate on existing WebSocket");
+                  ws.send(JSON.stringify({ type: "tokenUpdate", authToken: newToken }));
+                  scheduleTokenRefresh(newToken);
+                }
+              } catch (err) {
+                log("Proactive token refresh failed (non-fatal):", err);
+              }
+            }, msUntilRefresh);
+          }
+          ws.onopen = async function(event) {
+            try {
+              var token = await resolveGetToken()();
+              log("Opening socket - sending clientIdentity", context.clientIdentity);
+              ws.send(
+                JSON.stringify({
+                  type: "clientIdentity",
+                  clientIdentity: context.clientIdentity || null,
+                  authToken: token,
+                  schema: options.schema
+                })
+              );
+              scheduleTokenRefresh(token);
+            } catch (err) {
+              log("Failed to get token for WebSocket:", err);
+              ws.close();
+              onError("Authentication failed: " + (err.message || err), RECONNECT_DELAY);
+            }
           };
           ws.onerror = function(event) {
+            clearRefreshTimer();
             ws.close();
             log("ws.onerror", event);
             onError(event?.message, RECONNECT_DELAY);
           };
           ws.onclose = function(event) {
+            clearRefreshTimer();
             onError("Socket closed: " + event.reason, RECONNECT_DELAY);
           };
           var isFirstRound = true;
           ws.onmessage = function(event) {
             try {
               var requestFromServer = JSON.parse(event.data);
-              log("requestFromServer", requestFromServer, { acceptCallback, isFirstRound });
+              log("requestFromServer", requestFromServer, { isFirstRound });
               if (requestFromServer.type == "clientIdentity") {
                 context.clientIdentity = requestFromServer.clientIdentity;
                 context.save();
@@ -132,8 +201,8 @@ var init_syncProtocol = __esm({
                         onChangesAccepted2
                       );
                     },
-                    // Specify a disconnect function that will close our socket so that we dont continue to monitor changes.
                     disconnect: function() {
+                      clearRefreshTimer();
                       ws.close();
                     }
                   });
@@ -145,9 +214,13 @@ var init_syncProtocol = __esm({
                 acceptCallback();
                 delete acceptCallbacks[requestId2.toString()];
               } else if (requestFromServer.type == "error") {
-                var requestId2 = requestFromServer.requestId;
                 ws.close();
-                onError(requestFromServer.message, Infinity);
+                if (requestFromServer.code === "TOKEN_EXPIRED" || requestFromServer.code === "UNAUTHORIZED") {
+                  log("Auth error from server, will reconnect with fresh token:", requestFromServer.message);
+                  onError(requestFromServer.message, RECONNECT_DELAY);
+                } else {
+                  onError(requestFromServer.message, Infinity);
+                }
               } else {
                 log("unknown message", requestFromServer);
                 ws.close();
@@ -166,37 +239,38 @@ var init_syncProtocol = __esm({
 });
 
 // src/index.ts
-var src_exports = {};
-__export(src_exports, {
+var index_exports = {};
+__export(index_exports, {
   BasicProvider: () => BasicProvider,
+  DBStatus: () => DBStatus,
   NotAuthenticatedError: () => NotAuthenticatedError,
   RemoteCollection: () => RemoteCollection,
   RemoteDB: () => RemoteDB,
   RemoteDBError: () => RemoteDBError,
   STORAGE_KEYS: () => STORAGE_KEYS,
+  resolveDid: () => resolveDid,
+  resolveDidWebUrl: () => resolveDidWebUrl,
+  resolveHandle: () => resolveHandle,
   useBasic: () => useBasic,
   useQuery: () => import_dexie_react_hooks.useLiveQuery
 });
-module.exports = __toCommonJS(src_exports);
+module.exports = __toCommonJS(index_exports);
 
 // src/AuthContext.tsx
 var import_react = require("react");
-var import_jwt_decode = require("jwt-decode");
 
 // src/sync/index.ts
 var import_uuid = require("uuid");
 var import_dexie2 = require("dexie");
 init_config();
 var import_schema = require("@basictech/schema");
+init_tokenRegistry();
 var dexieExtensionsLoaded = false;
 var initPromise = null;
 async function initDexieExtensions() {
-  if (dexieExtensionsLoaded)
-    return;
-  if (typeof window === "undefined")
-    return;
-  if (initPromise)
-    return initPromise;
+  if (dexieExtensionsLoaded) return;
+  if (typeof window === "undefined") return;
+  if (initPromise) return initPromise;
   initPromise = (async () => {
     try {
       await import("dexie-syncable");
@@ -221,12 +295,13 @@ var BasicSync = class extends import_dexie2.Dexie {
     this.version(2).stores({});
     this.Collection.prototype.get = this.Collection.prototype.toArray;
   }
-  async connect({ access_token, ws_url }) {
+  async connect({ getToken, ws_url }) {
     const WS_URL = ws_url || "wss://pds.basic.id/ws";
     log("Connecting to", WS_URL);
+    setTokenGetter(WS_URL, getToken);
     await this.updateSyncNodes();
     log("Starting connection...");
-    return this.syncable.connect("websocket", WS_URL, { authToken: access_token, schema: this.basic_schema });
+    return this.syncable.connect("websocket", WS_URL, { schema: this.basic_schema });
   }
   async disconnect({ ws_url } = {}) {
     const WS_URL = ws_url || "wss://pds.basic.id/ws";
@@ -266,7 +341,7 @@ var BasicSync = class extends import_dexie2.Dexie {
   }
   _convertSchemaToDxSchema(schema) {
     const stores = Object.entries(schema.tables).map(([key, table]) => {
-      const indexedFields = Object.entries(table.fields).filter(([key2, field]) => field.indexed).map(([key2, field]) => `,${key2}`).join("");
+      const indexedFields = Object.entries(table.fields).filter(([, field]) => field.indexed).map(([fieldKey]) => `,${fieldKey}`).join("");
       return {
         [key]: "id" + indexedFields
       };
@@ -433,29 +508,45 @@ var RemoteCollection = class {
     const token = await this.config.getToken();
     const url = `${this.config.serverUrl}${path}`;
     this.log(`${method} ${url}`, body ? JSON.stringify(body) : "");
+    const headers = {
+      "Authorization": `Bearer ${token}`
+    };
+    if (body) {
+      headers["Content-Type"] = "application/json";
+    }
     const response = await fetch(url, {
       method,
-      headers: {
-        "Content-Type": "application/json",
-        "Authorization": `Bearer ${token}`
-      },
+      headers,
       ...body ? { body: JSON.stringify(body) } : {}
     });
     const responseData = await response.json().catch(() => ({}));
     if (!response.ok) {
       if (response.status === 401 && !isRetry) {
-        this.log("Got 401, retrying with fresh token...");
+        this.log("Got 401, forcing token refresh and retrying...");
+        await this.config.getToken({ forceRefresh: true });
         return this.request(method, path, body, true);
       }
       if (this.config.debug) {
         console.error(`[RemoteDB] Error ${response.status}:`, responseData);
       }
-      if (response.status === 401 && this.config.onAuthError) {
-        this.config.onAuthError({
-          status: response.status,
-          message: "Authentication failed",
-          response: responseData
-        });
+      if (this.config.onAuthError) {
+        if (response.status === 401) {
+          this.config.onAuthError({
+            status: response.status,
+            message: "Authentication failed",
+            response: responseData,
+            errorType: "expired",
+            afterRetry: isRetry
+          });
+        } else if (response.status === 403) {
+          this.config.onAuthError({
+            status: response.status,
+            message: responseData.message || "Forbidden - insufficient permissions or missing scope",
+            response: responseData,
+            errorType: "forbidden",
+            afterRetry: isRetry
+          });
+        }
       }
       const errorMessage = responseData.message || responseData.error || responseData.detail || (typeof responseData === "string" ? responseData : `API request failed: ${response.status}`);
       throw new RemoteDBError(errorMessage, response.status, responseData);
@@ -654,136 +745,8 @@ var RemoteDB = class {
   }
 };
 
-// src/AuthContext.tsx
-init_config();
-
-// package.json
-var version = "0.7.0-beta.6";
-
-// src/updater/versionUpdater.ts
-var VersionUpdater = class {
-  storage;
-  currentVersion;
-  migrations;
-  versionKey = "basic_app_version";
-  constructor(storage, currentVersion, migrations = []) {
-    this.storage = storage;
-    this.currentVersion = currentVersion;
-    this.migrations = migrations.sort((a, b) => this.compareVersions(a.fromVersion, b.fromVersion));
-  }
-  /**
-   * Check current stored version and run migrations if needed
-   * Only compares major.minor versions, ignoring beta/prerelease parts
-   * Example: "0.7.0-beta.1" and "0.7.0" are treated as the same version
-   */
-  async checkAndUpdate() {
-    const storedVersion = await this.getStoredVersion();
-    if (!storedVersion) {
-      await this.setStoredVersion(this.currentVersion);
-      return { updated: false, toVersion: this.currentVersion };
-    }
-    if (storedVersion === this.currentVersion) {
-      return { updated: false, toVersion: this.currentVersion };
-    }
-    const migrationsToRun = this.getMigrationsToRun(storedVersion, this.currentVersion);
-    if (migrationsToRun.length === 0) {
-      await this.setStoredVersion(this.currentVersion);
-      return { updated: true, fromVersion: storedVersion, toVersion: this.currentVersion };
-    }
-    for (const migration of migrationsToRun) {
-      try {
-        console.log(`Running migration from ${migration.fromVersion} to ${migration.toVersion}`);
-        await migration.migrate(this.storage);
-      } catch (error) {
-        console.error(`Migration failed from ${migration.fromVersion} to ${migration.toVersion}:`, error);
-        throw new Error(`Migration failed: ${error}`);
-      }
-    }
-    await this.setStoredVersion(this.currentVersion);
-    return { updated: true, fromVersion: storedVersion, toVersion: this.currentVersion };
-  }
-  async getStoredVersion() {
-    try {
-      const versionData = await this.storage.get(this.versionKey);
-      if (!versionData)
-        return null;
-      const versionInfo = JSON.parse(versionData);
-      return versionInfo.version;
-    } catch (error) {
-      console.warn("Failed to get stored version:", error);
-      return null;
-    }
-  }
-  async setStoredVersion(version2) {
-    const versionInfo = {
-      version: version2,
-      lastUpdated: Date.now()
-    };
-    await this.storage.set(this.versionKey, JSON.stringify(versionInfo));
-  }
-  getMigrationsToRun(fromVersion, toVersion) {
-    return this.migrations.filter((migration) => {
-      const storedLessThanMigrationTo = this.compareVersions(fromVersion, migration.toVersion) < 0;
-      const currentGreaterThanOrEqualMigrationTo = this.compareVersions(toVersion, migration.toVersion) >= 0;
-      console.log(`Checking migration ${migration.fromVersion} \u2192 ${migration.toVersion}:`);
-      console.log(`  stored ${fromVersion} < migration.to ${migration.toVersion}: ${storedLessThanMigrationTo}`);
-      console.log(`  current ${toVersion} >= migration.to ${migration.toVersion}: ${currentGreaterThanOrEqualMigrationTo}`);
-      const shouldRun = storedLessThanMigrationTo && currentGreaterThanOrEqualMigrationTo;
-      console.log(`  Should run: ${shouldRun}`);
-      return shouldRun;
-    });
-  }
-  /**
-   * Simple semantic version comparison (major.minor only, ignoring beta/prerelease)
-   * Returns: -1 if a < b, 0 if a === b, 1 if a > b
-   */
-  compareVersions(a, b) {
-    const aMajorMinor = this.extractMajorMinor(a);
-    const bMajorMinor = this.extractMajorMinor(b);
-    if (aMajorMinor.major !== bMajorMinor.major) {
-      return aMajorMinor.major - bMajorMinor.major;
-    }
-    return aMajorMinor.minor - bMajorMinor.minor;
-  }
-  /**
-   * Extract major.minor from version string, ignoring beta/prerelease
-   * Examples: "0.7.0-beta.1" -> {major: 0, minor: 7}
-   *           "1.2.3" -> {major: 1, minor: 2}
-   */
-  extractMajorMinor(version2) {
-    const cleanVersion = version2.split("-")[0]?.split("+")[0] || version2;
-    const parts = cleanVersion.split(".").map(Number);
-    return {
-      major: parts[0] || 0,
-      minor: parts[1] || 0
-    };
-  }
-  /**
-   * Add a migration to the updater
-   */
-  addMigration(migration) {
-    this.migrations.push(migration);
-    this.migrations.sort((a, b) => this.compareVersions(a.fromVersion, b.fromVersion));
-  }
-};
-function createVersionUpdater(storage, currentVersion, migrations = []) {
-  return new VersionUpdater(storage, currentVersion, migrations);
-}
-
-// src/updater/updateMigrations.ts
-var addMigrationTimestamp = {
-  fromVersion: "0.6.0",
-  toVersion: "0.7.0",
-  async migrate(storage) {
-    console.log("Running test migration");
-    storage.set("test_migration", "true");
-  }
-};
-function getMigrations() {
-  return [
-    addMigrationTimestamp
-  ];
-}
+// src/core/auth/AuthManager.ts
+var import_jwt_decode = require("jwt-decode");
 
 // src/utils/storage.ts
 var LocalStorageAdapter = class {
@@ -803,44 +766,95 @@ var STORAGE_KEYS = {
   AUTH_STATE: "basic_auth_state",
   REDIRECT_URI: "basic_redirect_uri",
   SERVER_URL: "basic_server_url",
-  DEBUG: "basic_debug"
+  PDS_ENDPOINTS: "basic_pds_endpoints",
+  LAST_CONNECT_REPORT: "basic_last_connect_report",
+  DEBUG: "basic_debug",
+  CODE_VERIFIER: "basic_code_verifier"
 };
-function getCookie(name) {
-  let cookieValue = "";
-  if (document.cookie && document.cookie !== "") {
-    const cookies = document.cookie.split(";");
-    for (let i = 0; i < cookies.length; i++) {
-      const cookie = cookies[i]?.trim();
-      if (cookie && cookie.substring(0, name.length + 1) === name + "=") {
-        cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
-        break;
-      }
-    }
+
+// src/utils/normalizeClientId.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function normalizeClientId(projectId, adminHostname = "api.basic.tech") {
+  if (!projectId) return projectId;
+  if (projectId === "self") return projectId;
+  if (projectId.startsWith("did:")) return projectId;
+  if (UUID_RE.test(projectId)) {
+    const hex = projectId.replace(/-/g, "").toLowerCase();
+    return `did:web:${adminHostname}:projects:${hex}`;
+  }
+  return projectId;
+}
+
+// src/utils/resolveDid.ts
+function resolveDidWebUrl(did) {
+  if (!did.startsWith("did:web:")) return null;
+  const rest = did.slice(8);
+  if (!rest) return null;
+  const parts = rest.split(":");
+  const hostname = parts[0].replace(/%3A/gi, ":");
+  if (parts.length === 1) {
+    return `https://${hostname}/.well-known/did.json`;
   }
-  return cookieValue;
+  const pathParts = parts.slice(1).map((p) => decodeURIComponent(p));
+  return `https://${hostname}/${pathParts.join("/")}/did.json`;
 }
-function setCookie(name, value, options) {
-  const opts = {
-    secure: true,
-    sameSite: "Strict",
-    httpOnly: false,
-    ...options
+async function resolveFromDocument(did, didDocument) {
+  const services = didDocument.service;
+  const pdsService = services?.find(
+    (s) => s.id === "#basic_pds" || s.id === `${did}#basic_pds`
+  );
+  if (!pdsService) {
+    throw new Error(`DID document has no #basic_pds service entry`);
+  }
+  const pdsUrl = pdsService.serviceEndpoint.replace(/\/+$/, "");
+  const oauthRes = await fetch(`${pdsUrl}/auth/.well-known/openid-configuration`);
+  if (!oauthRes.ok) {
+    throw new Error(`Failed to fetch OpenID configuration from ${pdsUrl}: ${oauthRes.status}`);
+  }
+  const oauth = await oauthRes.json();
+  return {
+    did,
+    didDocument,
+    pdsUrl,
+    authorization_endpoint: oauth.authorization_endpoint,
+    token_endpoint: oauth.token_endpoint,
+    userinfo_endpoint: oauth.userinfo_endpoint
   };
-  let cookieString = `${name}=${value}`;
-  if (opts.secure)
-    cookieString += "; Secure";
-  if (opts.sameSite)
-    cookieString += `; SameSite=${opts.sameSite}`;
-  if (opts.httpOnly)
-    cookieString += "; HttpOnly";
-  document.cookie = cookieString;
 }
-function clearCookie(name) {
-  document.cookie = `${name}=; Secure; SameSite=Strict`;
+async function resolveDid(did) {
+  const url = resolveDidWebUrl(did);
+  if (!url) {
+    throw new Error(`Unsupported DID method: ${did}`);
+  }
+  const didRes = await fetch(url);
+  if (!didRes.ok) {
+    throw new Error(`Failed to fetch DID document at ${url}: ${didRes.status}`);
+  }
+  const didDocument = await didRes.json();
+  return resolveFromDocument(did, didDocument);
+}
+async function resolveHandle(handle) {
+  const res = await fetch(`https://${handle}/.well-known/did.json`);
+  if (!res.ok) {
+    throw new Error(`Handle resolution failed for ${handle}: ${res.status}`);
+  }
+  const didDocument = await res.json();
+  const did = didDocument.id;
+  if (!did) {
+    throw new Error(`Handle response has no 'id' field`);
+  }
+  const resolved = await resolveFromDocument(did, didDocument);
+  resolved.handle = handle;
+  return resolved;
 }
 
 // src/utils/network.ts
 init_config();
+
+// package.json
+var version = "0.8.0-beta.1";
+
+// src/utils/network.ts
 function isDevelopment(debug) {
   return window.location.hostname === "localhost" || window.location.hostname === "127.0.0.1" || window.location.hostname.includes("localhost") || window.location.hostname.includes("127.0.0.1") || window.location.hostname.includes(".local") || process.env.NODE_ENV === "development" || debug === true;
 }
@@ -902,81 +916,905 @@ function getSyncStatus(statusCode) {
   }
 }
 
-// src/utils/schema.ts
-var import_schema3 = require("@basictech/schema");
+// src/core/auth/AuthManager.ts
 init_config();
-async function getSchemaStatus(schema) {
-  const projectId = schema.project_id;
-  const valid = (0, import_schema3.validateSchema)(schema);
-  if (!valid.valid) {
-    console.warn("BasicDB Error: your local schema is invalid. Please fix errors and try again - sync is disabled");
-    return {
-      valid: false,
-      status: "invalid",
-      latest: null
-    };
+function generateCodeVerifier() {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  return base64UrlEncode(array);
+}
+async function generateCodeChallenge(verifier) {
+  if (typeof crypto === "undefined" || !crypto.subtle) {
+    log("crypto.subtle unavailable (non-secure context?) -- falling back to plain PKCE challenge");
+    return { challenge: verifier, method: "plain" };
   }
-  const latestSchema = await fetch(`https://api.basic.tech/project/${projectId}/schema`).then((res) => res.json()).then((data) => data.data[0].schema).catch((err) => {
-    return {
-      valid: false,
-      status: "error",
-      latest: null
-    };
-  });
-  console.log("latestSchema", latestSchema);
-  if (!latestSchema.version) {
-    return {
-      valid: false,
-      status: "error",
-      latest: null
-    };
+  const encoder = new TextEncoder();
+  const data = encoder.encode(verifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return { challenge: base64UrlEncode(new Uint8Array(digest)), method: "S256" };
+}
+function base64UrlEncode(buffer) {
+  let str = "";
+  for (let i = 0; i < buffer.length; i++) {
+    str += String.fromCharCode(buffer[i]);
   }
-  if (latestSchema.version > schema.version) {
-    console.warn("BasicDB Error: your local schema version is behind the latest. Found version:", schema.version, "but expected", latestSchema.version, " - sync is disabled");
-    return {
-      valid: false,
-      status: "behind",
-      latest: latestSchema
-    };
-  } else if (latestSchema.version < schema.version) {
-    console.warn("BasicDB Error: your local schema version is ahead of the latest. Found version:", schema.version, "but expected", latestSchema.version, " - sync is disabled");
-    return {
-      valid: false,
-      status: "ahead",
-      latest: latestSchema
-    };
-  } else if (latestSchema.version === schema.version) {
-    const changes = (0, import_schema3.compareSchemas)(schema, latestSchema);
-    if (changes.valid) {
-      return {
-        valid: true,
-        status: "current",
-        latest: latestSchema
-      };
-    } else {
-      console.warn("BasicDB Error: your local schema is conflicting with the latest. Your version:", schema.version, "does not match origin version", latestSchema.version, " - sync is disabled");
-      return {
-        valid: false,
-        status: "conflict",
-        latest: latestSchema
+  return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+var AuthManager = class {
+  // --- Public state (read by the UI layer) ---
+  token = null;
+  user = null;
+  isSignedIn = false;
+  isAuthReady = false;
+  did = null;
+  /** Space-separated scopes granted in the current access token */
+  tokenScope = null;
+  /** Space-separated scopes originally requested in the auth config */
+  requestedScopes;
+  config;
+  storage;
+  /** True only during a user-initiated OAuth code exchange (not session restore) */
+  freshSignIn = false;
+  // --- Private ---
+  notify;
+  refreshPromise = null;
+  codeExchangePromise = null;
+  pendingRefresh = false;
+  isOnline = typeof navigator !== "undefined" ? navigator.onLine : true;
+  channel = null;
+  constructor(config, storage, notify) {
+    this.config = config;
+    this.storage = storage;
+    this.notify = notify;
+    this.requestedScopes = config.scopes;
+    this.initCrossTabSync();
+  }
+  initCrossTabSync() {
+    if (typeof BroadcastChannel === "undefined") return;
+    try {
+      this.channel = new BroadcastChannel("basic-auth");
+      this.channel.onmessage = (event) => {
+        if (event.data?.type === "token_refreshed") {
+          log("Received token refresh from another tab");
+          if (event.data.accessToken && this.token) {
+            this.token = { ...this.token, access_token: event.data.accessToken };
+          }
+          if (event.data.did) this.did = event.data.did;
+          if (event.data.tokenScope) this.tokenScope = event.data.tokenScope;
+          this.notify();
+        }
+        if (event.data?.type === "signed_in") {
+          log("Received sign-in from another tab, reloading");
+          if (typeof window !== "undefined") {
+            window.location.reload();
+          }
+        }
+        if (event.data?.type === "signed_out") {
+          log("Received sign-out from another tab, reloading");
+          this.user = null;
+          this.isSignedIn = false;
+          this.token = null;
+          this.did = null;
+          this.tokenScope = null;
+          this.notify();
+          if (typeof window !== "undefined") {
+            window.location.reload();
+          }
+        }
       };
+    } catch {
+      log("BroadcastChannel not available for cross-tab sync");
     }
-  } else {
-    return {
-      valid: false,
-      status: "error",
-      latest: null
-    };
   }
-}
-async function validateAndCheckSchema(schema) {
-  const valid = (0, import_schema3.validateSchema)(schema);
-  if (!valid.valid) {
-    log("Basic Schema is invalid!", valid.errors);
-    console.group("Schema Errors");
-    let errorMessage = "";
-    valid.errors.forEach((error, index) => {
-      log(`${index + 1}:`, error.message, ` - at ${error.instancePath}`);
+  broadcastTokenRefresh() {
+    this.channel?.postMessage({
+      type: "token_refreshed",
+      accessToken: this.token?.access_token,
+      did: this.did,
+      tokenScope: this.tokenScope
+    });
+  }
+  broadcastSignIn() {
+    this.channel?.postMessage({ type: "signed_in" });
+  }
+  broadcastSignOut() {
+    this.channel?.postMessage({ type: "signed_out" });
+  }
+  // ------------------------------------------------------------------
+  // Public API
+  // ------------------------------------------------------------------
+  /**
+   * Bootstrap auth: handle OAuth callback (?code=), restore session
+   * from refresh token, or load cached user for offline mode.
+   */
+  async initialize() {
+    await this.storage.set(STORAGE_KEYS.DEBUG, this.config.debug ? "true" : "false");
+    const storedServerUrl = await this.storage.get(STORAGE_KEYS.SERVER_URL);
+    if (storedServerUrl && storedServerUrl !== this.config.pdsUrl) {
+      log("PDS URL changed, clearing stored tokens");
+      await this.clearStoredAuth();
+    }
+    await this.storage.set(STORAGE_KEYS.SERVER_URL, this.config.pdsUrl);
+    try {
+      const params = new URLSearchParams(window.location.search);
+      if (params.has("code")) {
+        const code = params.get("code");
+        if (!code) {
+          this.isAuthReady = true;
+          this.notify();
+          return;
+        }
+        const state = await this.storage.get(STORAGE_KEYS.AUTH_STATE);
+        const urlState = params.get("state");
+        if (!state || state !== urlState) {
+          log("error: auth state does not match");
+          this.isAuthReady = true;
+          this.notify();
+          await this.storage.remove(STORAGE_KEYS.AUTH_STATE);
+          cleanOAuthParamsFromUrl();
+          return;
+        }
+        await this.storage.remove(STORAGE_KEYS.AUTH_STATE);
+        cleanOAuthParamsFromUrl();
+        this.freshSignIn = true;
+        this.exchangeToken(code, false).catch((error) => {
+          log("Error fetching token:", error);
+        });
+      } else {
+        const refreshToken = await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);
+        if (refreshToken) {
+          log("Found refresh token in storage, attempting to refresh access token");
+          this.exchangeToken(refreshToken, true).catch((error) => {
+            log("Error fetching refresh token:", error);
+          });
+        } else {
+          const cachedUserInfo = await this.storage.get(STORAGE_KEYS.USER_INFO);
+          if (cachedUserInfo) {
+            try {
+              this.user = JSON.parse(cachedUserInfo);
+              this.isSignedIn = true;
+              log("Loaded cached user info for offline mode");
+            } catch (error) {
+              log("Error parsing cached user info:", error);
+            }
+          }
+          this.isAuthReady = true;
+          this.notify();
+        }
+      }
+    } catch (e) {
+      log("error getting token", e);
+    }
+  }
+  /**
+   * Get a valid access token string. Refreshes proactively (5s buffer)
+   * or on demand (forceRefresh). Mutex prevents concurrent refreshes.
+   */
+  async getToken(options) {
+    log("getting token...");
+    if (!this.token) {
+      const refreshToken = await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);
+      if (refreshToken) {
+        log("No token in memory, attempting to refresh from storage");
+        if (this.refreshPromise) {
+          log("Token refresh already in progress, waiting...");
+          try {
+            const newToken = await this.refreshPromise;
+            if (newToken?.access_token) {
+              return newToken.access_token;
+            }
+          } catch (error) {
+            log("In-flight refresh failed:", error);
+            throw error;
+          }
+        }
+        try {
+          const newToken = await this.exchangeToken(refreshToken, true);
+          if (newToken?.access_token) {
+            return newToken.access_token;
+          }
+        } catch (error) {
+          log("Failed to refresh token from storage:", error);
+          if (this.isNetworkError(error)) {
+            throw new Error("Network offline - authentication will be retried when online");
+          }
+          throw new Error("Authentication expired. Please sign in again.");
+        }
+      }
+      log("no token found");
+      throw new Error("no token found");
+    }
+    const decoded = (0, import_jwt_decode.jwtDecode)(this.token.access_token);
+    const expirationBuffer = 5;
+    const isExpired = decoded.exp && decoded.exp < Date.now() / 1e3 + expirationBuffer;
+    const shouldRefresh = isExpired || options?.forceRefresh === true;
+    if (shouldRefresh) {
+      log(options?.forceRefresh ? "force refreshing token..." : "token is expired - refreshing ...");
+      if (this.refreshPromise) {
+        log("Token refresh already in progress, waiting...");
+        try {
+          const newToken = await this.refreshPromise;
+          return newToken?.access_token || "";
+        } catch (error) {
+          log("In-flight refresh failed:", error);
+          if (this.isNetworkError(error)) {
+            log("Network issue - using expired token until network is restored");
+            return this.token.access_token;
+          }
+          throw error;
+        }
+      }
+      const refreshToken = this.token.refresh_token || await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);
+      if (refreshToken) {
+        try {
+          const newToken = await this.exchangeToken(refreshToken, true);
+          return newToken?.access_token || "";
+        } catch (error) {
+          log("Failed to refresh expired token:", error);
+          if (this.isNetworkError(error)) {
+            log("Network issue - using expired token until network is restored");
+            return this.token.access_token;
+          }
+          throw new Error("Authentication expired. Please sign in again.");
+        }
+      } else {
+        throw new Error("no refresh token available");
+      }
+    }
+    return this.token.access_token || "";
+  }
+  async getSignInUrl(redirectUri, endpoints) {
+    log("getting sign in link...");
+    if (!this.config.projectId) {
+      throw new Error("Project ID is required to generate sign-in link");
+    }
+    const pdsEndpoints = endpoints || this.defaultPdsEndpoints();
+    await this.storage.set(STORAGE_KEYS.PDS_ENDPOINTS, JSON.stringify(pdsEndpoints));
+    const randomState = Math.random().toString(36).substring(6);
+    await this.storage.set(STORAGE_KEYS.AUTH_STATE, randomState);
+    const redirectUrl = redirectUri || window.location.href;
+    if (!redirectUrl || !redirectUrl.startsWith("http://") && !redirectUrl.startsWith("https://")) {
+      throw new Error("Invalid redirect URI provided");
+    }
+    await this.storage.set(STORAGE_KEYS.REDIRECT_URI, redirectUrl);
+    log("Stored redirect_uri for token exchange:", redirectUrl);
+    const codeVerifier = generateCodeVerifier();
+    const { challenge: codeChallenge, method: challengeMethod } = await generateCodeChallenge(codeVerifier);
+    await this.storage.set(STORAGE_KEYS.CODE_VERIFIER, codeVerifier);
+    let baseUrl = pdsEndpoints.authorization_endpoint;
+    baseUrl += `?client_id=${encodeURIComponent(normalizeClientId(this.config.projectId, this.adminHostname))}`;
+    baseUrl += `&redirect_uri=${encodeURIComponent(redirectUrl)}`;
+    baseUrl += `&response_type=code`;
+    baseUrl += `&scope=${encodeURIComponent(this.config.scopes)}`;
+    baseUrl += `&state=${randomState}`;
+    baseUrl += `&code_challenge=${encodeURIComponent(codeChallenge)}`;
+    baseUrl += `&code_challenge_method=${challengeMethod}`;
+    log("Generated sign-in link successfully with scopes:", this.config.scopes);
+    return baseUrl;
+  }
+  async signIn(redirectUri) {
+    log("signing in...");
+    if (!this.config.projectId) {
+      log("Error: project_id is required for sign-in");
+      throw new Error("Project ID is required for authentication");
+    }
+    const signInLink = await this.getSignInUrl(redirectUri);
+    log("Generated sign-in link:", signInLink);
+    try {
+      new URL(signInLink);
+    } catch {
+      log("Error: Invalid sign-in link generated");
+      throw new Error("Failed to generate valid sign-in URL");
+    }
+    window.location.href = signInLink;
+  }
+  async signInWithHandle(handle) {
+    log("signing in with handle:", handle);
+    if (!this.config.projectId) {
+      throw new Error("Project ID is required for authentication");
+    }
+    const resolved = await resolveHandle(handle);
+    log("Resolved handle to PDS:", resolved.pdsUrl);
+    const endpoints = {
+      pds_url: resolved.pdsUrl,
+      authorization_endpoint: resolved.authorization_endpoint,
+      token_endpoint: resolved.token_endpoint,
+      userinfo_endpoint: resolved.userinfo_endpoint
+    };
+    const signInLink = await this.getSignInUrl(void 0, endpoints);
+    log("Generated federated sign-in link:", signInLink);
+    try {
+      new URL(signInLink);
+    } catch {
+      throw new Error("Failed to generate valid sign-in URL");
+    }
+    window.location.href = signInLink;
+  }
+  async signInWithCode(code, state) {
+    try {
+      log("signInWithCode called with code:", code);
+      if (!code || typeof code !== "string") {
+        return { success: false, error: "Invalid authorization code" };
+      }
+      if (state) {
+        const storedState = await this.storage.get(STORAGE_KEYS.AUTH_STATE);
+        if (storedState && storedState !== state) {
+          log("State parameter mismatch:", { provided: state, stored: storedState });
+          return { success: false, error: "State parameter mismatch" };
+        }
+      }
+      await this.storage.remove(STORAGE_KEYS.AUTH_STATE);
+      cleanOAuthParamsFromUrl();
+      this.freshSignIn = true;
+      const token = await this.exchangeToken(code, false);
+      if (token) {
+        log("signInWithCode successful");
+        return { success: true };
+      } else {
+        return { success: false, error: "Failed to exchange code for token" };
+      }
+    } catch (error) {
+      log("signInWithCode error:", error);
+      return {
+        success: false,
+        error: error.message || "Authentication failed"
+      };
+    }
+  }
+  /**
+   * Clear auth state and storage. Does NOT handle sync/DB cleanup —
+   * the UI layer (BasicProvider) wraps this to add sync teardown.
+   */
+  async signOut() {
+    log("signing out!");
+    this.resetAuthState();
+    await this.storage.remove(STORAGE_KEYS.AUTH_STATE);
+    await this.storage.remove(STORAGE_KEYS.LAST_CONNECT_REPORT);
+    await this.clearStoredAuth();
+    this.broadcastSignOut();
+    this.notify();
+  }
+  hasScope(scope) {
+    if (!this.tokenScope) return false;
+    return this.tokenScope.split(/[\s,]+/).filter(Boolean).includes(scope);
+  }
+  /**
+   * Returns scopes that were requested but not granted in the current token.
+   * Useful after login or when a 403 is returned.
+   */
+  missingScopes() {
+    const requested = this.requestedScopes.split(/[\s,]+/).filter(Boolean);
+    if (!this.tokenScope) return requested;
+    const granted = new Set(this.tokenScope.split(/[\s,]+/).filter(Boolean));
+    return requested.filter((s) => !granted.has(s));
+  }
+  /**
+   * Register online/offline handlers that retry pending refreshes.
+   * Returns a cleanup function for useEffect teardown.
+   */
+  setupNetworkListeners() {
+    const handleOnline = async () => {
+      log("Network came back online");
+      this.isOnline = true;
+      if (this.pendingRefresh && this.token) {
+        log("Retrying pending token refresh");
+        this.pendingRefresh = false;
+        const refreshToken = this.token.refresh_token || await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);
+        if (refreshToken) {
+          this.exchangeToken(refreshToken, true).catch((error) => {
+            log("Retry refresh failed:", error);
+          });
+        }
+      }
+    };
+    const handleOffline = () => {
+      log("Network went offline");
+      this.isOnline = false;
+    };
+    window.addEventListener("online", handleOnline);
+    window.addEventListener("offline", handleOffline);
+    return () => {
+      window.removeEventListener("online", handleOnline);
+      window.removeEventListener("offline", handleOffline);
+    };
+  }
+  // ------------------------------------------------------------------
+  // Private
+  // ------------------------------------------------------------------
+  get adminHostname() {
+    try {
+      return new URL(this.config.adminUrl).hostname;
+    } catch {
+      return "api.basic.tech";
+    }
+  }
+  defaultPdsEndpoints() {
+    return {
+      pds_url: this.config.pdsUrl,
+      authorization_endpoint: `${this.config.pdsUrl}/auth/authorize`,
+      token_endpoint: `${this.config.pdsUrl}/auth/token`,
+      userinfo_endpoint: `${this.config.pdsUrl}/auth/userinfo`
+    };
+  }
+  async getActivePdsEndpoints() {
+    const stored = await this.storage.get(STORAGE_KEYS.PDS_ENDPOINTS);
+    if (stored) {
+      try {
+        return JSON.parse(stored);
+      } catch {
+      }
+    }
+    return this.defaultPdsEndpoints();
+  }
+  async reportConnection(accessToken) {
+    if (!this.config.projectId || !this.config.adminUrl) return;
+    const lastReport = await this.storage.get(STORAGE_KEYS.LAST_CONNECT_REPORT);
+    if (lastReport) {
+      const elapsed = Date.now() - parseInt(lastReport, 10);
+      if (elapsed < 24 * 60 * 60 * 1e3) return;
+    }
+    try {
+      await fetch(`${this.config.adminUrl}/project/${this.config.projectId}/user/connect`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ token: accessToken })
+      });
+      await this.storage.set(STORAGE_KEYS.LAST_CONNECT_REPORT, Date.now().toString());
+      log("Reported connection to admin server");
+    } catch (err) {
+      log("Failed to report connection (non-blocking):", err);
+    }
+  }
+  /**
+   * After a new token is stored, decode JWT claims and fetch user info.
+   */
+  async processNewToken() {
+    if (!this.token) {
+      this.isAuthReady = true;
+      this.notify();
+      return;
+    }
+    try {
+      const decoded = (0, import_jwt_decode.jwtDecode)(this.token.access_token);
+      if (decoded.sub) this.did = decoded.sub;
+      if (decoded.scope) this.tokenScope = decoded.scope;
+      const expirationBuffer = 5;
+      const isExpired = decoded.exp && decoded.exp < Date.now() / 1e3 + expirationBuffer;
+      if (isExpired) {
+        log("token is expired - refreshing ...");
+        const refreshToken = this.token.refresh_token;
+        if (!refreshToken) {
+          log("Error: No refresh token available for expired token");
+          this.isAuthReady = true;
+          this.notify();
+          return;
+        }
+        try {
+          const newToken = await this.exchangeToken(refreshToken, true);
+          await this.fetchUser(newToken?.access_token || "");
+        } catch (error) {
+          log("Failed to refresh token in processNewToken:", error);
+          if (this.isNetworkError(error)) {
+            log("Network issue - continuing with expired token until online");
+            await this.fetchUser(this.token.access_token);
+          } else {
+            this.isAuthReady = true;
+            this.notify();
+          }
+        }
+      } else {
+        await this.fetchUser(this.token.access_token);
+      }
+    } catch (error) {
+      log("Error processing token:", error);
+      this.isAuthReady = true;
+      this.notify();
+    }
+  }
+  async fetchUser(accessToken) {
+    log("fetching user");
+    try {
+      const endpoints = await this.getActivePdsEndpoints();
+      const response = await fetch(endpoints.userinfo_endpoint, {
+        method: "GET",
+        headers: { "Authorization": `Bearer ${accessToken}` }
+      });
+      if (!response.ok) {
+        throw new Error(`Failed to fetch user info: ${response.status}`);
+      }
+      const user = await response.json();
+      if (user.error) {
+        log("error fetching user", user.error);
+        throw new Error(`User info error: ${user.error}`);
+      }
+      if (this.token?.refresh_token) {
+        await this.storage.set(STORAGE_KEYS.REFRESH_TOKEN, this.token.refresh_token);
+      }
+      await this.storage.set(STORAGE_KEYS.USER_INFO, JSON.stringify(user));
+      log("Cached user info in storage");
+      this.user = user;
+      this.isSignedIn = true;
+      this.isAuthReady = true;
+      if (this.freshSignIn) {
+        this.freshSignIn = false;
+        this.broadcastSignIn();
+      } else {
+        this.broadcastTokenRefresh();
+      }
+      this.notify();
+    } catch (error) {
+      log("Failed to fetch user info:", error);
+      this.isAuthReady = true;
+      this.notify();
+    }
+  }
+  /**
+   * Exchange an auth code or refresh token for an access token.
+   * Handles mutex (one in-flight refresh), token validation, and
+   * triggers processNewToken on success.
+   */
+  async exchangeToken(codeOrRefreshToken, isRefreshToken) {
+    if (!codeOrRefreshToken || codeOrRefreshToken.trim() === "") {
+      const errorMsg = isRefreshToken ? "Refresh token is empty or undefined" : "Authorization code is empty or undefined";
+      log("Error:", errorMsg);
+      throw new Error(errorMsg);
+    }
+    if (isRefreshToken && this.refreshPromise) {
+      log("Reusing in-flight refresh token request");
+      return this.refreshPromise;
+    }
+    if (!isRefreshToken && this.codeExchangePromise) {
+      log("Reusing in-flight code exchange request");
+      return this.codeExchangePromise;
+    }
+    const tokenPromise = (async () => {
+      try {
+        if (!this.isOnline) {
+          log("Network is offline, marking refresh as pending");
+          this.pendingRefresh = true;
+          throw new Error("Network offline - refresh will be retried when online");
+        }
+        const endpoints = await this.getActivePdsEndpoints();
+        let requestBody;
+        if (isRefreshToken) {
+          requestBody = {
+            grant_type: "refresh_token",
+            refresh_token: codeOrRefreshToken
+          };
+          if (this.config.projectId) {
+            requestBody.client_id = normalizeClientId(this.config.projectId, this.adminHostname);
+          }
+        } else {
+          requestBody = {
+            grant_type: "authorization_code",
+            code: codeOrRefreshToken
+          };
+          const storedRedirectUri = await this.storage.get(STORAGE_KEYS.REDIRECT_URI);
+          if (storedRedirectUri) {
+            requestBody.redirect_uri = storedRedirectUri;
+            log("Including redirect_uri in token exchange:", storedRedirectUri);
+          } else {
+            log("Warning: No redirect_uri found in storage for token exchange");
+          }
+          const codeVerifier = await this.storage.get(STORAGE_KEYS.CODE_VERIFIER);
+          if (codeVerifier) {
+            requestBody.code_verifier = codeVerifier;
+          }
+          if (this.config.projectId) {
+            requestBody.client_id = normalizeClientId(this.config.projectId, this.adminHostname);
+          }
+        }
+        log("Token exchange request body:", {
+          ...requestBody,
+          ...isRefreshToken ? { refresh_token: "[REDACTED]" } : { code: "[REDACTED]" },
+          ...requestBody.code_verifier ? { code_verifier: "[REDACTED]" } : {}
+        });
+        const token = await fetch(endpoints.token_endpoint, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(requestBody)
+        }).then((response) => response.json()).catch((error) => {
+          log("Network error fetching token:", error);
+          if (!this.isOnline) {
+            this.pendingRefresh = true;
+            throw new Error("Network offline - refresh will be retried when online");
+          }
+          throw new Error("Network error during token refresh");
+        });
+        if (token.access_token) {
+          try {
+            const decoded = (0, import_jwt_decode.jwtDecode)(token.access_token);
+            if (decoded.typ === "refresh") {
+              log("Error: received refresh token as access token");
+              throw new Error("Invalid token: received refresh token instead of access token");
+            }
+          } catch (decodeError) {
+            if (decodeError.message.includes("Invalid token")) {
+              throw decodeError;
+            }
+            log("Warning: could not decode access token for type check:", decodeError);
+          }
+        }
+        if (token.error) {
+          log("error fetching token", token.error);
+          if (typeof token.error === "string" && (token.error.includes("network") || token.error.includes("timeout"))) {
+            this.pendingRefresh = true;
+            throw new Error("Network issue - refresh will be retried when online");
+          }
+          await this.clearStoredAuth();
+          this.resetAuthState();
+          this.notify();
+          throw new Error(`Token refresh failed: ${token.error}`);
+        } else {
+          this.token = token;
+          this.pendingRefresh = false;
+          if (token.refresh_token) {
+            await this.storage.set(STORAGE_KEYS.REFRESH_TOKEN, token.refresh_token);
+            log("Updated refresh token in storage");
+          }
+          if (!isRefreshToken) {
+            await this.storage.remove(STORAGE_KEYS.REDIRECT_URI);
+            await this.storage.remove(STORAGE_KEYS.CODE_VERIFIER);
+            log("Cleaned up redirect_uri and code_verifier from storage after successful exchange");
+          }
+          this.reportConnection(token.access_token).catch(() => {
+          });
+          await this.processNewToken();
+        }
+        return token;
+      } catch (error) {
+        log("Token refresh error:", error);
+        if (!this.isNetworkError(error)) {
+          await this.clearStoredAuth();
+          this.resetAuthState();
+          this.notify();
+        }
+        throw error;
+      }
+    })();
+    if (isRefreshToken) {
+      this.refreshPromise = tokenPromise;
+      tokenPromise.finally(() => {
+        if (this.refreshPromise === tokenPromise) {
+          this.refreshPromise = null;
+          log("Cleared refresh promise reference");
+        }
+      });
+    } else {
+      this.codeExchangePromise = tokenPromise;
+      tokenPromise.finally(() => {
+        if (this.codeExchangePromise === tokenPromise) {
+          this.codeExchangePromise = null;
+          log("Cleared code exchange promise reference");
+        }
+      });
+    }
+    return tokenPromise;
+  }
+  resetAuthState() {
+    this.user = null;
+    this.isSignedIn = false;
+    this.token = null;
+    this.did = null;
+    this.tokenScope = null;
+    this.isAuthReady = true;
+  }
+  async clearStoredAuth() {
+    await this.storage.remove(STORAGE_KEYS.REFRESH_TOKEN);
+    await this.storage.remove(STORAGE_KEYS.USER_INFO);
+    await this.storage.remove(STORAGE_KEYS.REDIRECT_URI);
+    await this.storage.remove(STORAGE_KEYS.CODE_VERIFIER);
+    await this.storage.remove(STORAGE_KEYS.SERVER_URL);
+    await this.storage.remove(STORAGE_KEYS.PDS_ENDPOINTS);
+  }
+  isNetworkError(error) {
+    if (error instanceof Error) {
+      return error.message.includes("offline") || error.message.includes("Network");
+    }
+    return false;
+  }
+};
+
+// src/AuthContext.tsx
+init_config();
+
+// src/updater/versionUpdater.ts
+init_config();
+var VersionUpdater = class {
+  storage;
+  currentVersion;
+  migrations;
+  versionKey = "basic_app_version";
+  constructor(storage, currentVersion, migrations = []) {
+    this.storage = storage;
+    this.currentVersion = currentVersion;
+    this.migrations = migrations.sort((a, b) => this.compareVersions(a.fromVersion, b.fromVersion));
+  }
+  /**
+   * Check current stored version and run migrations if needed
+   * Only compares major.minor versions, ignoring beta/prerelease parts
+   * Example: "0.7.0-beta.1" and "0.7.0" are treated as the same version
+   */
+  async checkAndUpdate() {
+    const storedVersion = await this.getStoredVersion();
+    if (!storedVersion) {
+      await this.setStoredVersion(this.currentVersion);
+      return { updated: false, toVersion: this.currentVersion };
+    }
+    if (storedVersion === this.currentVersion) {
+      return { updated: false, toVersion: this.currentVersion };
+    }
+    const migrationsToRun = this.getMigrationsToRun(storedVersion, this.currentVersion);
+    if (migrationsToRun.length === 0) {
+      await this.setStoredVersion(this.currentVersion);
+      return { updated: true, fromVersion: storedVersion, toVersion: this.currentVersion };
+    }
+    for (const migration of migrationsToRun) {
+      try {
+        log(`Running migration from ${migration.fromVersion} to ${migration.toVersion}`);
+        await migration.migrate(this.storage);
+      } catch (error) {
+        console.error(`Migration failed from ${migration.fromVersion} to ${migration.toVersion}:`, error);
+        throw new Error(`Migration failed: ${error}`);
+      }
+    }
+    await this.setStoredVersion(this.currentVersion);
+    return { updated: true, fromVersion: storedVersion, toVersion: this.currentVersion };
+  }
+  async getStoredVersion() {
+    try {
+      const versionData = await this.storage.get(this.versionKey);
+      if (!versionData) return null;
+      const versionInfo = JSON.parse(versionData);
+      return versionInfo.version;
+    } catch (error) {
+      console.warn("Failed to get stored version:", error);
+      return null;
+    }
+  }
+  async setStoredVersion(version2) {
+    const versionInfo = {
+      version: version2,
+      lastUpdated: Date.now()
+    };
+    await this.storage.set(this.versionKey, JSON.stringify(versionInfo));
+  }
+  getMigrationsToRun(fromVersion, toVersion) {
+    return this.migrations.filter((migration) => {
+      const storedLessThanMigrationTo = this.compareVersions(fromVersion, migration.toVersion) < 0;
+      const currentGreaterThanOrEqualMigrationTo = this.compareVersions(toVersion, migration.toVersion) >= 0;
+      const shouldRun = storedLessThanMigrationTo && currentGreaterThanOrEqualMigrationTo;
+      log(`Migration ${migration.fromVersion} \u2192 ${migration.toVersion}: shouldRun=${shouldRun}`);
+      return shouldRun;
+    });
+  }
+  /**
+   * Simple semantic version comparison (major.minor only, ignoring beta/prerelease)
+   * Returns: -1 if a < b, 0 if a === b, 1 if a > b
+   */
+  compareVersions(a, b) {
+    const aMajorMinor = this.extractMajorMinor(a);
+    const bMajorMinor = this.extractMajorMinor(b);
+    if (aMajorMinor.major !== bMajorMinor.major) {
+      return aMajorMinor.major - bMajorMinor.major;
+    }
+    return aMajorMinor.minor - bMajorMinor.minor;
+  }
+  /**
+   * Extract major.minor from version string, ignoring beta/prerelease
+   * Examples: "0.7.0-beta.1" -> {major: 0, minor: 7}
+   *           "1.2.3" -> {major: 1, minor: 2}
+   */
+  extractMajorMinor(version2) {
+    const cleanVersion = version2.split("-")[0]?.split("+")[0] || version2;
+    const parts = cleanVersion.split(".").map(Number);
+    return {
+      major: parts[0] || 0,
+      minor: parts[1] || 0
+    };
+  }
+  /**
+   * Add a migration to the updater
+   */
+  addMigration(migration) {
+    this.migrations.push(migration);
+    this.migrations.sort((a, b) => this.compareVersions(a.fromVersion, b.fromVersion));
+  }
+};
+function createVersionUpdater(storage, currentVersion, migrations = []) {
+  return new VersionUpdater(storage, currentVersion, migrations);
+}
+
+// src/updater/updateMigrations.ts
+init_config();
+var addMigrationTimestamp = {
+  fromVersion: "0.6.0",
+  toVersion: "0.7.0",
+  async migrate(storage) {
+    log("Running migration 0.6.0 \u2192 0.7.0");
+    storage.set("test_migration", "true");
+  }
+};
+function getMigrations() {
+  return [
+    addMigrationTimestamp
+  ];
+}
+
+// src/utils/schema.ts
+var import_schema3 = require("@basictech/schema");
+init_config();
+async function getSchemaStatus(schema) {
+  const projectId = schema.project_id;
+  const valid = (0, import_schema3.validateSchema)(schema);
+  if (!valid.valid) {
+    console.warn("BasicDB Error: your local schema is invalid. Please fix errors and try again - sync is disabled");
+    return {
+      valid: false,
+      status: "invalid",
+      latest: null
+    };
+  }
+  const latestSchema = await fetch(`https://api.basic.tech/project/${projectId}/schema`).then((res) => res.json()).then((data) => data.data[0].schema).catch((err) => {
+    return {
+      valid: false,
+      status: "error",
+      latest: null
+    };
+  });
+  if (!latestSchema.version) {
+    return {
+      valid: false,
+      status: "error",
+      latest: null
+    };
+  }
+  if (latestSchema.version > schema.version) {
+    console.warn("BasicDB Error: your local schema version is behind the latest. Found version:", schema.version, "but expected", latestSchema.version, " - sync is disabled");
+    return {
+      valid: false,
+      status: "behind",
+      latest: latestSchema
+    };
+  } else if (latestSchema.version < schema.version) {
+    console.warn("BasicDB Error: your local schema version is ahead of the latest. Found version:", schema.version, "but expected", latestSchema.version, " - sync is disabled");
+    return {
+      valid: false,
+      status: "ahead",
+      latest: latestSchema
+    };
+  } else if (latestSchema.version === schema.version) {
+    const changes = (0, import_schema3.compareSchemas)(schema, latestSchema);
+    if (changes.valid) {
+      return {
+        valid: true,
+        status: "current",
+        latest: latestSchema
+      };
+    } else {
+      console.warn("BasicDB Error: your local schema is conflicting with the latest. Your version:", schema.version, "does not match origin version", latestSchema.version, " - sync is disabled");
+      return {
+        valid: false,
+        status: "conflict",
+        latest: latestSchema
+      };
+    }
+  } else {
+    return {
+      valid: false,
+      status: "error",
+      latest: null
+    };
+  }
+}
+async function validateAndCheckSchema(schema) {
+  const valid = (0, import_schema3.validateSchema)(schema);
+  if (!valid.valid) {
+    log("Basic Schema is invalid!", valid.errors);
+    console.group("Schema Errors");
+    let errorMessage = "";
+    valid.errors.forEach((error, index) => {
+      log(`${index + 1}:`, error.message, ` - at ${error.instancePath}`);
       errorMessage += `${index + 1}: ${error.message} - at ${error.instancePath}
 `;
     });
@@ -992,6 +1830,7 @@ async function validateAndCheckSchema(schema) {
     schemaStatus = await getSchemaStatus(schema);
     log("schemaStatus", schemaStatus);
   } else {
+    schemaStatus = { valid: false, status: "unpublished" };
     log("schema not published - at version 0");
   }
   return {
@@ -1004,9 +1843,21 @@ async function validateAndCheckSchema(schema) {
 var import_jsx_runtime = require("react/jsx-runtime");
 var DEFAULT_AUTH_CONFIG = {
   scopes: "profile,email,app:admin",
-  server_url: "https://api.basic.tech",
+  pds_url: "https://pds.basic.id",
+  admin_url: "https://api.basic.tech",
   ws_url: "wss://pds.basic.id/ws"
 };
+var DBStatus = /* @__PURE__ */ ((DBStatus2) => {
+  DBStatus2["LOADING"] = "LOADING";
+  DBStatus2["OFFLINE"] = "OFFLINE";
+  DBStatus2["CONNECTING"] = "CONNECTING";
+  DBStatus2["ONLINE"] = "ONLINE";
+  DBStatus2["SYNCING"] = "SYNCING";
+  DBStatus2["ERROR"] = "ERROR";
+  DBStatus2["ERROR_WILL_RETRY"] = "ERROR_WILL_RETRY";
+  DBStatus2["ERROR_TOKEN_EXPIRED"] = "ERROR_TOKEN_EXPIRED";
+  return DBStatus2;
+})(DBStatus || {});
 var noDb = {
   collection: () => {
     throw new Error("no basicdb found - initialization failed. double check your schema.");
@@ -1017,12 +1868,17 @@ var BasicContext = (0, import_react.createContext)({
   isReady: false,
   isSignedIn: false,
   user: null,
+  did: null,
+  scope: null,
+  hasScope: () => false,
+  missingScopes: () => [],
   // Auth actions
   signIn: () => Promise.resolve(),
+  signInWithHandle: () => Promise.resolve(),
   signOut: () => Promise.resolve(),
   signInWithCode: () => Promise.resolve({ success: false }),
   // Token management
-  getToken: () => Promise.reject(new Error("no token")),
+  getToken: (_options) => Promise.reject(new Error("no token")),
   getSignInUrl: () => Promise.resolve(""),
   // DB access
   db: noDb,
@@ -1035,6 +1891,16 @@ var BasicContext = (0, import_react.createContext)({
   signinWithCode: () => Promise.resolve({ success: false }),
   getSignInLink: () => Promise.resolve("")
 });
+function snapshotAuth(mgr) {
+  return {
+    isSignedIn: mgr.isSignedIn,
+    hasToken: !!mgr.token,
+    isAuthReady: mgr.isAuthReady,
+    user: mgr.user,
+    did: mgr.did,
+    tokenScope: mgr.tokenScope
+  };
+}
 function BasicProvider({
   children,
   project_id: project_id_prop,
@@ -1045,64 +1911,79 @@ function BasicProvider({
   dbMode = "sync"
 }) {
   const project_id = schema?.project_id || project_id_prop;
-  const [isAuthReady, setIsAuthReady] = (0, import_react.useState)(false);
-  const [isSignedIn, setIsSignedIn] = (0, import_react.useState)(false);
-  const [token, setToken] = (0, import_react.useState)(null);
-  const [user, setUser] = (0, import_react.useState)({});
-  const [shouldConnect, setShouldConnect] = (0, import_react.useState)(false);
-  const [isReady, setIsReady] = (0, import_react.useState)(false);
-  const [dbStatus, setDbStatus] = (0, import_react.useState)("OFFLINE" /* OFFLINE */);
-  const [error, setError] = (0, import_react.useState)(null);
-  const [isOnline, setIsOnline] = (0, import_react.useState)(navigator.onLine);
-  const [pendingRefresh, setPendingRefresh] = (0, import_react.useState)(false);
-  const syncRef = (0, import_react.useRef)(null);
-  const remoteDbRef = (0, import_react.useRef)(null);
-  const storageAdapter = storage || new LocalStorageAdapter();
+  if (auth?.server_url && !auth?.pds_url) {
+    log("Warning: auth.server_url is deprecated, use auth.pds_url instead");
+  }
   const authConfig = {
     scopes: auth?.scopes || DEFAULT_AUTH_CONFIG.scopes,
-    server_url: auth?.server_url || DEFAULT_AUTH_CONFIG.server_url,
+    pds_url: auth?.pds_url || auth?.server_url || DEFAULT_AUTH_CONFIG.pds_url,
+    admin_url: auth?.admin_url || DEFAULT_AUTH_CONFIG.admin_url,
     ws_url: auth?.ws_url || DEFAULT_AUTH_CONFIG.ws_url
   };
   const scopesString = Array.isArray(authConfig.scopes) ? authConfig.scopes.join(" ") : authConfig.scopes;
-  const refreshPromiseRef = (0, import_react.useRef)(null);
+  const storageRef = (0, import_react.useRef)(storage || new LocalStorageAdapter());
+  const storageAdapter = storageRef.current;
+  const [authState, setAuthState] = (0, import_react.useState)({
+    isSignedIn: false,
+    hasToken: false,
+    isAuthReady: false,
+    user: null,
+    did: null,
+    tokenScope: null
+  });
+  const authRef = (0, import_react.useRef)(null);
+  if (!authRef.current) {
+    authRef.current = new AuthManager(
+      {
+        projectId: project_id,
+        scopes: scopesString,
+        pdsUrl: authConfig.pds_url,
+        adminUrl: authConfig.admin_url,
+        debug
+      },
+      storageAdapter,
+      () => setAuthState(snapshotAuth(authRef.current))
+    );
+  }
+  const syncRef = (0, import_react.useRef)(null);
+  const remoteDbRef = (0, import_react.useRef)(null);
+  const [shouldConnect, setShouldConnect] = (0, import_react.useState)(false);
+  const [dbStatus, setDbStatus] = (0, import_react.useState)("OFFLINE" /* OFFLINE */);
+  const [isReady, setIsReady] = (0, import_react.useState)(false);
+  const [error, setError] = (0, import_react.useState)(null);
   const isDevMode = () => isDevelopment(debug);
-  const cleanOAuthParams = () => cleanOAuthParamsFromUrl();
   (0, import_react.useEffect)(() => {
-    const handleOnline = () => {
-      log("Network came back online");
-      setIsOnline(true);
-      if (pendingRefresh) {
-        log("Retrying pending token refresh");
-        setPendingRefresh(false);
-        if (token) {
-          const refreshToken = token.refresh_token || localStorage.getItem("basic_refresh_token");
-          if (refreshToken) {
-            fetchToken(refreshToken, true).catch((error2) => {
-              log("Retry refresh failed:", error2);
-            });
-          }
+    const runVersionUpdater = async () => {
+      try {
+        const versionUpdater = createVersionUpdater(storageAdapter, version, getMigrations());
+        const updateResult = await versionUpdater.checkAndUpdate();
+        if (updateResult.updated) {
+          log(`App updated from ${updateResult.fromVersion} to ${updateResult.toVersion}`);
+        } else {
+          log(`App version ${updateResult.toVersion} is current`);
         }
+      } catch (error2) {
+        log("Version update failed:", error2);
       }
     };
-    const handleOffline = () => {
-      log("Network went offline");
-      setIsOnline(false);
-    };
-    window.addEventListener("online", handleOnline);
-    window.addEventListener("offline", handleOffline);
-    return () => {
-      window.removeEventListener("online", handleOnline);
-      window.removeEventListener("offline", handleOffline);
-    };
-  }, [pendingRefresh, token]);
+    runVersionUpdater();
+    authRef.current.initialize();
+    return authRef.current.setupNetworkListeners();
+  }, []);
   (0, import_react.useEffect)(() => {
     async function initSyncDb(options) {
       if (!syncRef.current) {
         log("Initializing Basic Sync DB");
         await initDexieExtensions();
         syncRef.current = new BasicSync("basicdb", { schema });
-        syncRef.current.syncable.on("statusChanged", (status, url) => {
-          setDbStatus(getSyncStatus(status));
+        syncRef.current.syncable.on("statusChanged", (status) => {
+          const newStatus = getSyncStatus(status);
+          setDbStatus(newStatus);
+          if (newStatus === "ERROR_WILL_RETRY" /* ERROR_WILL_RETRY */) {
+            log("Sync entered ERROR_WILL_RETRY - proactively refreshing token");
+            authRef.current.getToken({ forceRefresh: true }).catch(() => {
+            });
+          }
         });
         if (options.shouldConnect) {
           setShouldConnect(true);
@@ -1125,14 +2006,14 @@ function BasicProvider({
         }
         log("Initializing Basic Remote DB");
         remoteDbRef.current = new RemoteDB({
-          serverUrl: authConfig.server_url,
+          serverUrl: authConfig.pds_url,
           projectId: project_id,
-          getToken,
+          getToken: (opts) => authRef.current.getToken(opts),
           schema,
           debug,
           onAuthError: (error2) => {
             log("RemoteDB auth error:", error2);
-            signout();
+            handleSignOut();
           }
         });
         setDbStatus("ONLINE" /* ONLINE */);
@@ -1163,7 +2044,11 @@ function BasicProvider({
         if (result.schemaStatus.valid) {
           await initSyncDb({ shouldConnect: true });
         } else {
-          log("Schema is invalid!", result.schemaStatus);
+          if (result.schemaStatus.status === "unpublished") {
+            log("Schema not published yet (version 0) - sync is disabled. Publish your schema to enable sync.");
+          } else {
+            log("Schema is invalid!", result.schemaStatus);
+          }
           await initSyncDb({ shouldConnect: false });
         }
       }
@@ -1180,220 +2065,33 @@ function BasicProvider({
     }
   }, []);
   (0, import_react.useEffect)(() => {
-    async function connectToDb() {
-      if (token && syncRef.current && isSignedIn && shouldConnect) {
-        const tok = await getToken();
-        if (!tok) {
-          log("no token found");
-          return;
-        }
-        log("connecting to db...");
-        syncRef.current?.connect({
-          access_token: tok,
-          ws_url: authConfig.ws_url
-        }).catch((e) => {
-          log("error connecting to db", e);
-        });
-      }
+    if (authState.hasToken && syncRef.current && authState.isSignedIn && shouldConnect) {
+      log("connecting to db...");
+      syncRef.current?.connect({
+        getToken: (opts) => authRef.current.getToken(opts),
+        ws_url: authConfig.ws_url
+      }).catch((e) => {
+        log("error connecting to db", e);
+      });
     }
-    connectToDb();
-  }, [isSignedIn, shouldConnect]);
-  (0, import_react.useEffect)(() => {
-    const initializeAuth = async () => {
-      await storageAdapter.set(STORAGE_KEYS.DEBUG, debug ? "true" : "false");
-      const storedServerUrl = await storageAdapter.get(STORAGE_KEYS.SERVER_URL);
-      if (storedServerUrl && storedServerUrl !== authConfig.server_url) {
-        log("Server URL changed, clearing stored tokens");
-        await storageAdapter.remove(STORAGE_KEYS.REFRESH_TOKEN);
-        await storageAdapter.remove(STORAGE_KEYS.USER_INFO);
-        await storageAdapter.remove(STORAGE_KEYS.AUTH_STATE);
-        await storageAdapter.remove(STORAGE_KEYS.REDIRECT_URI);
-        clearCookie("basic_token");
-        clearCookie("basic_access_token");
-      }
-      await storageAdapter.set(STORAGE_KEYS.SERVER_URL, authConfig.server_url);
-      try {
-        const versionUpdater = createVersionUpdater(storageAdapter, version, getMigrations());
-        const updateResult = await versionUpdater.checkAndUpdate();
-        if (updateResult.updated) {
-          log(`App updated from ${updateResult.fromVersion} to ${updateResult.toVersion}`);
-        } else {
-          log(`App version ${updateResult.toVersion} is current`);
-        }
-      } catch (error2) {
-        log("Version update failed:", error2);
-      }
-      try {
-        if (window.location.search.includes("code")) {
-          let code = window.location?.search?.split("code=")[1]?.split("&")[0];
-          if (!code)
-            return;
-          const state = await storageAdapter.get(STORAGE_KEYS.AUTH_STATE);
-          const urlState = window.location.search.split("state=")[1]?.split("&")[0];
-          if (!state || state !== urlState) {
-            log("error: auth state does not match");
-            setIsAuthReady(true);
-            await storageAdapter.remove(STORAGE_KEYS.AUTH_STATE);
-            cleanOAuthParams();
-            return;
-          }
-          await storageAdapter.remove(STORAGE_KEYS.AUTH_STATE);
-          cleanOAuthParams();
-          fetchToken(code, false).catch((error2) => {
-            log("Error fetching token:", error2);
-          });
-        } else {
-          const refreshToken = await storageAdapter.get(STORAGE_KEYS.REFRESH_TOKEN);
-          if (refreshToken) {
-            log("Found refresh token in storage, attempting to refresh access token");
-            fetchToken(refreshToken, true).catch((error2) => {
-              log("Error fetching refresh token:", error2);
-            });
-          } else {
-            let cookie_token = getCookie("basic_token");
-            if (cookie_token !== "") {
-              const tokenData = JSON.parse(cookie_token);
-              setToken(tokenData);
-              if (tokenData.refresh_token) {
-                await storageAdapter.set(STORAGE_KEYS.REFRESH_TOKEN, tokenData.refresh_token);
-              }
-            } else {
-              const cachedUserInfo = await storageAdapter.get(STORAGE_KEYS.USER_INFO);
-              if (cachedUserInfo) {
-                try {
-                  const userData = JSON.parse(cachedUserInfo);
-                  setUser(userData);
-                  setIsSignedIn(true);
-                  log("Loaded cached user info for offline mode");
-                } catch (error2) {
-                  log("Error parsing cached user info:", error2);
-                }
-              }
-              setIsAuthReady(true);
-            }
-          }
-        }
-      } catch (e) {
-        log("error getting token", e);
-      }
-    };
-    initializeAuth();
-  }, []);
-  (0, import_react.useEffect)(() => {
-    async function fetchUser(acc_token) {
-      console.info("fetching user");
+  }, [authState.isSignedIn, authState.hasToken, shouldConnect]);
+  const handleSignOut = async () => {
+    await authRef.current.signOut();
+    if (syncRef.current) {
       try {
-        const response = await fetch(`${authConfig.server_url}/auth/userInfo`, {
-          method: "GET",
-          headers: {
-            "Authorization": `Bearer ${acc_token}`
-          }
-        });
-        if (!response.ok) {
-          throw new Error(`Failed to fetch user info: ${response.status}`);
-        }
-        const user2 = await response.json();
-        if (user2.error) {
-          log("error fetching user", user2.error);
-          throw new Error(`User info error: ${user2.error}`);
-        }
-        if (token?.refresh_token) {
-          await storageAdapter.set(STORAGE_KEYS.REFRESH_TOKEN, token.refresh_token);
-        }
-        await storageAdapter.set(STORAGE_KEYS.USER_INFO, JSON.stringify(user2));
-        log("Cached user info in storage");
-        setCookie("basic_access_token", token?.access_token || "", { httpOnly: false });
-        setCookie("basic_token", JSON.stringify(token));
-        setUser(user2);
-        setIsSignedIn(true);
-        setIsAuthReady(true);
+        await syncRef.current.close();
+        await syncRef.current.delete({ disableAutoOpen: false });
+        syncRef.current = null;
+        window?.location?.reload();
       } catch (error2) {
-        log("Failed to fetch user info:", error2);
-        setIsAuthReady(true);
-      }
-    }
-    async function checkToken() {
-      if (!token) {
-        log("error: no user token found");
-        setIsAuthReady(true);
-        return;
-      }
-      const decoded = (0, import_jwt_decode.jwtDecode)(token?.access_token);
-      const expirationBuffer = 5;
-      const isExpired = decoded.exp && decoded.exp < Date.now() / 1e3 + expirationBuffer;
-      if (isExpired) {
-        log("token is expired - refreshing ...");
-        const refreshToken = token?.refresh_token;
-        if (!refreshToken) {
-          log("Error: No refresh token available for expired token");
-          setIsAuthReady(true);
-          return;
-        }
-        try {
-          const newToken = await fetchToken(refreshToken, true);
-          fetchUser(newToken?.access_token || "");
-        } catch (error2) {
-          log("Failed to refresh token in checkToken:", error2);
-          if (error2.message.includes("offline") || error2.message.includes("Network")) {
-            log("Network issue - continuing with expired token until online");
-            fetchUser(token?.access_token || "");
-          } else {
-            setIsAuthReady(true);
-          }
-        }
-      } else {
-        fetchUser(token?.access_token || "");
+        console.error("Error during database cleanup:", error2);
       }
     }
-    if (token) {
-      checkToken();
-    }
-  }, [token]);
-  const getSignInLink = async (redirectUri) => {
-    try {
-      log("getting sign in link...");
-      if (!project_id) {
-        throw new Error("Project ID is required to generate sign-in link");
-      }
-      const randomState = Math.random().toString(36).substring(6);
-      await storageAdapter.set(STORAGE_KEYS.AUTH_STATE, randomState);
-      const redirectUrl = redirectUri || window.location.href;
-      if (!redirectUrl || !redirectUrl.startsWith("http://") && !redirectUrl.startsWith("https://")) {
-        throw new Error("Invalid redirect URI provided");
-      }
-      await storageAdapter.set(STORAGE_KEYS.REDIRECT_URI, redirectUrl);
-      log("Stored redirect_uri for token exchange:", redirectUrl);
-      let baseUrl = `${authConfig.server_url}/auth/authorize`;
-      baseUrl += `?client_id=${project_id}`;
-      baseUrl += `&redirect_uri=${encodeURIComponent(redirectUrl)}`;
-      baseUrl += `&response_type=code`;
-      baseUrl += `&scope=${encodeURIComponent(scopesString)}`;
-      baseUrl += `&state=${randomState}`;
-      log("Generated sign-in link successfully with scopes:", scopesString);
-      return baseUrl;
-    } catch (error2) {
-      log("Error generating sign-in link:", error2);
-      throw error2;
-    }
   };
-  const signin = async () => {
+  const handleSignIn = async () => {
     try {
-      log("signing in...");
-      if (!project_id) {
-        log("Error: project_id is required for sign-in");
-        throw new Error("Project ID is required for authentication");
-      }
-      const signInLink = await getSignInLink();
-      log("Generated sign-in link:", signInLink);
-      try {
-        new URL(signInLink);
-      } catch {
-        log("Error: Invalid sign-in link generated");
-        throw new Error("Failed to generate valid sign-in URL");
-      }
-      window.location.href = signInLink;
+      await authRef.current.signIn();
     } catch (error2) {
-      log("Error during sign-in:", error2);
       if (isDevMode()) {
         setError({
           code: "signin_error",
@@ -1404,255 +2102,19 @@ function BasicProvider({
       throw error2;
     }
   };
-  const signinWithCode = async (code, state) => {
+  const handleSignInWithHandle = async (handle) => {
     try {
-      log("signinWithCode called with code:", code);
-      if (!code || typeof code !== "string") {
-        return { success: false, error: "Invalid authorization code" };
-      }
-      if (state) {
-        const storedState = await storageAdapter.get(STORAGE_KEYS.AUTH_STATE);
-        if (storedState && storedState !== state) {
-          log("State parameter mismatch:", { provided: state, stored: storedState });
-          return { success: false, error: "State parameter mismatch" };
-        }
-      }
-      await storageAdapter.remove(STORAGE_KEYS.AUTH_STATE);
-      cleanOAuthParams();
-      const token2 = await fetchToken(code, false);
-      if (token2) {
-        log("signinWithCode successful");
-        return { success: true };
-      } else {
-        return { success: false, error: "Failed to exchange code for token" };
-      }
+      await authRef.current.signInWithHandle(handle);
     } catch (error2) {
-      log("signinWithCode error:", error2);
-      return {
-        success: false,
-        error: error2.message || "Authentication failed"
-      };
-    }
-  };
-  const signout = async () => {
-    log("signing out!");
-    setUser({});
-    setIsSignedIn(false);
-    setToken(null);
-    clearCookie("basic_token");
-    clearCookie("basic_access_token");
-    await storageAdapter.remove(STORAGE_KEYS.AUTH_STATE);
-    await storageAdapter.remove(STORAGE_KEYS.REFRESH_TOKEN);
-    await storageAdapter.remove(STORAGE_KEYS.USER_INFO);
-    await storageAdapter.remove(STORAGE_KEYS.REDIRECT_URI);
-    await storageAdapter.remove(STORAGE_KEYS.SERVER_URL);
-    if (syncRef.current) {
-      (async () => {
-        try {
-          await syncRef.current?.close();
-          await syncRef.current?.delete({ disableAutoOpen: false });
-          syncRef.current = null;
-          window?.location?.reload();
-        } catch (error2) {
-          console.error("Error during database cleanup:", error2);
-        }
-      })();
-    }
-  };
-  const getToken = async () => {
-    log("getting token...");
-    if (!token) {
-      const refreshToken = await storageAdapter.get(STORAGE_KEYS.REFRESH_TOKEN);
-      if (refreshToken) {
-        log("No token in memory, attempting to refresh from storage");
-        if (refreshPromiseRef.current) {
-          log("Token refresh already in progress, waiting...");
-          try {
-            const newToken = await refreshPromiseRef.current;
-            if (newToken?.access_token) {
-              return newToken.access_token;
-            }
-          } catch (error2) {
-            log("In-flight refresh failed:", error2);
-            throw error2;
-          }
-        }
-        try {
-          const newToken = await fetchToken(refreshToken, true);
-          if (newToken?.access_token) {
-            return newToken.access_token;
-          }
-        } catch (error2) {
-          log("Failed to refresh token from storage:", error2);
-          if (error2.message.includes("offline") || error2.message.includes("Network")) {
-            log("Network issue - continuing with potentially expired token");
-            const lastToken = localStorage.getItem("basic_access_token");
-            if (lastToken) {
-              return lastToken;
-            }
-            throw new Error("Network offline - authentication will be retried when online");
-          }
-          throw new Error("Authentication expired. Please sign in again.");
-        }
-      }
-      log("no token found");
-      throw new Error("no token found");
-    }
-    const decoded = (0, import_jwt_decode.jwtDecode)(token?.access_token);
-    const expirationBuffer = 5;
-    const isExpired = decoded.exp && decoded.exp < Date.now() / 1e3 + expirationBuffer;
-    if (isExpired) {
-      log("token is expired - refreshing ...");
-      if (refreshPromiseRef.current) {
-        log("Token refresh already in progress, waiting...");
-        try {
-          const newToken = await refreshPromiseRef.current;
-          return newToken?.access_token || "";
-        } catch (error2) {
-          log("In-flight refresh failed:", error2);
-          if (error2.message.includes("offline") || error2.message.includes("Network")) {
-            log("Network issue - using expired token until network is restored");
-            return token.access_token;
-          }
-          throw error2;
-        }
-      }
-      const refreshToken = token?.refresh_token || await storageAdapter.get(STORAGE_KEYS.REFRESH_TOKEN);
-      if (refreshToken) {
-        try {
-          const newToken = await fetchToken(refreshToken, true);
-          return newToken?.access_token || "";
-        } catch (error2) {
-          log("Failed to refresh expired token:", error2);
-          if (error2.message.includes("offline") || error2.message.includes("Network")) {
-            log("Network issue - using expired token until network is restored");
-            return token.access_token;
-          }
-          throw new Error("Authentication expired. Please sign in again.");
-        }
-      } else {
-        throw new Error("no refresh token available");
-      }
-    }
-    return token?.access_token || "";
-  };
-  const fetchToken = async (codeOrRefreshToken, isRefreshToken = false) => {
-    if (!codeOrRefreshToken || codeOrRefreshToken.trim() === "") {
-      const errorMsg = isRefreshToken ? "Refresh token is empty or undefined" : "Authorization code is empty or undefined";
-      log("Error:", errorMsg);
-      throw new Error(errorMsg);
-    }
-    if (isRefreshToken && refreshPromiseRef.current) {
-      log("Reusing in-flight refresh token request");
-      return refreshPromiseRef.current;
-    }
-    const refreshPromise = (async () => {
-      try {
-        if (!isOnline) {
-          log("Network is offline, marking refresh as pending");
-          setPendingRefresh(true);
-          throw new Error("Network offline - refresh will be retried when online");
-        }
-        let requestBody;
-        if (isRefreshToken) {
-          requestBody = {
-            grant_type: "refresh_token",
-            refresh_token: codeOrRefreshToken
-          };
-          if (project_id) {
-            requestBody.client_id = project_id;
-          }
-        } else {
-          requestBody = {
-            grant_type: "authorization_code",
-            code: codeOrRefreshToken
-          };
-          const storedRedirectUri = await storageAdapter.get(STORAGE_KEYS.REDIRECT_URI);
-          if (storedRedirectUri) {
-            requestBody.redirect_uri = storedRedirectUri;
-            log("Including redirect_uri in token exchange:", storedRedirectUri);
-          } else {
-            log("Warning: No redirect_uri found in storage for token exchange");
-          }
-          if (project_id) {
-            requestBody.client_id = project_id;
-          }
-        }
-        log("Token exchange request body:", { ...requestBody, refresh_token: isRefreshToken ? "[REDACTED]" : void 0, code: !isRefreshToken ? "[REDACTED]" : void 0 });
-        const token2 = await fetch(`${authConfig.server_url}/auth/token`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json"
-          },
-          body: JSON.stringify(requestBody)
-        }).then((response) => response.json()).catch((error2) => {
-          log("Network error fetching token:", error2);
-          if (!isOnline) {
-            setPendingRefresh(true);
-            throw new Error("Network offline - refresh will be retried when online");
-          }
-          throw new Error("Network error during token refresh");
+      if (isDevMode()) {
+        setError({
+          code: "signin_error",
+          title: "Sign-in Failed",
+          message: error2.message || "An error occurred during sign-in. Please try again."
         });
-        if (token2.error) {
-          log("error fetching token", token2.error);
-          if (token2.error.includes("network") || token2.error.includes("timeout")) {
-            setPendingRefresh(true);
-            throw new Error("Network issue - refresh will be retried when online");
-          }
-          await storageAdapter.remove(STORAGE_KEYS.REFRESH_TOKEN);
-          await storageAdapter.remove(STORAGE_KEYS.USER_INFO);
-          await storageAdapter.remove(STORAGE_KEYS.REDIRECT_URI);
-          await storageAdapter.remove(STORAGE_KEYS.SERVER_URL);
-          clearCookie("basic_token");
-          clearCookie("basic_access_token");
-          setUser({});
-          setIsSignedIn(false);
-          setToken(null);
-          setIsAuthReady(true);
-          throw new Error(`Token refresh failed: ${token2.error}`);
-        } else {
-          setToken(token2);
-          setPendingRefresh(false);
-          if (token2.refresh_token) {
-            await storageAdapter.set(STORAGE_KEYS.REFRESH_TOKEN, token2.refresh_token);
-            log("Updated refresh token in storage");
-          }
-          if (!isRefreshToken) {
-            await storageAdapter.remove(STORAGE_KEYS.REDIRECT_URI);
-            log("Cleaned up redirect_uri from storage after successful exchange");
-          }
-          setCookie("basic_access_token", token2.access_token, { httpOnly: false });
-          setCookie("basic_token", JSON.stringify(token2));
-          log("Updated access token and full token in cookies");
-        }
-        return token2;
-      } catch (error2) {
-        log("Token refresh error:", error2);
-        if (!error2.message.includes("offline") && !error2.message.includes("Network")) {
-          await storageAdapter.remove(STORAGE_KEYS.REFRESH_TOKEN);
-          await storageAdapter.remove(STORAGE_KEYS.USER_INFO);
-          await storageAdapter.remove(STORAGE_KEYS.REDIRECT_URI);
-          await storageAdapter.remove(STORAGE_KEYS.SERVER_URL);
-          clearCookie("basic_token");
-          clearCookie("basic_access_token");
-          setUser({});
-          setIsSignedIn(false);
-          setToken(null);
-          setIsAuthReady(true);
-        }
-        throw error2;
       }
-    })();
-    if (isRefreshToken) {
-      refreshPromiseRef.current = refreshPromise;
-      refreshPromise.finally(() => {
-        if (refreshPromiseRef.current === refreshPromise) {
-          refreshPromiseRef.current = null;
-          log("Cleared refresh promise reference");
-        }
-      });
+      throw error2;
     }
-    return refreshPromise;
   };
   const getCurrentDb = () => {
     if (dbMode === "remote") {
@@ -1661,27 +2123,32 @@ function BasicProvider({
     return syncRef.current || noDb;
   };
   const contextValue = {
-    // Auth state (new naming)
-    isReady: isAuthReady,
-    isSignedIn,
-    user,
-    // Auth actions (new camelCase naming)
-    signIn: signin,
-    signOut: signout,
-    signInWithCode: signinWithCode,
+    // Auth state
+    isReady: authState.isAuthReady,
+    isSignedIn: authState.isSignedIn,
+    user: authState.user,
+    did: authState.did,
+    scope: authState.tokenScope,
+    hasScope: (scope) => authRef.current.hasScope(scope),
+    missingScopes: () => authRef.current.missingScopes(),
+    // Auth actions
+    signIn: handleSignIn,
+    signInWithHandle: handleSignInWithHandle,
+    signOut: handleSignOut,
+    signInWithCode: (code, state) => authRef.current.signInWithCode(code, state),
     // Token management
-    getToken,
-    getSignInUrl: getSignInLink,
+    getToken: (opts) => authRef.current.getToken(opts),
+    getSignInUrl: (redirectUri) => authRef.current.getSignInUrl(redirectUri),
     // DB access
     db: getCurrentDb(),
     dbStatus,
     dbMode,
     // Legacy aliases (deprecated)
-    isAuthReady,
-    signin,
-    signout,
-    signinWithCode,
-    getSignInLink
+    isAuthReady: authState.isAuthReady,
+    signin: handleSignIn,
+    signout: handleSignOut,
+    signinWithCode: (code, state) => authRef.current.signInWithCode(code, state),
+    getSignInLink: (redirectUri) => authRef.current.getSignInUrl(redirectUri)
   };
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(BasicContext.Provider, { value: contextValue, children: [
     error && isDevMode() && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ErrorDisplay, { error }),
@@ -1720,11 +2187,15 @@ var import_dexie_react_hooks = require("dexie-react-hooks");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   BasicProvider,
+  DBStatus,
   NotAuthenticatedError,
   RemoteCollection,
   RemoteDB,
   RemoteDBError,
   STORAGE_KEYS,
+  resolveDid,
+  resolveDidWebUrl,
+  resolveHandle,
   useBasic,
   useQuery
 });