@basictech/react 0.7.0 → 0.8.0-beta.2

package/dist/index.mjs

@@ -24,25 +24,53 @@ var init_config = __esm({
   }
 });
 
+// src/sync/tokenRegistry.ts
+function setTokenGetter(url, fn) {
+  registry.set(url, fn);
+}
+function getTokenGetter(url) {
+  return registry.get(url);
+}
+var registry;
+var init_tokenRegistry = __esm({
+  "src/sync/tokenRegistry.ts"() {
+    "use strict";
+    registry = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/sync/syncProtocol.js
 var syncProtocol_exports = {};
 __export(syncProtocol_exports, {
   syncProtocol: () => syncProtocol
 });
 import { Dexie } from "dexie";
+function decodeJwtExp(token) {
+  try {
+    var parts = token.split(".");
+    if (parts.length !== 3) return null;
+    var payload = JSON.parse(atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")));
+    return typeof payload.exp === "number" ? payload.exp : null;
+  } catch (_) {
+    return null;
+  }
+}
 var syncProtocol;
 var init_syncProtocol = __esm({
   "src/sync/syncProtocol.js"() {
     "use strict";
     "use client";
     init_config();
+    init_tokenRegistry();
     syncProtocol = function() {
       log("Initializing syncProtocol");
       var RECONNECT_DELAY = 5e3;
+      var TOKEN_REFRESH_BUFFER = 60;
       Dexie.Syncable.registerSyncProtocol("websocket", {
         sync: function(context, url, options, baseRevision, syncedRevision, changes, partial, applyRemoteChanges, onChangesAccepted, onSuccess, onError) {
           var requestId = 0;
           var acceptCallbacks = {};
+          var refreshTimer = null;
           log("Connecting to", url);
           var ws = new WebSocket(url);
           function sendChanges(changes2, baseRevision2, partial2, onChangesAccepted2) {
@@ -59,30 +87,71 @@ var init_syncProtocol = __esm({
               })
             );
           }
-          ws.onopen = function(event) {
-            log("Opening socket - sending clientIdentity", context.clientIdentity);
-            ws.send(
-              JSON.stringify({
-                type: "clientIdentity",
-                clientIdentity: context.clientIdentity || null,
-                authToken: options.authToken,
-                schema: options.schema
-              })
-            );
+          function clearRefreshTimer() {
+            if (refreshTimer) {
+              clearTimeout(refreshTimer);
+              refreshTimer = null;
+            }
+          }
+          function resolveGetToken() {
+            var fn = getTokenGetter(url);
+            if (!fn) throw new Error("No token getter registered for " + url);
+            return fn;
+          }
+          function scheduleTokenRefresh(tokenStr) {
+            clearRefreshTimer();
+            var exp = decodeJwtExp(tokenStr);
+            if (!exp) return;
+            var msUntilRefresh = (exp - TOKEN_REFRESH_BUFFER) * 1e3 - Date.now();
+            if (msUntilRefresh <= 0) return;
+            log("Scheduling proactive token refresh in", Math.round(msUntilRefresh / 1e3), "s");
+            refreshTimer = setTimeout(async function() {
+              try {
+                var newToken = await resolveGetToken()({ forceRefresh: true });
+                if (ws.readyState === WebSocket.OPEN) {
+                  log("Sending tokenUpdate on existing WebSocket");
+                  ws.send(JSON.stringify({ type: "tokenUpdate", authToken: newToken }));
+                  scheduleTokenRefresh(newToken);
+                }
+              } catch (err) {
+                log("Proactive token refresh failed (non-fatal):", err);
+              }
+            }, msUntilRefresh);
+          }
+          ws.onopen = async function(event) {
+            try {
+              var token = await resolveGetToken()();
+              log("Opening socket - sending clientIdentity", context.clientIdentity);
+              ws.send(
+                JSON.stringify({
+                  type: "clientIdentity",
+                  clientIdentity: context.clientIdentity || null,
+                  authToken: token,
+                  schema: options.schema
+                })
+              );
+              scheduleTokenRefresh(token);
+            } catch (err) {
+              log("Failed to get token for WebSocket:", err);
+              ws.close();
+              onError("Authentication failed: " + (err.message || err), RECONNECT_DELAY);
+            }
           };
           ws.onerror = function(event) {
+            clearRefreshTimer();
             ws.close();
             log("ws.onerror", event);
             onError(event?.message, RECONNECT_DELAY);
           };
           ws.onclose = function(event) {
+            clearRefreshTimer();
             onError("Socket closed: " + event.reason, RECONNECT_DELAY);
           };
           var isFirstRound = true;
           ws.onmessage = function(event) {
             try {
               var requestFromServer = JSON.parse(event.data);
-              log("requestFromServer", requestFromServer, { acceptCallback, isFirstRound });
+              log("requestFromServer", requestFromServer, { isFirstRound });
               if (requestFromServer.type == "clientIdentity") {
                 context.clientIdentity = requestFromServer.clientIdentity;
                 context.save();
@@ -110,8 +179,8 @@ var init_syncProtocol = __esm({
                         onChangesAccepted2
                       );
                     },
-                    // Specify a disconnect function that will close our socket so that we dont continue to monitor changes.
                     disconnect: function() {
+                      clearRefreshTimer();
                       ws.close();
                     }
                   });
@@ -123,9 +192,13 @@ var init_syncProtocol = __esm({
                 acceptCallback();
                 delete acceptCallbacks[requestId2.toString()];
               } else if (requestFromServer.type == "error") {
-                var requestId2 = requestFromServer.requestId;
                 ws.close();
-                onError(requestFromServer.message, Infinity);
+                if (requestFromServer.code === "TOKEN_EXPIRED" || requestFromServer.code === "UNAUTHORIZED") {
+                  log("Auth error from server, will reconnect with fresh token:", requestFromServer.message);
+                  onError(requestFromServer.message, RECONNECT_DELAY);
+                } else {
+                  onError(requestFromServer.message, Infinity);
+                }
               } else {
                 log("unknown message", requestFromServer);
                 ws.close();
@@ -143,24 +216,822 @@ var init_syncProtocol = __esm({
   }
 });
 
+// package.json
+var version;
+var init_package = __esm({
+  "package.json"() {
+    version = "0.8.0-beta.2";
+  }
+});
+
+// src/utils/network.ts
+import semver from "semver";
+function isDevelopment(debug) {
+  if (debug === true) return true;
+  if (typeof process !== "undefined" && process.env.NODE_ENV === "development") return true;
+  if (typeof window === "undefined" || !window.location) return false;
+  const host = window.location.hostname;
+  return host === "localhost" || host === "127.0.0.1" || host.includes("localhost") || host.includes("127.0.0.1") || host.includes(".local");
+}
+function normalizeVersion(v) {
+  if (v == null) return null;
+  const t = String(v).trim();
+  return t.length ? t : null;
+}
+function versionsMatch(a, b) {
+  const na = a.trim();
+  const nb = b.trim();
+  if (na === nb) return true;
+  const va = semver.valid(na);
+  const vb = semver.valid(nb);
+  if (va && vb) return semver.eq(va, vb);
+  return false;
+}
+function usesBetaDistTag(version2) {
+  const pre = semver.prerelease(version2);
+  const id = pre?.[0];
+  return typeof id === "string" && id.toLowerCase() === "beta";
+}
+async function checkForNewVersion() {
+  try {
+    const currentVersion = normalizeVersion(version);
+    if (!currentVersion) {
+      return { hasNewVersion: false, latestVersion: null, currentVersion: null };
+    }
+    const response = await fetch("https://registry.npmjs.org/@basictech/react", {
+      headers: { Accept: "application/vnd.npm.install-v1+json" }
+    });
+    if (!response.ok) {
+      throw new Error("Failed to fetch version from npm");
+    }
+    const data = await response.json();
+    const distTags = data["dist-tags"] ?? {};
+    const rawRegistry = usesBetaDistTag(currentVersion) ? distTags.beta ?? distTags.latest : distTags.latest;
+    const latestVersion = normalizeVersion(rawRegistry ?? null);
+    if (!latestVersion) {
+      throw new Error("Missing dist-tags from npm registry");
+    }
+    const same = versionsMatch(currentVersion, latestVersion);
+    if (!same && isDevelopment()) {
+      log("[basic] version check mismatch:", {
+        currentVersion,
+        registryVersion: latestVersion,
+        channel: usesBetaDistTag(currentVersion) ? "beta" : "latest"
+      });
+    }
+    if (!same) {
+      console.warn("[basic] New version available:", latestVersion, `
+run "npm install @basictech/react@${latestVersion}" to update`);
+    }
+    if (usesBetaDistTag(currentVersion)) {
+      log("thank you for being on basictech/react beta :)");
+    }
+    return {
+      hasNewVersion: !same,
+      latestVersion,
+      currentVersion
+    };
+  } catch (error) {
+    log("Error checking for new version:", error);
+    return {
+      hasNewVersion: false,
+      latestVersion: null,
+      currentVersion: null
+    };
+  }
+}
+function cleanOAuthParamsFromUrl() {
+  if (window.location.search.includes("code") || window.location.search.includes("state")) {
+    const url = new URL(window.location.href);
+    url.searchParams.delete("code");
+    url.searchParams.delete("state");
+    window.history.pushState({}, document.title, url.pathname + url.search);
+    log("Cleaned OAuth parameters from URL");
+  }
+}
+function getSyncStatus(statusCode) {
+  switch (statusCode) {
+    case -1:
+      return "ERROR";
+    case 0:
+      return "OFFLINE";
+    case 1:
+      return "CONNECTING";
+    case 2:
+      return "ONLINE";
+    case 3:
+      return "SYNCING";
+    case 4:
+      return "ERROR_WILL_RETRY";
+    default:
+      return "UNKNOWN";
+  }
+}
+var init_network = __esm({
+  "src/utils/network.ts"() {
+    "use strict";
+    init_config();
+    init_package();
+  }
+});
+
+// src/context.tsx
+import { createContext, useContext } from "react";
+function useBasic() {
+  return useContext(BasicContext);
+}
+var DBStatus, noDb, BasicContext;
+var init_context = __esm({
+  "src/context.tsx"() {
+    "use strict";
+    DBStatus = /* @__PURE__ */ ((DBStatus2) => {
+      DBStatus2["LOADING"] = "LOADING";
+      DBStatus2["OFFLINE"] = "OFFLINE";
+      DBStatus2["CONNECTING"] = "CONNECTING";
+      DBStatus2["ONLINE"] = "ONLINE";
+      DBStatus2["SYNCING"] = "SYNCING";
+      DBStatus2["ERROR"] = "ERROR";
+      DBStatus2["ERROR_WILL_RETRY"] = "ERROR_WILL_RETRY";
+      DBStatus2["ERROR_TOKEN_EXPIRED"] = "ERROR_TOKEN_EXPIRED";
+      return DBStatus2;
+    })(DBStatus || {});
+    noDb = {
+      collection: () => {
+        throw new Error("no basicdb found - initialization failed. double check your schema.");
+      }
+    };
+    BasicContext = createContext({
+      isReady: false,
+      isSignedIn: false,
+      user: null,
+      did: null,
+      scope: null,
+      hasScope: () => false,
+      missingScopes: () => [],
+      signIn: () => Promise.resolve(),
+      signInWithHandle: () => Promise.resolve(),
+      signOut: () => Promise.resolve(),
+      signInWithCode: () => Promise.resolve({ success: false }),
+      getToken: (_options) => Promise.reject(new Error("no token")),
+      getSignInUrl: () => Promise.resolve(""),
+      db: noDb,
+      dbStatus: "LOADING" /* LOADING */,
+      dbMode: "sync",
+      devInfo: null,
+      refreshSchemaStatus: async () => {
+      },
+      isAuthReady: false,
+      signin: () => Promise.resolve(),
+      signout: () => Promise.resolve(),
+      signinWithCode: () => Promise.resolve({ success: false }),
+      getSignInLink: () => Promise.resolve("")
+    });
+  }
+});
+
+// src/dev/BasicDevToolbar.tsx
+var BasicDevToolbar_exports = {};
+__export(BasicDevToolbar_exports, {
+  BasicDevToolbar: () => BasicDevToolbar
+});
+import { useCallback, useMemo, useState } from "react";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+function toneForAuth(isReady, isSignedIn) {
+  if (!isReady) return "muted";
+  if (isSignedIn) return "ok";
+  return "warn";
+}
+function toneForDb(dbMode, dbStatus) {
+  if (dbMode === "remote") return dbStatus === "ONLINE" /* ONLINE */ ? "ok" : "warn";
+  if (dbStatus === "ONLINE" /* ONLINE */ || dbStatus === "SYNCING" /* SYNCING */) return "ok";
+  if (dbStatus === "CONNECTING" /* CONNECTING */ || dbStatus === "LOADING" /* LOADING */) return "warn";
+  if (dbStatus === "OFFLINE" /* OFFLINE */) return "muted";
+  return "bad";
+}
+function toneForSchema(info) {
+  if (!info) return "muted";
+  if (info.valid && info.status === "current") return "ok";
+  if (info.status === "unpublished") return "warn";
+  if (info.status === "no_schema") return "muted";
+  return "bad";
+}
+function dbStatusLabel(status) {
+  switch (status) {
+    case "LOADING" /* LOADING */:
+      return "Initializing";
+    case "OFFLINE" /* OFFLINE */:
+      return "Offline";
+    case "CONNECTING" /* CONNECTING */:
+      return "Connecting";
+    case "ONLINE" /* ONLINE */:
+      return "Connected";
+    case "SYNCING" /* SYNCING */:
+      return "Syncing";
+    case "ERROR" /* ERROR */:
+      return "Error";
+    case "ERROR_WILL_RETRY" /* ERROR_WILL_RETRY */:
+      return "Retrying";
+    case "ERROR_TOKEN_EXPIRED" /* ERROR_TOKEN_EXPIRED */:
+      return "Token refresh";
+    default:
+      return String(status);
+  }
+}
+function chipColor(tone) {
+  switch (tone) {
+    case "ok":
+      return "#22c55e";
+    case "warn":
+      return "#eab308";
+    case "bad":
+      return "#ef4444";
+    default:
+      return "#71717a";
+  }
+}
+function displayDid(did) {
+  return did || "\u2014";
+}
+function displayUserLine(user) {
+  const parts = [];
+  if (user.sub) parts.push(`sub: ${user.sub}`);
+  if (user.email) parts.push(`email: ${user.email}`);
+  if (user.name) parts.push(`name: ${user.name}`);
+  return parts.length ? parts.join(" \xB7 ") : "\u2014";
+}
+function ClipboardIcon() {
+  return /* @__PURE__ */ jsxs(
+    "svg",
+    {
+      width: "14",
+      height: "14",
+      viewBox: "0 0 24 24",
+      fill: "none",
+      stroke: "currentColor",
+      strokeWidth: "2",
+      strokeLinecap: "round",
+      strokeLinejoin: "round",
+      "aria-hidden": true,
+      children: [
+        /* @__PURE__ */ jsx("rect", { x: "9", y: "9", width: "13", height: "13", rx: "2", ry: "2" }),
+        /* @__PURE__ */ jsx("path", { d: "M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1" })
+      ]
+    }
+  );
+}
+function SectionHeader({ children }) {
+  return /* @__PURE__ */ jsx(
+    "div",
+    {
+      style: {
+        fontSize: 10,
+        fontWeight: 700,
+        color: "#e4e4e7",
+        letterSpacing: "0.07em",
+        textTransform: "uppercase",
+        marginBottom: 8
+      },
+      children
+    }
+  );
+}
+function SectionRule() {
+  const bleed = PANEL_PAD_X;
+  return /* @__PURE__ */ jsx(
+    "div",
+    {
+      role: "separator",
+      style: {
+        height: 1,
+        background: "rgba(255, 255, 255, 0.055)",
+        marginLeft: -bleed,
+        marginRight: -bleed,
+        marginTop: 14,
+        marginBottom: 10,
+        width: `calc(100% + ${bleed * 2}px)`
+      }
+    }
+  );
+}
+function CopyableRow({
+  rowKey,
+  label,
+  copyText,
+  copiedKey,
+  onCopied,
+  children
+}) {
+  const [hover, setHover] = useState(false);
+  const canCopy = copyText.length > 0;
+  const handleClick = useCallback(
+    (e) => {
+      e.stopPropagation();
+      if (!canCopy) return;
+      void navigator.clipboard.writeText(copyText).then(() => onCopied(rowKey));
+    },
+    [canCopy, copyText, onCopied, rowKey]
+  );
+  return /* @__PURE__ */ jsxs(
+    "div",
+    {
+      role: canCopy ? "button" : void 0,
+      tabIndex: canCopy ? 0 : void 0,
+      onClick: canCopy ? handleClick : void 0,
+      onKeyDown: canCopy ? (e) => {
+        if (e.key === "Enter" || e.key === " ") {
+          e.preventDefault();
+          handleClick(e);
+        }
+      } : void 0,
+      onMouseEnter: () => setHover(true),
+      onMouseLeave: () => setHover(false),
+      style: {
+        display: "flex",
+        gap: 8,
+        marginBottom: 6,
+        alignItems: "flex-start",
+        borderRadius: 6,
+        padding: "4px 6px",
+        marginLeft: -6,
+        marginRight: -6,
+        cursor: canCopy ? "pointer" : "default",
+        background: hover && canCopy ? "rgba(255,255,255,0.06)" : "transparent",
+        transition: "background 0.12s ease"
+      },
+      children: [
+        /* @__PURE__ */ jsx("span", { style: { color: "#a1a1aa", minWidth: 88, flexShrink: 0, paddingTop: 2 }, children: label }),
+        /* @__PURE__ */ jsx(
+          "span",
+          {
+            style: {
+              flex: 1,
+              minWidth: 0,
+              wordBreak: "break-all",
+              paddingTop: 2,
+              lineHeight: 1.35
+            },
+            children
+          }
+        ),
+        canCopy && /* @__PURE__ */ jsx(
+          "span",
+          {
+            style: {
+              flexShrink: 0,
+              color: copiedKey === rowKey ? "#22c55e" : "#71717a",
+              opacity: hover || copiedKey === rowKey ? 1 : 0,
+              transition: "opacity 0.12s ease, color 0.12s ease",
+              paddingTop: 2,
+              display: "flex",
+              alignItems: "flex-start"
+            },
+            title: "Copy value",
+            children: copiedKey === rowKey ? /* @__PURE__ */ jsx("span", { style: { fontSize: 10 }, children: "\u2713" }) : /* @__PURE__ */ jsx(ClipboardIcon, {})
+          }
+        )
+      ]
+    }
+  );
+}
+function BasicDevToolbar({ enabled = true, debug }) {
+  const {
+    isReady,
+    isSignedIn,
+    user,
+    did,
+    scope,
+    missingScopes,
+    dbMode,
+    dbStatus,
+    devInfo,
+    refreshSchemaStatus
+  } = useBasic();
+  const [open, setOpen] = useState(false);
+  const [refreshing, setRefreshing] = useState(false);
+  const [copied, setCopied] = useState(false);
+  const [rowCopied, setRowCopied] = useState(null);
+  const show = enabled && typeof window !== "undefined" && isDevelopment(debug);
+  const authTone = toneForAuth(isReady, isSignedIn);
+  const dbTone = toneForDb(dbMode, dbStatus);
+  const schemaTone = toneForSchema(devInfo);
+  const syncTone = dbMode === "remote" ? "muted" : dbTone === "ok" || dbStatus === "SYNCING" /* SYNCING */ ? "ok" : dbTone === "warn" ? "warn" : dbTone === "bad" ? "bad" : "muted";
+  const handleRefreshSchema = useCallback(async () => {
+    setRefreshing(true);
+    try {
+      await refreshSchemaStatus();
+    } finally {
+      setRefreshing(false);
+    }
+  }, [refreshSchemaStatus]);
+  const missingList = missingScopes();
+  const debugPayload = useMemo(() => {
+    return {
+      sdkVersion: version,
+      isReady,
+      isSignedIn,
+      did: did ?? null,
+      user: user ? {
+        sub: user.sub,
+        email: user.email,
+        name: user.name,
+        picture: user.picture
+      } : null,
+      scope,
+      missingScopes: missingList,
+      dbMode,
+      dbStatus,
+      indexedDbName: dbMode === "sync" ? INDEXED_DB_NAME : null,
+      schema: devInfo
+    };
+  }, [isReady, isSignedIn, did, user, scope, dbMode, dbStatus, devInfo, missingList]);
+  const handleCopy = useCallback(async () => {
+    try {
+      await navigator.clipboard.writeText(JSON.stringify(debugPayload, null, 2));
+      setCopied(true);
+      setTimeout(() => setCopied(false), 2e3);
+    } catch {
+    }
+  }, [debugPayload]);
+  const onRowCopied = useCallback((key) => {
+    setRowCopied(key);
+    setTimeout(() => setRowCopied((k) => k === key ? null : k), 1500);
+  }, []);
+  if (!show) return null;
+  const shell = {
+    position: "fixed",
+    bottom: 12,
+    left: "50%",
+    transform: "translateX(-50%)",
+    zIndex: 99999,
+    fontFamily: 'ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace',
+    fontSize: 11,
+    color: "#e4e4e7",
+    pointerEvents: "auto"
+  };
+  const bar = {
+    display: "flex",
+    alignItems: "center",
+    gap: 8,
+    padding: "8px 12px",
+    borderRadius: 999,
+    background: "rgba(24, 24, 27, 0.92)",
+    border: "1px solid rgba(63, 63, 70, 0.9)",
+    boxShadow: "0 8px 32px rgba(0,0,0,0.35)",
+    cursor: "pointer",
+    userSelect: "none"
+  };
+  const dot = (tone) => /* @__PURE__ */ jsx(
+    "span",
+    {
+      style: {
+        display: "block",
+        boxSizing: "border-box",
+        width: 6,
+        height: 6,
+        minWidth: 6,
+        minHeight: 6,
+        maxWidth: 6,
+        maxHeight: 6,
+        borderRadius: "50%",
+        background: chipColor(tone),
+        flexShrink: 0
+      }
+    }
+  );
+  const dotSlot = (title, tone) => /* @__PURE__ */ jsx(
+    "span",
+    {
+      title,
+      style: {
+        display: "inline-flex",
+        alignItems: "center",
+        justifyContent: "center",
+        width: 6,
+        height: 6,
+        flexShrink: 0,
+        lineHeight: 0
+      },
+      children: dot(tone)
+    }
+  );
+  const panel = {
+    marginBottom: 8,
+    maxHeight: "50vh",
+    overflow: "auto",
+    padding: PANEL_PAD_X,
+    borderRadius: 10,
+    background: "rgba(24, 24, 27, 0.96)",
+    border: "1px solid rgba(63, 63, 70, 0.9)",
+    boxShadow: "0 8px 32px rgba(0,0,0,0.35)",
+    minWidth: 300,
+    maxWidth: "min(560px, calc(100vw - 24px))"
+  };
+  const syncStatusText = dbStatusLabel(dbStatus);
+  return /* @__PURE__ */ jsxs("div", { style: shell, children: [
+    open && /* @__PURE__ */ jsxs("div", { style: panel, children: [
+      /* @__PURE__ */ jsxs("div", { style: { marginBottom: 12 }, children: [
+        /* @__PURE__ */ jsx("div", { style: { fontWeight: 600, fontSize: 12 }, children: "Basic SDK" }),
+        /* @__PURE__ */ jsxs("div", { style: { color: "#71717a", fontSize: 10, marginTop: 2 }, children: [
+          "v",
+          version
+        ] })
+      ] }),
+      /* @__PURE__ */ jsx(SectionHeader, { children: "Auth" }),
+      /* @__PURE__ */ jsx(
+        CopyableRow,
+        {
+          rowKey: "ready",
+          label: "Ready",
+          copyText: String(isReady),
+          copiedKey: rowCopied,
+          onCopied: onRowCopied,
+          children: String(isReady)
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        CopyableRow,
+        {
+          rowKey: "signedIn",
+          label: "Signed in",
+          copyText: String(isSignedIn),
+          copiedKey: rowCopied,
+          onCopied: onRowCopied,
+          children: String(isSignedIn)
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        CopyableRow,
+        {
+          rowKey: "did",
+          label: "DID",
+          copyText: did || "",
+          copiedKey: rowCopied,
+          onCopied: onRowCopied,
+          children: displayDid(did)
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        CopyableRow,
+        {
+          rowKey: "user",
+          label: "User",
+          copyText: user ? displayUserLine(user) : "",
+          copiedKey: rowCopied,
+          onCopied: onRowCopied,
+          children: user ? displayUserLine(user) : "\u2014"
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        CopyableRow,
+        {
+          rowKey: "scopes",
+          label: "Scopes",
+          copyText: scope || "",
+          copiedKey: rowCopied,
+          onCopied: onRowCopied,
+          children: scope || "\u2014"
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        CopyableRow,
+        {
+          rowKey: "missingScopes",
+          label: "Missing scopes",
+          copyText: missingList.length ? missingList.join(", ") : "",
+          copiedKey: rowCopied,
+          onCopied: onRowCopied,
+          children: missingList.length ? missingList.join(", ") : "\u2014"
+        }
+      ),
+      /* @__PURE__ */ jsx(SectionRule, {}),
+      /* @__PURE__ */ jsx(SectionHeader, { children: "Database" }),
+      /* @__PURE__ */ jsx(
+        CopyableRow,
+        {
+          rowKey: "dbMode",
+          label: "Mode",
+          copyText: dbMode,
+          copiedKey: rowCopied,
+          onCopied: onRowCopied,
+          children: dbMode
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        CopyableRow,
+        {
+          rowKey: "indexedDb",
+          label: "IndexedDB",
+          copyText: dbMode === "sync" ? INDEXED_DB_NAME : "",
+          copiedKey: rowCopied,
+          onCopied: onRowCopied,
+          children: dbMode === "sync" ? INDEXED_DB_NAME : "\u2014"
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        CopyableRow,
+        {
+          rowKey: "syncStatus",
+          label: "Sync / status",
+          copyText: syncStatusText,
+          copiedKey: rowCopied,
+          onCopied: onRowCopied,
+          children: syncStatusText
+        }
+      ),
+      /* @__PURE__ */ jsx(SectionRule, {}),
+      /* @__PURE__ */ jsx(SectionHeader, { children: "Schema" }),
+      devInfo ? /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsx(
+          CopyableRow,
+          {
+            rowKey: "schemaProject",
+            label: "Project",
+            copyText: devInfo.projectId ?? "",
+            copiedKey: rowCopied,
+            onCopied: onRowCopied,
+            children: devInfo.projectId ?? "\u2014"
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          CopyableRow,
+          {
+            rowKey: "schemaLocalVer",
+            label: "Local version",
+            copyText: devInfo.localVersion !== void 0 && devInfo.localVersion !== null ? String(devInfo.localVersion) : "",
+            copiedKey: rowCopied,
+            onCopied: onRowCopied,
+            children: devInfo.localVersion ?? "\u2014"
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          CopyableRow,
+          {
+            rowKey: "schemaRemote",
+            label: "Remote check",
+            copyText: devInfo.status,
+            copiedKey: rowCopied,
+            onCopied: onRowCopied,
+            children: devInfo.status
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          CopyableRow,
+          {
+            rowKey: "schemaValid",
+            label: "Valid",
+            copyText: String(devInfo.valid),
+            copiedKey: rowCopied,
+            onCopied: onRowCopied,
+            children: String(devInfo.valid)
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          CopyableRow,
+          {
+            rowKey: "schemaChecked",
+            label: "Checked",
+            copyText: devInfo.lastCheckedAt ? new Date(devInfo.lastCheckedAt).toISOString() : "",
+            copiedKey: rowCopied,
+            onCopied: onRowCopied,
+            children: devInfo.lastCheckedAt ? new Date(devInfo.lastCheckedAt).toLocaleString() : "\u2014"
+          }
+        ),
+        devInfo.error ? /* @__PURE__ */ jsx(
+          CopyableRow,
+          {
+            rowKey: "schemaError",
+            label: "Error",
+            copyText: devInfo.error,
+            copiedKey: rowCopied,
+            onCopied: onRowCopied,
+            children: devInfo.error
+          }
+        ) : null
+      ] }) : /* @__PURE__ */ jsx(
+        CopyableRow,
+        {
+          rowKey: "schemaStatus",
+          label: "Status",
+          copyText: "No schema on provider",
+          copiedKey: rowCopied,
+          onCopied: onRowCopied,
+          children: "No schema on provider"
+        }
+      ),
+      /* @__PURE__ */ jsxs("div", { style: { display: "flex", gap: 8, marginTop: 12, flexWrap: "wrap" }, children: [
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: (e) => {
+              e.stopPropagation();
+              void handleRefreshSchema();
+            },
+            disabled: refreshing,
+            style: {
+              padding: "6px 10px",
+              borderRadius: 6,
+              border: "1px solid #3f3f46",
+              background: "#27272a",
+              color: "#e4e4e7",
+              cursor: refreshing ? "wait" : "pointer",
+              fontSize: 11,
+              fontFamily: "inherit"
+            },
+            children: refreshing ? "Refreshing\u2026" : "Refresh schema"
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: (e) => {
+              e.stopPropagation();
+              void handleCopy();
+            },
+            style: {
+              padding: "6px 10px",
+              borderRadius: 6,
+              border: "1px solid #3f3f46",
+              background: "#27272a",
+              color: "#e4e4e7",
+              cursor: "pointer",
+              fontSize: 11,
+              fontFamily: "inherit"
+            },
+            children: copied ? "Copied" : "Copy debug info"
+          }
+        )
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs(
+      "button",
+      {
+        type: "button",
+        "aria-expanded": open,
+        onClick: () => setOpen((o) => !o),
+        style: {
+          ...bar,
+          border: "none",
+          width: "100%",
+          cursor: "pointer"
+        },
+        children: [
+          /* @__PURE__ */ jsx("span", { style: { fontWeight: 600, letterSpacing: 0.02 }, children: "Basic" }),
+          /* @__PURE__ */ jsxs(
+            "span",
+            {
+              style: {
+                display: "inline-flex",
+                alignItems: "center",
+                gap: 6,
+                marginLeft: 8,
+                height: 6,
+                flexShrink: 0,
+                lineHeight: 0
+              },
+              children: [
+                dotSlot("Auth", authTone),
+                dotSlot("DB", dbTone),
+                dotSlot("Sync", syncTone),
+                dotSlot("Schema", schemaTone)
+              ]
+            }
+          ),
+          /* @__PURE__ */ jsx("span", { style: { color: "#71717a", marginLeft: 4 }, children: open ? "\u25BE" : "\u25B4" })
+        ]
+      }
+    )
+  ] });
+}
+var INDEXED_DB_NAME, PANEL_PAD_X;
+var init_BasicDevToolbar = __esm({
+  "src/dev/BasicDevToolbar.tsx"() {
+    "use strict";
+    "use client";
+    init_context();
+    init_package();
+    init_network();
+    INDEXED_DB_NAME = "basicdb";
+    PANEL_PAD_X = 12;
+  }
+});
+
 // src/AuthContext.tsx
-import { createContext, useContext, useEffect, useState, useRef } from "react";
-import { jwtDecode } from "jwt-decode";
+import { useCallback as useCallback2, useEffect, useRef, useState as useState2, Suspense, lazy } from "react";
 
 // src/sync/index.ts
 init_config();
+init_tokenRegistry();
 import { v7 as uuidv7 } from "uuid";
 import { Dexie as Dexie2 } from "dexie";
 import { validateData } from "@basictech/schema";
 var dexieExtensionsLoaded = false;
 var initPromise = null;
 async function initDexieExtensions() {
-  if (dexieExtensionsLoaded)
-    return;
-  if (typeof window === "undefined")
-    return;
-  if (initPromise)
-    return initPromise;
+  if (dexieExtensionsLoaded) return;
+  if (typeof window === "undefined") return;
+  if (initPromise) return initPromise;
   initPromise = (async () => {
     try {
       await import("dexie-syncable");
@@ -185,12 +1056,13 @@ var BasicSync = class extends Dexie2 {
     this.version(2).stores({});
     this.Collection.prototype.get = this.Collection.prototype.toArray;
   }
-  async connect({ access_token, ws_url }) {
+  async connect({ getToken, ws_url }) {
     const WS_URL = ws_url || "wss://pds.basic.id/ws";
     log("Connecting to", WS_URL);
+    setTokenGetter(WS_URL, getToken);
     await this.updateSyncNodes();
     log("Starting connection...");
-    return this.syncable.connect("websocket", WS_URL, { authToken: access_token, schema: this.basic_schema });
+    return this.syncable.connect("websocket", WS_URL, { schema: this.basic_schema });
   }
   async disconnect({ ws_url } = {}) {
     const WS_URL = ws_url || "wss://pds.basic.id/ws";
@@ -230,7 +1102,7 @@ var BasicSync = class extends Dexie2 {
   }
   _convertSchemaToDxSchema(schema) {
     const stores = Object.entries(schema.tables).map(([key, table]) => {
-      const indexedFields = Object.entries(table.fields).filter(([key2, field]) => field.indexed).map(([key2, field]) => `,${key2}`).join("");
+      const indexedFields = Object.entries(table.fields).filter(([, field]) => field.indexed).map(([fieldKey]) => `,${fieldKey}`).join("");
       return {
         [key]: "id" + indexedFields
       };
@@ -397,29 +1269,45 @@ var RemoteCollection = class {
     const token = await this.config.getToken();
     const url = `${this.config.serverUrl}${path}`;
     this.log(`${method} ${url}`, body ? JSON.stringify(body) : "");
+    const headers = {
+      "Authorization": `Bearer ${token}`
+    };
+    if (body) {
+      headers["Content-Type"] = "application/json";
+    }
     const response = await fetch(url, {
       method,
-      headers: {
-        "Content-Type": "application/json",
-        "Authorization": `Bearer ${token}`
-      },
+      headers,
       ...body ? { body: JSON.stringify(body) } : {}
     });
     const responseData = await response.json().catch(() => ({}));
     if (!response.ok) {
       if (response.status === 401 && !isRetry) {
-        this.log("Got 401, retrying with fresh token...");
+        this.log("Got 401, forcing token refresh and retrying...");
+        await this.config.getToken({ forceRefresh: true });
         return this.request(method, path, body, true);
       }
       if (this.config.debug) {
         console.error(`[RemoteDB] Error ${response.status}:`, responseData);
       }
-      if (response.status === 401 && this.config.onAuthError) {
-        this.config.onAuthError({
-          status: response.status,
-          message: "Authentication failed",
-          response: responseData
-        });
+      if (this.config.onAuthError) {
+        if (response.status === 401) {
+          this.config.onAuthError({
+            status: response.status,
+            message: "Authentication failed",
+            response: responseData,
+            errorType: "expired",
+            afterRetry: isRetry
+          });
+        } else if (response.status === 403) {
+          this.config.onAuthError({
+            status: response.status,
+            message: responseData.message || "Forbidden - insufficient permissions or missing scope",
+            response: responseData,
+            errorType: "forbidden",
+            afterRetry: isRetry
+          });
+        }
       }
       const errorMessage = responseData.message || responseData.error || responseData.detail || (typeof responseData === "string" ? responseData : `API request failed: ${response.status}`);
       throw new RemoteDBError(errorMessage, response.status, responseData);
@@ -618,22 +1506,824 @@ var RemoteDB = class {
   }
 };
 
-// src/AuthContext.tsx
-init_config();
+// src/core/auth/AuthManager.ts
+import { jwtDecode } from "jwt-decode";
 
-// package.json
-var version = "0.7.0-beta.6";
+// src/utils/storage.ts
+var LocalStorageAdapter = class {
+  async get(key) {
+    return localStorage.getItem(key);
+  }
+  async set(key, value) {
+    localStorage.setItem(key, value);
+  }
+  async remove(key) {
+    localStorage.removeItem(key);
+  }
+};
+var STORAGE_KEYS = {
+  REFRESH_TOKEN: "basic_refresh_token",
+  USER_INFO: "basic_user_info",
+  AUTH_STATE: "basic_auth_state",
+  REDIRECT_URI: "basic_redirect_uri",
+  SERVER_URL: "basic_server_url",
+  PDS_ENDPOINTS: "basic_pds_endpoints",
+  LAST_CONNECT_REPORT: "basic_last_connect_report",
+  DEBUG: "basic_debug",
+  CODE_VERIFIER: "basic_code_verifier"
+};
 
-// src/updater/versionUpdater.ts
-var VersionUpdater = class {
+// src/utils/normalizeClientId.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function normalizeClientId(projectId, adminHostname = "api.basic.tech") {
+  if (!projectId) return projectId;
+  if (projectId === "self") return projectId;
+  if (projectId.startsWith("did:")) return projectId;
+  if (UUID_RE.test(projectId)) {
+    const hex = projectId.replace(/-/g, "").toLowerCase();
+    return `did:web:${adminHostname}:projects:${hex}`;
+  }
+  return projectId;
+}
+
+// src/utils/resolveDid.ts
+function resolveDidWebUrl(did) {
+  if (!did.startsWith("did:web:")) return null;
+  const rest = did.slice(8);
+  if (!rest) return null;
+  const parts = rest.split(":");
+  const hostname = parts[0].replace(/%3A/gi, ":");
+  if (parts.length === 1) {
+    return `https://${hostname}/.well-known/did.json`;
+  }
+  const pathParts = parts.slice(1).map((p) => decodeURIComponent(p));
+  return `https://${hostname}/${pathParts.join("/")}/did.json`;
+}
+async function resolveFromDocument(did, didDocument) {
+  const services = didDocument.service;
+  const pdsService = services?.find(
+    (s) => s.id === "#basic_pds" || s.id === `${did}#basic_pds`
+  );
+  if (!pdsService) {
+    throw new Error(`DID document has no #basic_pds service entry`);
+  }
+  const pdsUrl = pdsService.serviceEndpoint.replace(/\/+$/, "");
+  const oauthRes = await fetch(`${pdsUrl}/auth/.well-known/openid-configuration`);
+  if (!oauthRes.ok) {
+    throw new Error(`Failed to fetch OpenID configuration from ${pdsUrl}: ${oauthRes.status}`);
+  }
+  const oauth = await oauthRes.json();
+  return {
+    did,
+    didDocument,
+    pdsUrl,
+    authorization_endpoint: oauth.authorization_endpoint,
+    token_endpoint: oauth.token_endpoint,
+    userinfo_endpoint: oauth.userinfo_endpoint
+  };
+}
+async function resolveDid(did) {
+  const url = resolveDidWebUrl(did);
+  if (!url) {
+    throw new Error(`Unsupported DID method: ${did}`);
+  }
+  const didRes = await fetch(url);
+  if (!didRes.ok) {
+    throw new Error(`Failed to fetch DID document at ${url}: ${didRes.status}`);
+  }
+  const didDocument = await didRes.json();
+  return resolveFromDocument(did, didDocument);
+}
+async function resolveHandle(handle) {
+  const res = await fetch(`https://${handle}/.well-known/did.json`);
+  if (!res.ok) {
+    throw new Error(`Handle resolution failed for ${handle}: ${res.status}`);
+  }
+  const didDocument = await res.json();
+  const did = didDocument.id;
+  if (!did) {
+    throw new Error(`Handle response has no 'id' field`);
+  }
+  const resolved = await resolveFromDocument(did, didDocument);
+  resolved.handle = handle;
+  return resolved;
+}
+
+// src/core/auth/AuthManager.ts
+init_network();
+init_config();
+function generateCodeVerifier() {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  return base64UrlEncode(array);
+}
+async function generateCodeChallenge(verifier) {
+  if (typeof crypto === "undefined" || !crypto.subtle) {
+    log("crypto.subtle unavailable (non-secure context?) -- falling back to plain PKCE challenge");
+    return { challenge: verifier, method: "plain" };
+  }
+  const encoder = new TextEncoder();
+  const data = encoder.encode(verifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return { challenge: base64UrlEncode(new Uint8Array(digest)), method: "S256" };
+}
+function base64UrlEncode(buffer) {
+  let str = "";
+  for (let i = 0; i < buffer.length; i++) {
+    str += String.fromCharCode(buffer[i]);
+  }
+  return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+var AuthManager = class {
+  // --- Public state (read by the UI layer) ---
+  token = null;
+  user = null;
+  isSignedIn = false;
+  isAuthReady = false;
+  did = null;
+  /** Space-separated scopes granted in the current access token */
+  tokenScope = null;
+  /** Space-separated scopes originally requested in the auth config */
+  requestedScopes;
+  config;
   storage;
-  currentVersion;
-  migrations;
-  versionKey = "basic_app_version";
-  constructor(storage, currentVersion, migrations = []) {
+  /** True only during a user-initiated OAuth code exchange (not session restore) */
+  freshSignIn = false;
+  // --- Private ---
+  notify;
+  refreshPromise = null;
+  codeExchangePromise = null;
+  pendingRefresh = false;
+  isOnline = typeof navigator !== "undefined" ? navigator.onLine : true;
+  channel = null;
+  constructor(config, storage, notify) {
+    this.config = config;
     this.storage = storage;
-    this.currentVersion = currentVersion;
-    this.migrations = migrations.sort((a, b) => this.compareVersions(a.fromVersion, b.fromVersion));
+    this.notify = notify;
+    this.requestedScopes = config.scopes;
+    this.initCrossTabSync();
+  }
+  initCrossTabSync() {
+    if (typeof BroadcastChannel === "undefined") return;
+    try {
+      this.channel = new BroadcastChannel("basic-auth");
+      this.channel.onmessage = (event) => {
+        if (event.data?.type === "token_refreshed") {
+          log("Received token refresh from another tab");
+          if (event.data.accessToken && this.token) {
+            this.token = { ...this.token, access_token: event.data.accessToken };
+          }
+          if (event.data.did) this.did = event.data.did;
+          if (event.data.tokenScope) this.tokenScope = event.data.tokenScope;
+          this.notify();
+        }
+        if (event.data?.type === "signed_in") {
+          log("Received sign-in from another tab, reloading");
+          if (typeof window !== "undefined") {
+            window.location.reload();
+          }
+        }
+        if (event.data?.type === "signed_out") {
+          log("Received sign-out from another tab, reloading");
+          this.user = null;
+          this.isSignedIn = false;
+          this.token = null;
+          this.did = null;
+          this.tokenScope = null;
+          this.notify();
+          if (typeof window !== "undefined") {
+            window.location.reload();
+          }
+        }
+      };
+    } catch {
+      log("BroadcastChannel not available for cross-tab sync");
+    }
+  }
+  broadcastTokenRefresh() {
+    this.channel?.postMessage({
+      type: "token_refreshed",
+      accessToken: this.token?.access_token,
+      did: this.did,
+      tokenScope: this.tokenScope
+    });
+  }
+  broadcastSignIn() {
+    this.channel?.postMessage({ type: "signed_in" });
+  }
+  broadcastSignOut() {
+    this.channel?.postMessage({ type: "signed_out" });
+  }
+  // ------------------------------------------------------------------
+  // Public API
+  // ------------------------------------------------------------------
+  /**
+   * Bootstrap auth: handle OAuth callback (?code=), restore session
+   * from refresh token, or load cached user for offline mode.
+   */
+  async initialize() {
+    await this.storage.set(STORAGE_KEYS.DEBUG, this.config.debug ? "true" : "false");
+    const storedServerUrl = await this.storage.get(STORAGE_KEYS.SERVER_URL);
+    if (storedServerUrl && storedServerUrl !== this.config.pdsUrl) {
+      log("PDS URL changed, clearing stored tokens");
+      await this.clearStoredAuth();
+    }
+    await this.storage.set(STORAGE_KEYS.SERVER_URL, this.config.pdsUrl);
+    try {
+      const params = new URLSearchParams(window.location.search);
+      if (params.has("code")) {
+        const code = params.get("code");
+        if (!code) {
+          this.isAuthReady = true;
+          this.notify();
+          return;
+        }
+        const state = await this.storage.get(STORAGE_KEYS.AUTH_STATE);
+        const urlState = params.get("state");
+        if (!state || state !== urlState) {
+          log("error: auth state does not match");
+          this.isAuthReady = true;
+          this.notify();
+          await this.storage.remove(STORAGE_KEYS.AUTH_STATE);
+          cleanOAuthParamsFromUrl();
+          return;
+        }
+        await this.storage.remove(STORAGE_KEYS.AUTH_STATE);
+        cleanOAuthParamsFromUrl();
+        this.freshSignIn = true;
+        this.exchangeToken(code, false).catch((error) => {
+          log("Error fetching token:", error);
+        });
+      } else {
+        const refreshToken = await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);
+        if (refreshToken) {
+          log("Found refresh token in storage, attempting to refresh access token");
+          this.exchangeToken(refreshToken, true).catch((error) => {
+            log("Error fetching refresh token:", error);
+          });
+        } else {
+          const cachedUserInfo = await this.storage.get(STORAGE_KEYS.USER_INFO);
+          if (cachedUserInfo) {
+            try {
+              this.user = JSON.parse(cachedUserInfo);
+              this.isSignedIn = true;
+              log("Loaded cached user info for offline mode");
+            } catch (error) {
+              log("Error parsing cached user info:", error);
+            }
+          }
+          this.isAuthReady = true;
+          this.notify();
+        }
+      }
+    } catch (e) {
+      log("error getting token", e);
+    }
+  }
+  /**
+   * Get a valid access token string. Refreshes proactively (5s buffer)
+   * or on demand (forceRefresh). Mutex prevents concurrent refreshes.
+   */
+  async getToken(options) {
+    log("getting token...");
+    if (!this.token) {
+      const refreshToken = await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);
+      if (refreshToken) {
+        log("No token in memory, attempting to refresh from storage");
+        if (this.refreshPromise) {
+          log("Token refresh already in progress, waiting...");
+          try {
+            const newToken = await this.refreshPromise;
+            if (newToken?.access_token) {
+              return newToken.access_token;
+            }
+          } catch (error) {
+            log("In-flight refresh failed:", error);
+            throw error;
+          }
+        }
+        try {
+          const newToken = await this.exchangeToken(refreshToken, true);
+          if (newToken?.access_token) {
+            return newToken.access_token;
+          }
+        } catch (error) {
+          log("Failed to refresh token from storage:", error);
+          if (this.isNetworkError(error)) {
+            throw new Error("Network offline - authentication will be retried when online");
+          }
+          throw new Error("Authentication expired. Please sign in again.");
+        }
+      }
+      log("no token found");
+      throw new Error("no token found");
+    }
+    const decoded = jwtDecode(this.token.access_token);
+    const expirationBuffer = 5;
+    const isExpired = decoded.exp && decoded.exp < Date.now() / 1e3 + expirationBuffer;
+    const shouldRefresh = isExpired || options?.forceRefresh === true;
+    if (shouldRefresh) {
+      log(options?.forceRefresh ? "force refreshing token..." : "token is expired - refreshing ...");
+      if (this.refreshPromise) {
+        log("Token refresh already in progress, waiting...");
+        try {
+          const newToken = await this.refreshPromise;
+          return newToken?.access_token || "";
+        } catch (error) {
+          log("In-flight refresh failed:", error);
+          if (this.isNetworkError(error)) {
+            log("Network issue - using expired token until network is restored");
+            return this.token.access_token;
+          }
+          throw error;
+        }
+      }
+      const refreshToken = this.token.refresh_token || await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);
+      if (refreshToken) {
+        try {
+          const newToken = await this.exchangeToken(refreshToken, true);
+          return newToken?.access_token || "";
+        } catch (error) {
+          log("Failed to refresh expired token:", error);
+          if (this.isNetworkError(error)) {
+            log("Network issue - using expired token until network is restored");
+            return this.token.access_token;
+          }
+          throw new Error("Authentication expired. Please sign in again.");
+        }
+      } else {
+        throw new Error("no refresh token available");
+      }
+    }
+    return this.token.access_token || "";
+  }
+  async getSignInUrl(redirectUri, endpoints) {
+    log("getting sign in link...");
+    if (!this.config.projectId) {
+      throw new Error("Project ID is required to generate sign-in link");
+    }
+    const pdsEndpoints = endpoints || this.defaultPdsEndpoints();
+    await this.storage.set(STORAGE_KEYS.PDS_ENDPOINTS, JSON.stringify(pdsEndpoints));
+    const randomState = Math.random().toString(36).substring(6);
+    await this.storage.set(STORAGE_KEYS.AUTH_STATE, randomState);
+    const redirectUrl = redirectUri || window.location.href;
+    if (!redirectUrl || !redirectUrl.startsWith("http://") && !redirectUrl.startsWith("https://")) {
+      throw new Error("Invalid redirect URI provided");
+    }
+    await this.storage.set(STORAGE_KEYS.REDIRECT_URI, redirectUrl);
+    log("Stored redirect_uri for token exchange:", redirectUrl);
+    const codeVerifier = generateCodeVerifier();
+    const { challenge: codeChallenge, method: challengeMethod } = await generateCodeChallenge(codeVerifier);
+    await this.storage.set(STORAGE_KEYS.CODE_VERIFIER, codeVerifier);
+    let baseUrl = pdsEndpoints.authorization_endpoint;
+    baseUrl += `?client_id=${encodeURIComponent(normalizeClientId(this.config.projectId, this.adminHostname))}`;
+    baseUrl += `&redirect_uri=${encodeURIComponent(redirectUrl)}`;
+    baseUrl += `&response_type=code`;
+    baseUrl += `&scope=${encodeURIComponent(this.config.scopes)}`;
+    baseUrl += `&state=${randomState}`;
+    baseUrl += `&code_challenge=${encodeURIComponent(codeChallenge)}`;
+    baseUrl += `&code_challenge_method=${challengeMethod}`;
+    log("Generated sign-in link successfully with scopes:", this.config.scopes);
+    return baseUrl;
+  }
+  async signIn(redirectUri) {
+    log("signing in...");
+    if (!this.config.projectId) {
+      log("Error: project_id is required for sign-in");
+      throw new Error("Project ID is required for authentication");
+    }
+    const signInLink = await this.getSignInUrl(redirectUri);
+    log("Generated sign-in link:", signInLink);
+    try {
+      new URL(signInLink);
+    } catch {
+      log("Error: Invalid sign-in link generated");
+      throw new Error("Failed to generate valid sign-in URL");
+    }
+    window.location.href = signInLink;
+  }
+  async signInWithHandle(handle) {
+    log("signing in with handle:", handle);
+    if (!this.config.projectId) {
+      throw new Error("Project ID is required for authentication");
+    }
+    const resolved = await resolveHandle(handle);
+    log("Resolved handle to PDS:", resolved.pdsUrl);
+    const endpoints = {
+      pds_url: resolved.pdsUrl,
+      authorization_endpoint: resolved.authorization_endpoint,
+      token_endpoint: resolved.token_endpoint,
+      userinfo_endpoint: resolved.userinfo_endpoint
+    };
+    const signInLink = await this.getSignInUrl(void 0, endpoints);
+    log("Generated federated sign-in link:", signInLink);
+    try {
+      new URL(signInLink);
+    } catch {
+      throw new Error("Failed to generate valid sign-in URL");
+    }
+    window.location.href = signInLink;
+  }
+  async signInWithCode(code, state) {
+    try {
+      log("signInWithCode called with code:", code);
+      if (!code || typeof code !== "string") {
+        return { success: false, error: "Invalid authorization code" };
+      }
+      if (state) {
+        const storedState = await this.storage.get(STORAGE_KEYS.AUTH_STATE);
+        if (storedState && storedState !== state) {
+          log("State parameter mismatch:", { provided: state, stored: storedState });
+          return { success: false, error: "State parameter mismatch" };
+        }
+      }
+      await this.storage.remove(STORAGE_KEYS.AUTH_STATE);
+      cleanOAuthParamsFromUrl();
+      this.freshSignIn = true;
+      const token = await this.exchangeToken(code, false);
+      if (token) {
+        log("signInWithCode successful");
+        return { success: true };
+      } else {
+        return { success: false, error: "Failed to exchange code for token" };
+      }
+    } catch (error) {
+      log("signInWithCode error:", error);
+      return {
+        success: false,
+        error: error.message || "Authentication failed"
+      };
+    }
+  }
+  /**
+   * Clear auth state and storage. Does NOT handle sync/DB cleanup —
+   * the UI layer (BasicProvider) wraps this to add sync teardown.
+   */
+  async signOut() {
+    log("signing out!");
+    this.resetAuthState();
+    await this.storage.remove(STORAGE_KEYS.AUTH_STATE);
+    await this.storage.remove(STORAGE_KEYS.LAST_CONNECT_REPORT);
+    await this.clearStoredAuth();
+    this.broadcastSignOut();
+    this.notify();
+  }
+  hasScope(scope) {
+    if (!this.tokenScope) return false;
+    return this.tokenScope.split(/[\s,]+/).filter(Boolean).includes(scope);
+  }
+  /**
+   * Returns scopes that were requested but not granted in the current token.
+   * Useful after login or when a 403 is returned.
+   */
+  missingScopes() {
+    const requested = this.requestedScopes.split(/[\s,]+/).filter(Boolean);
+    if (!this.tokenScope) return requested;
+    const granted = new Set(this.tokenScope.split(/[\s,]+/).filter(Boolean));
+    return requested.filter((s) => !granted.has(s));
+  }
+  /**
+   * Register online/offline handlers that retry pending refreshes.
+   * Returns a cleanup function for useEffect teardown.
+   */
+  setupNetworkListeners() {
+    const handleOnline = async () => {
+      log("Network came back online");
+      this.isOnline = true;
+      if (this.pendingRefresh && this.token) {
+        log("Retrying pending token refresh");
+        this.pendingRefresh = false;
+        const refreshToken = this.token.refresh_token || await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);
+        if (refreshToken) {
+          this.exchangeToken(refreshToken, true).catch((error) => {
+            log("Retry refresh failed:", error);
+          });
+        }
+      }
+    };
+    const handleOffline = () => {
+      log("Network went offline");
+      this.isOnline = false;
+    };
+    window.addEventListener("online", handleOnline);
+    window.addEventListener("offline", handleOffline);
+    return () => {
+      window.removeEventListener("online", handleOnline);
+      window.removeEventListener("offline", handleOffline);
+    };
+  }
+  // ------------------------------------------------------------------
+  // Private
+  // ------------------------------------------------------------------
+  get adminHostname() {
+    try {
+      return new URL(this.config.adminUrl).hostname;
+    } catch {
+      return "api.basic.tech";
+    }
+  }
+  defaultPdsEndpoints() {
+    return {
+      pds_url: this.config.pdsUrl,
+      authorization_endpoint: `${this.config.pdsUrl}/auth/authorize`,
+      token_endpoint: `${this.config.pdsUrl}/auth/token`,
+      userinfo_endpoint: `${this.config.pdsUrl}/auth/userinfo`
+    };
+  }
+  async getActivePdsEndpoints() {
+    const stored = await this.storage.get(STORAGE_KEYS.PDS_ENDPOINTS);
+    if (stored) {
+      try {
+        return JSON.parse(stored);
+      } catch {
+      }
+    }
+    return this.defaultPdsEndpoints();
+  }
+  async reportConnection(accessToken) {
+    if (!this.config.projectId || !this.config.adminUrl) return;
+    const lastReport = await this.storage.get(STORAGE_KEYS.LAST_CONNECT_REPORT);
+    if (lastReport) {
+      const elapsed = Date.now() - parseInt(lastReport, 10);
+      if (elapsed < 24 * 60 * 60 * 1e3) return;
+    }
+    try {
+      await fetch(`${this.config.adminUrl}/project/${this.config.projectId}/user/connect`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ token: accessToken })
+      });
+      await this.storage.set(STORAGE_KEYS.LAST_CONNECT_REPORT, Date.now().toString());
+      log("Reported connection to admin server");
+    } catch (err) {
+      log("Failed to report connection (non-blocking):", err);
+    }
+  }
+  /**
+   * After a new token is stored, decode JWT claims and fetch user info.
+   */
+  async processNewToken() {
+    if (!this.token) {
+      this.isAuthReady = true;
+      this.notify();
+      return;
+    }
+    try {
+      const decoded = jwtDecode(this.token.access_token);
+      if (decoded.sub) this.did = decoded.sub;
+      if (decoded.scope) this.tokenScope = decoded.scope;
+      const expirationBuffer = 5;
+      const isExpired = decoded.exp && decoded.exp < Date.now() / 1e3 + expirationBuffer;
+      if (isExpired) {
+        log("token is expired - refreshing ...");
+        const refreshToken = this.token.refresh_token;
+        if (!refreshToken) {
+          log("Error: No refresh token available for expired token");
+          this.isAuthReady = true;
+          this.notify();
+          return;
+        }
+        try {
+          const newToken = await this.exchangeToken(refreshToken, true);
+          await this.fetchUser(newToken?.access_token || "");
+        } catch (error) {
+          log("Failed to refresh token in processNewToken:", error);
+          if (this.isNetworkError(error)) {
+            log("Network issue - continuing with expired token until online");
+            await this.fetchUser(this.token.access_token);
+          } else {
+            this.isAuthReady = true;
+            this.notify();
+          }
+        }
+      } else {
+        await this.fetchUser(this.token.access_token);
+      }
+    } catch (error) {
+      log("Error processing token:", error);
+      this.isAuthReady = true;
+      this.notify();
+    }
+  }
+  async fetchUser(accessToken) {
+    log("fetching user");
+    try {
+      const endpoints = await this.getActivePdsEndpoints();
+      const response = await fetch(endpoints.userinfo_endpoint, {
+        method: "GET",
+        headers: { "Authorization": `Bearer ${accessToken}` }
+      });
+      if (!response.ok) {
+        throw new Error(`Failed to fetch user info: ${response.status}`);
+      }
+      const user = await response.json();
+      if (user.error) {
+        log("error fetching user", user.error);
+        throw new Error(`User info error: ${user.error}`);
+      }
+      if (this.token?.refresh_token) {
+        await this.storage.set(STORAGE_KEYS.REFRESH_TOKEN, this.token.refresh_token);
+      }
+      await this.storage.set(STORAGE_KEYS.USER_INFO, JSON.stringify(user));
+      log("Cached user info in storage");
+      this.user = user;
+      this.isSignedIn = true;
+      this.isAuthReady = true;
+      if (this.freshSignIn) {
+        this.freshSignIn = false;
+        this.broadcastSignIn();
+      } else {
+        this.broadcastTokenRefresh();
+      }
+      this.notify();
+    } catch (error) {
+      log("Failed to fetch user info:", error);
+      this.isAuthReady = true;
+      this.notify();
+    }
+  }
+  /**
+   * Exchange an auth code or refresh token for an access token.
+   * Handles mutex (one in-flight refresh), token validation, and
+   * triggers processNewToken on success.
+   */
+  async exchangeToken(codeOrRefreshToken, isRefreshToken) {
+    if (!codeOrRefreshToken || codeOrRefreshToken.trim() === "") {
+      const errorMsg = isRefreshToken ? "Refresh token is empty or undefined" : "Authorization code is empty or undefined";
+      log("Error:", errorMsg);
+      throw new Error(errorMsg);
+    }
+    if (isRefreshToken && this.refreshPromise) {
+      log("Reusing in-flight refresh token request");
+      return this.refreshPromise;
+    }
+    if (!isRefreshToken && this.codeExchangePromise) {
+      log("Reusing in-flight code exchange request");
+      return this.codeExchangePromise;
+    }
+    const tokenPromise = (async () => {
+      try {
+        if (!this.isOnline) {
+          log("Network is offline, marking refresh as pending");
+          this.pendingRefresh = true;
+          throw new Error("Network offline - refresh will be retried when online");
+        }
+        const endpoints = await this.getActivePdsEndpoints();
+        let requestBody;
+        if (isRefreshToken) {
+          requestBody = {
+            grant_type: "refresh_token",
+            refresh_token: codeOrRefreshToken
+          };
+          if (this.config.projectId) {
+            requestBody.client_id = normalizeClientId(this.config.projectId, this.adminHostname);
+          }
+        } else {
+          requestBody = {
+            grant_type: "authorization_code",
+            code: codeOrRefreshToken
+          };
+          const storedRedirectUri = await this.storage.get(STORAGE_KEYS.REDIRECT_URI);
+          if (storedRedirectUri) {
+            requestBody.redirect_uri = storedRedirectUri;
+            log("Including redirect_uri in token exchange:", storedRedirectUri);
+          } else {
+            log("Warning: No redirect_uri found in storage for token exchange");
+          }
+          const codeVerifier = await this.storage.get(STORAGE_KEYS.CODE_VERIFIER);
+          if (codeVerifier) {
+            requestBody.code_verifier = codeVerifier;
+          }
+          if (this.config.projectId) {
+            requestBody.client_id = normalizeClientId(this.config.projectId, this.adminHostname);
+          }
+        }
+        log("Token exchange request body:", {
+          ...requestBody,
+          ...isRefreshToken ? { refresh_token: "[REDACTED]" } : { code: "[REDACTED]" },
+          ...requestBody.code_verifier ? { code_verifier: "[REDACTED]" } : {}
+        });
+        const token = await fetch(endpoints.token_endpoint, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(requestBody)
+        }).then((response) => response.json()).catch((error) => {
+          log("Network error fetching token:", error);
+          if (!this.isOnline) {
+            this.pendingRefresh = true;
+            throw new Error("Network offline - refresh will be retried when online");
+          }
+          throw new Error("Network error during token refresh");
+        });
+        if (token.access_token) {
+          try {
+            const decoded = jwtDecode(token.access_token);
+            if (decoded.typ === "refresh") {
+              log("Error: received refresh token as access token");
+              throw new Error("Invalid token: received refresh token instead of access token");
+            }
+          } catch (decodeError) {
+            if (decodeError.message.includes("Invalid token")) {
+              throw decodeError;
+            }
+            log("Warning: could not decode access token for type check:", decodeError);
+          }
+        }
+        if (token.error) {
+          log("error fetching token", token.error);
+          if (typeof token.error === "string" && (token.error.includes("network") || token.error.includes("timeout"))) {
+            this.pendingRefresh = true;
+            throw new Error("Network issue - refresh will be retried when online");
+          }
+          await this.clearStoredAuth();
+          this.resetAuthState();
+          this.notify();
+          throw new Error(`Token refresh failed: ${token.error}`);
+        } else {
+          this.token = token;
+          this.pendingRefresh = false;
+          if (token.refresh_token) {
+            await this.storage.set(STORAGE_KEYS.REFRESH_TOKEN, token.refresh_token);
+            log("Updated refresh token in storage");
+          }
+          if (!isRefreshToken) {
+            await this.storage.remove(STORAGE_KEYS.REDIRECT_URI);
+            await this.storage.remove(STORAGE_KEYS.CODE_VERIFIER);
+            log("Cleaned up redirect_uri and code_verifier from storage after successful exchange");
+          }
+          this.reportConnection(token.access_token).catch(() => {
+          });
+          await this.processNewToken();
+        }
+        return token;
+      } catch (error) {
+        log("Token refresh error:", error);
+        if (!this.isNetworkError(error)) {
+          await this.clearStoredAuth();
+          this.resetAuthState();
+          this.notify();
+        }
+        throw error;
+      }
+    })();
+    if (isRefreshToken) {
+      this.refreshPromise = tokenPromise;
+      tokenPromise.finally(() => {
+        if (this.refreshPromise === tokenPromise) {
+          this.refreshPromise = null;
+          log("Cleared refresh promise reference");
+        }
+      });
+    } else {
+      this.codeExchangePromise = tokenPromise;
+      tokenPromise.finally(() => {
+        if (this.codeExchangePromise === tokenPromise) {
+          this.codeExchangePromise = null;
+          log("Cleared code exchange promise reference");
+        }
+      });
+    }
+    return tokenPromise;
+  }
+  resetAuthState() {
+    this.user = null;
+    this.isSignedIn = false;
+    this.token = null;
+    this.did = null;
+    this.tokenScope = null;
+    this.isAuthReady = true;
+  }
+  async clearStoredAuth() {
+    await this.storage.remove(STORAGE_KEYS.REFRESH_TOKEN);
+    await this.storage.remove(STORAGE_KEYS.USER_INFO);
+    await this.storage.remove(STORAGE_KEYS.REDIRECT_URI);
+    await this.storage.remove(STORAGE_KEYS.CODE_VERIFIER);
+    await this.storage.remove(STORAGE_KEYS.SERVER_URL);
+    await this.storage.remove(STORAGE_KEYS.PDS_ENDPOINTS);
+  }
+  isNetworkError(error) {
+    if (error instanceof Error) {
+      return error.message.includes("offline") || error.message.includes("Network");
+    }
+    return false;
+  }
+};
+
+// src/AuthContext.tsx
+init_config();
+init_package();
+
+// src/updater/versionUpdater.ts
+init_config();
+var VersionUpdater = class {
+  storage;
+  currentVersion;
+  migrations;
+  versionKey = "basic_app_version";
+  constructor(storage, currentVersion, migrations = []) {
+    this.storage = storage;
+    this.currentVersion = currentVersion;
+    this.migrations = migrations.sort((a, b) => this.compareVersions(a.fromVersion, b.fromVersion));
   }
   /**
    * Check current stored version and run migrations if needed
@@ -656,7 +2346,7 @@ var VersionUpdater = class {
     }
     for (const migration of migrationsToRun) {
       try {
-        console.log(`Running migration from ${migration.fromVersion} to ${migration.toVersion}`);
+        log(`Running migration from ${migration.fromVersion} to ${migration.toVersion}`);
         await migration.migrate(this.storage);
       } catch (error) {
         console.error(`Migration failed from ${migration.fromVersion} to ${migration.toVersion}:`, error);
@@ -669,8 +2359,7 @@ var VersionUpdater = class {
   async getStoredVersion() {
     try {
       const versionData = await this.storage.get(this.versionKey);
-      if (!versionData)
-        return null;
+      if (!versionData) return null;
       const versionInfo = JSON.parse(versionData);
       return versionInfo.version;
     } catch (error) {
@@ -689,11 +2378,8 @@ var VersionUpdater = class {
     return this.migrations.filter((migration) => {
       const storedLessThanMigrationTo = this.compareVersions(fromVersion, migration.toVersion) < 0;
       const currentGreaterThanOrEqualMigrationTo = this.compareVersions(toVersion, migration.toVersion) >= 0;
-      console.log(`Checking migration ${migration.fromVersion} \u2192 ${migration.toVersion}:`);
-      console.log(`  stored ${fromVersion} < migration.to ${migration.toVersion}: ${storedLessThanMigrationTo}`);
-      console.log(`  current ${toVersion} >= migration.to ${migration.toVersion}: ${currentGreaterThanOrEqualMigrationTo}`);
       const shouldRun = storedLessThanMigrationTo && currentGreaterThanOrEqualMigrationTo;
-      console.log(`  Should run: ${shouldRun}`);
+      log(`Migration ${migration.fromVersion} \u2192 ${migration.toVersion}: shouldRun=${shouldRun}`);
       return shouldRun;
     });
   }
@@ -735,11 +2421,12 @@ function createVersionUpdater(storage, currentVersion, migrations = []) {
 }
 
 // src/updater/updateMigrations.ts
+init_config();
 var addMigrationTimestamp = {
   fromVersion: "0.6.0",
   toVersion: "0.7.0",
   async migrate(storage) {
-    console.log("Running test migration");
+    log("Running migration 0.6.0 \u2192 0.7.0");
     storage.set("test_migration", "true");
   }
 };
@@ -749,129 +2436,15 @@ function getMigrations() {
   ];
 }
 
-// src/utils/storage.ts
-var LocalStorageAdapter = class {
-  async get(key) {
-    return localStorage.getItem(key);
-  }
-  async set(key, value) {
-    localStorage.setItem(key, value);
-  }
-  async remove(key) {
-    localStorage.removeItem(key);
-  }
-};
-var STORAGE_KEYS = {
-  REFRESH_TOKEN: "basic_refresh_token",
-  USER_INFO: "basic_user_info",
-  AUTH_STATE: "basic_auth_state",
-  REDIRECT_URI: "basic_redirect_uri",
-  SERVER_URL: "basic_server_url",
-  DEBUG: "basic_debug"
-};
-function getCookie(name) {
-  let cookieValue = "";
-  if (document.cookie && document.cookie !== "") {
-    const cookies = document.cookie.split(";");
-    for (let i = 0; i < cookies.length; i++) {
-      const cookie = cookies[i]?.trim();
-      if (cookie && cookie.substring(0, name.length + 1) === name + "=") {
-        cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
-        break;
-      }
-    }
-  }
-  return cookieValue;
-}
-function setCookie(name, value, options) {
-  const opts = {
-    secure: true,
-    sameSite: "Strict",
-    httpOnly: false,
-    ...options
-  };
-  let cookieString = `${name}=${value}`;
-  if (opts.secure)
-    cookieString += "; Secure";
-  if (opts.sameSite)
-    cookieString += `; SameSite=${opts.sameSite}`;
-  if (opts.httpOnly)
-    cookieString += "; HttpOnly";
-  document.cookie = cookieString;
-}
-function clearCookie(name) {
-  document.cookie = `${name}=; Secure; SameSite=Strict`;
-}
-
-// src/utils/network.ts
-init_config();
-function isDevelopment(debug) {
-  return window.location.hostname === "localhost" || window.location.hostname === "127.0.0.1" || window.location.hostname.includes("localhost") || window.location.hostname.includes("127.0.0.1") || window.location.hostname.includes(".local") || process.env.NODE_ENV === "development" || debug === true;
-}
-async function checkForNewVersion() {
-  try {
-    const isBeta = version.includes("beta");
-    const response = await fetch(`https://registry.npmjs.org/@basictech/react/${isBeta ? "beta" : "latest"}`);
-    if (!response.ok) {
-      throw new Error("Failed to fetch version from npm");
-    }
-    const data = await response.json();
-    const latestVersion = data.version;
-    if (latestVersion !== version) {
-      console.warn("[basic] New version available:", latestVersion, `
-run "npm install @basictech/react@${latestVersion}" to update`);
-    }
-    if (isBeta) {
-      log("thank you for being on basictech/react beta :)");
-    }
-    return {
-      hasNewVersion: version !== latestVersion,
-      latestVersion,
-      currentVersion: version
-    };
-  } catch (error) {
-    log("Error checking for new version:", error);
-    return {
-      hasNewVersion: false,
-      latestVersion: null,
-      currentVersion: null
-    };
-  }
-}
-function cleanOAuthParamsFromUrl() {
-  if (window.location.search.includes("code") || window.location.search.includes("state")) {
-    const url = new URL(window.location.href);
-    url.searchParams.delete("code");
-    url.searchParams.delete("state");
-    window.history.pushState({}, document.title, url.pathname + url.search);
-    log("Cleaned OAuth parameters from URL");
-  }
-}
-function getSyncStatus(statusCode) {
-  switch (statusCode) {
-    case -1:
-      return "ERROR";
-    case 0:
-      return "OFFLINE";
-    case 1:
-      return "CONNECTING";
-    case 2:
-      return "ONLINE";
-    case 3:
-      return "SYNCING";
-    case 4:
-      return "ERROR_WILL_RETRY";
-    default:
-      return "UNKNOWN";
-  }
-}
+// src/AuthContext.tsx
+init_network();
 
 // src/utils/schema.ts
 init_config();
-import { validateSchema as validateSchema2, compareSchemas } from "@basictech/schema";
+import { validateSchema, compareSchemas } from "@basictech/schema";
 async function getSchemaStatus(schema) {
   const projectId = schema.project_id;
-  const valid = validateSchema2(schema);
+  const valid = validateSchema(schema);
   if (!valid.valid) {
     console.warn("BasicDB Error: your local schema is invalid. Please fix errors and try again - sync is disabled");
     return {
@@ -887,7 +2460,6 @@ async function getSchemaStatus(schema) {
       latest: null
     };
   });
-  console.log("latestSchema", latestSchema);
   if (!latestSchema.version) {
     return {
       valid: false,
@@ -934,7 +2506,7 @@ async function getSchemaStatus(schema) {
   }
 }
 async function validateAndCheckSchema(schema) {
-  const valid = validateSchema2(schema);
+  const valid = validateSchema(schema);
   if (!valid.valid) {
     log("Basic Schema is invalid!", valid.errors);
     console.group("Schema Errors");
@@ -956,6 +2528,7 @@ async function validateAndCheckSchema(schema) {
     schemaStatus = await getSchemaStatus(schema);
     log("schemaStatus", schemaStatus);
   } else {
+    schemaStatus = { valid: false, status: "unpublished" };
     log("schema not published - at version 0");
   }
   return {
@@ -965,40 +2538,28 @@ async function validateAndCheckSchema(schema) {
 }
 
 // src/AuthContext.tsx
-import { jsx, jsxs } from "react/jsx-runtime";
+init_context();
+init_context();
+import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
+var BasicDevToolbar2 = lazy(
+  () => Promise.resolve().then(() => (init_BasicDevToolbar(), BasicDevToolbar_exports)).then((m) => ({ default: m.BasicDevToolbar }))
+);
 var DEFAULT_AUTH_CONFIG = {
   scopes: "profile,email,app:admin",
-  server_url: "https://api.basic.tech",
+  pds_url: "https://pds.basic.id",
+  admin_url: "https://api.basic.tech",
   ws_url: "wss://pds.basic.id/ws"
 };
-var noDb = {
-  collection: () => {
-    throw new Error("no basicdb found - initialization failed. double check your schema.");
-  }
-};
-var BasicContext = createContext({
-  // Auth state
-  isReady: false,
-  isSignedIn: false,
-  user: null,
-  // Auth actions
-  signIn: () => Promise.resolve(),
-  signOut: () => Promise.resolve(),
-  signInWithCode: () => Promise.resolve({ success: false }),
-  // Token management
-  getToken: () => Promise.reject(new Error("no token")),
-  getSignInUrl: () => Promise.resolve(""),
-  // DB access
-  db: noDb,
-  dbStatus: "LOADING" /* LOADING */,
-  dbMode: "sync",
-  // Legacy aliases
-  isAuthReady: false,
-  signin: () => Promise.resolve(),
-  signout: () => Promise.resolve(),
-  signinWithCode: () => Promise.resolve({ success: false }),
-  getSignInLink: () => Promise.resolve("")
-});
+function snapshotAuth(mgr) {
+  return {
+    isSignedIn: mgr.isSignedIn,
+    hasToken: !!mgr.token,
+    isAuthReady: mgr.isAuthReady,
+    user: mgr.user,
+    did: mgr.did,
+    tokenScope: mgr.tokenScope
+  };
+}
 function BasicProvider({
   children,
   project_id: project_id_prop,
@@ -1006,67 +2567,121 @@ function BasicProvider({
   debug = false,
   storage,
   auth,
-  dbMode = "sync"
+  dbMode = "sync",
+  devToolbar = false
 }) {
   const project_id = schema?.project_id || project_id_prop;
-  const [isAuthReady, setIsAuthReady] = useState(false);
-  const [isSignedIn, setIsSignedIn] = useState(false);
-  const [token, setToken] = useState(null);
-  const [user, setUser] = useState({});
-  const [shouldConnect, setShouldConnect] = useState(false);
-  const [isReady, setIsReady] = useState(false);
-  const [dbStatus, setDbStatus] = useState("OFFLINE" /* OFFLINE */);
-  const [error, setError] = useState(null);
-  const [isOnline, setIsOnline] = useState(navigator.onLine);
-  const [pendingRefresh, setPendingRefresh] = useState(false);
-  const syncRef = useRef(null);
-  const remoteDbRef = useRef(null);
-  const storageAdapter = storage || new LocalStorageAdapter();
+  if (auth?.server_url && !auth?.pds_url) {
+    log("Warning: auth.server_url is deprecated, use auth.pds_url instead");
+  }
   const authConfig = {
     scopes: auth?.scopes || DEFAULT_AUTH_CONFIG.scopes,
-    server_url: auth?.server_url || DEFAULT_AUTH_CONFIG.server_url,
+    pds_url: auth?.pds_url || auth?.server_url || DEFAULT_AUTH_CONFIG.pds_url,
+    admin_url: auth?.admin_url || DEFAULT_AUTH_CONFIG.admin_url,
     ws_url: auth?.ws_url || DEFAULT_AUTH_CONFIG.ws_url
   };
   const scopesString = Array.isArray(authConfig.scopes) ? authConfig.scopes.join(" ") : authConfig.scopes;
-  const refreshPromiseRef = useRef(null);
+  const storageRef = useRef(storage || new LocalStorageAdapter());
+  const storageAdapter = storageRef.current;
+  const schemaRef = useRef(schema);
+  schemaRef.current = schema;
+  const [authState, setAuthState] = useState2({
+    isSignedIn: false,
+    hasToken: false,
+    isAuthReady: false,
+    user: null,
+    did: null,
+    tokenScope: null
+  });
+  const authRef = useRef(null);
+  if (!authRef.current) {
+    authRef.current = new AuthManager(
+      {
+        projectId: project_id,
+        scopes: scopesString,
+        pdsUrl: authConfig.pds_url,
+        adminUrl: authConfig.admin_url,
+        debug
+      },
+      storageAdapter,
+      () => setAuthState(snapshotAuth(authRef.current))
+    );
+  }
+  const syncRef = useRef(null);
+  const remoteDbRef = useRef(null);
+  const [shouldConnect, setShouldConnect] = useState2(false);
+  const [dbStatus, setDbStatus] = useState2("OFFLINE" /* OFFLINE */);
+  const [isReady, setIsReady] = useState2(false);
+  const [error, setError] = useState2(null);
+  const [schemaDevInfo, setSchemaDevInfo] = useState2(null);
   const isDevMode = () => isDevelopment(debug);
-  const cleanOAuthParams = () => cleanOAuthParamsFromUrl();
+  const refreshSchemaStatus = useCallback2(async () => {
+    const s = schemaRef.current;
+    if (!s) {
+      setSchemaDevInfo(
+        project_id ? {
+          projectId: project_id,
+          localVersion: void 0,
+          status: "no_schema",
+          valid: false,
+          lastCheckedAt: Date.now()
+        } : null
+      );
+      return;
+    }
+    const result = await validateAndCheckSchema(s);
+    if (!result.isValid) {
+      const errText = result.errors?.map((e) => e.message || "").join("; ") || "invalid";
+      setSchemaDevInfo({
+        projectId: s.project_id ?? null,
+        localVersion: s.version,
+        status: "invalid",
+        valid: false,
+        lastCheckedAt: Date.now(),
+        error: errText
+      });
+      return;
+    }
+    setSchemaDevInfo({
+      projectId: s.project_id ?? null,
+      localVersion: s.version,
+      status: result.schemaStatus.status ?? "unknown",
+      valid: result.schemaStatus.valid,
+      lastCheckedAt: Date.now()
+    });
+  }, [project_id]);
   useEffect(() => {
-    const handleOnline = () => {
-      log("Network came back online");
-      setIsOnline(true);
-      if (pendingRefresh) {
-        log("Retrying pending token refresh");
-        setPendingRefresh(false);
-        if (token) {
-          const refreshToken = token.refresh_token || localStorage.getItem("basic_refresh_token");
-          if (refreshToken) {
-            fetchToken(refreshToken, true).catch((error2) => {
-              log("Retry refresh failed:", error2);
-            });
-          }
+    const runVersionUpdater = async () => {
+      try {
+        const versionUpdater = createVersionUpdater(storageAdapter, version, getMigrations());
+        const updateResult = await versionUpdater.checkAndUpdate();
+        if (updateResult.updated) {
+          log(`App updated from ${updateResult.fromVersion} to ${updateResult.toVersion}`);
+        } else {
+          log(`App version ${updateResult.toVersion} is current`);
         }
+      } catch (error2) {
+        log("Version update failed:", error2);
       }
     };
-    const handleOffline = () => {
-      log("Network went offline");
-      setIsOnline(false);
-    };
-    window.addEventListener("online", handleOnline);
-    window.addEventListener("offline", handleOffline);
-    return () => {
-      window.removeEventListener("online", handleOnline);
-      window.removeEventListener("offline", handleOffline);
-    };
-  }, [pendingRefresh, token]);
+    runVersionUpdater();
+    authRef.current.initialize();
+    return authRef.current.setupNetworkListeners();
+  }, []);
   useEffect(() => {
     async function initSyncDb(options) {
       if (!syncRef.current) {
         log("Initializing Basic Sync DB");
         await initDexieExtensions();
         syncRef.current = new BasicSync("basicdb", { schema });
-        syncRef.current.syncable.on("statusChanged", (status, url) => {
-          setDbStatus(getSyncStatus(status));
+        syncRef.current.syncable.on("statusChanged", (status) => {
+          const newStatus = getSyncStatus(status);
+          setDbStatus(newStatus);
+          if (newStatus === "ERROR_WILL_RETRY" /* ERROR_WILL_RETRY */) {
+            log("Sync entered ERROR_WILL_RETRY - proactively refreshing token");
+            authRef.current.getToken({ forceRefresh: true }).catch(() => {
+            });
+          }
         });
         if (options.shouldConnect) {
           setShouldConnect(true);
@@ -1089,14 +2704,14 @@ function BasicProvider({
         }
         log("Initializing Basic Remote DB");
         remoteDbRef.current = new RemoteDB({
-          serverUrl: authConfig.server_url,
+          serverUrl: authConfig.pds_url,
           projectId: project_id,
-          getToken,
+          getToken: (opts) => authRef.current.getToken(opts),
           schema,
           debug,
           onAuthError: (error2) => {
             log("RemoteDB auth error:", error2);
-            signout();
+            handleSignOut();
           }
         });
         setDbStatus("ONLINE" /* ONLINE */);
@@ -1108,11 +2723,19 @@ function BasicProvider({
       if (!result.isValid) {
         let errorMessage = "";
         if (result.errors) {
-          result.errors.forEach((error2, index) => {
-            errorMessage += `${index + 1}: ${error2.message} - at ${error2.instancePath}
+          result.errors.forEach((err, index) => {
+            errorMessage += `${index + 1}: ${err.message} - at ${err.instancePath}
 `;
           });
         }
+        setSchemaDevInfo({
+          projectId: schema?.project_id ?? null,
+          localVersion: schema?.version,
+          status: "invalid",
+          valid: false,
+          lastCheckedAt: Date.now(),
+          error: errorMessage.trim() || void 0
+        });
         setError({
           code: "schema_invalid",
           title: "Basic Schema is invalid!",
@@ -1121,13 +2744,24 @@ function BasicProvider({
         setIsReady(true);
         return null;
       }
+      setSchemaDevInfo({
+        projectId: schema?.project_id ?? null,
+        localVersion: schema?.version,
+        status: result.schemaStatus.status ?? "unknown",
+        valid: result.schemaStatus.valid,
+        lastCheckedAt: Date.now()
+      });
       if (dbMode === "remote") {
         initRemoteDb();
       } else {
         if (result.schemaStatus.valid) {
           await initSyncDb({ shouldConnect: true });
         } else {
-          log("Schema is invalid!", result.schemaStatus);
+          if (result.schemaStatus.status === "unpublished") {
+            log("Schema not published yet (version 0) - sync is disabled. Publish your schema to enable sync.");
+          } else {
+            log("Schema is invalid!", result.schemaStatus);
+          }
           await initSyncDb({ shouldConnect: false });
         }
       }
@@ -1136,6 +2770,15 @@ function BasicProvider({
     if (schema) {
       checkSchema();
     } else {
+      setSchemaDevInfo(
+        project_id ? {
+          projectId: project_id,
+          localVersion: void 0,
+          status: "no_schema",
+          valid: false,
+          lastCheckedAt: Date.now()
+        } : null
+      );
       if (dbMode === "remote" && project_id) {
         initRemoteDb();
       } else {
@@ -1144,220 +2787,33 @@ function BasicProvider({
     }
   }, []);
   useEffect(() => {
-    async function connectToDb() {
-      if (token && syncRef.current && isSignedIn && shouldConnect) {
-        const tok = await getToken();
-        if (!tok) {
-          log("no token found");
-          return;
-        }
-        log("connecting to db...");
-        syncRef.current?.connect({
-          access_token: tok,
-          ws_url: authConfig.ws_url
-        }).catch((e) => {
-          log("error connecting to db", e);
-        });
-      }
+    if (authState.hasToken && syncRef.current && authState.isSignedIn && shouldConnect) {
+      log("connecting to db...");
+      syncRef.current?.connect({
+        getToken: (opts) => authRef.current.getToken(opts),
+        ws_url: authConfig.ws_url
+      }).catch((e) => {
+        log("error connecting to db", e);
+      });
     }
-    connectToDb();
-  }, [isSignedIn, shouldConnect]);
-  useEffect(() => {
-    const initializeAuth = async () => {
-      await storageAdapter.set(STORAGE_KEYS.DEBUG, debug ? "true" : "false");
-      const storedServerUrl = await storageAdapter.get(STORAGE_KEYS.SERVER_URL);
-      if (storedServerUrl && storedServerUrl !== authConfig.server_url) {
-        log("Server URL changed, clearing stored tokens");
-        await storageAdapter.remove(STORAGE_KEYS.REFRESH_TOKEN);
-        await storageAdapter.remove(STORAGE_KEYS.USER_INFO);
-        await storageAdapter.remove(STORAGE_KEYS.AUTH_STATE);
-        await storageAdapter.remove(STORAGE_KEYS.REDIRECT_URI);
-        clearCookie("basic_token");
-        clearCookie("basic_access_token");
-      }
-      await storageAdapter.set(STORAGE_KEYS.SERVER_URL, authConfig.server_url);
-      try {
-        const versionUpdater = createVersionUpdater(storageAdapter, version, getMigrations());
-        const updateResult = await versionUpdater.checkAndUpdate();
-        if (updateResult.updated) {
-          log(`App updated from ${updateResult.fromVersion} to ${updateResult.toVersion}`);
-        } else {
-          log(`App version ${updateResult.toVersion} is current`);
-        }
-      } catch (error2) {
-        log("Version update failed:", error2);
-      }
-      try {
-        if (window.location.search.includes("code")) {
-          let code = window.location?.search?.split("code=")[1]?.split("&")[0];
-          if (!code)
-            return;
-          const state = await storageAdapter.get(STORAGE_KEYS.AUTH_STATE);
-          const urlState = window.location.search.split("state=")[1]?.split("&")[0];
-          if (!state || state !== urlState) {
-            log("error: auth state does not match");
-            setIsAuthReady(true);
-            await storageAdapter.remove(STORAGE_KEYS.AUTH_STATE);
-            cleanOAuthParams();
-            return;
-          }
-          await storageAdapter.remove(STORAGE_KEYS.AUTH_STATE);
-          cleanOAuthParams();
-          fetchToken(code, false).catch((error2) => {
-            log("Error fetching token:", error2);
-          });
-        } else {
-          const refreshToken = await storageAdapter.get(STORAGE_KEYS.REFRESH_TOKEN);
-          if (refreshToken) {
-            log("Found refresh token in storage, attempting to refresh access token");
-            fetchToken(refreshToken, true).catch((error2) => {
-              log("Error fetching refresh token:", error2);
-            });
-          } else {
-            let cookie_token = getCookie("basic_token");
-            if (cookie_token !== "") {
-              const tokenData = JSON.parse(cookie_token);
-              setToken(tokenData);
-              if (tokenData.refresh_token) {
-                await storageAdapter.set(STORAGE_KEYS.REFRESH_TOKEN, tokenData.refresh_token);
-              }
-            } else {
-              const cachedUserInfo = await storageAdapter.get(STORAGE_KEYS.USER_INFO);
-              if (cachedUserInfo) {
-                try {
-                  const userData = JSON.parse(cachedUserInfo);
-                  setUser(userData);
-                  setIsSignedIn(true);
-                  log("Loaded cached user info for offline mode");
-                } catch (error2) {
-                  log("Error parsing cached user info:", error2);
-                }
-              }
-              setIsAuthReady(true);
-            }
-          }
-        }
-      } catch (e) {
-        log("error getting token", e);
-      }
-    };
-    initializeAuth();
-  }, []);
-  useEffect(() => {
-    async function fetchUser(acc_token) {
-      console.info("fetching user");
+  }, [authState.isSignedIn, authState.hasToken, shouldConnect]);
+  const handleSignOut = async () => {
+    await authRef.current.signOut();
+    if (syncRef.current) {
       try {
-        const response = await fetch(`${authConfig.server_url}/auth/userInfo`, {
-          method: "GET",
-          headers: {
-            "Authorization": `Bearer ${acc_token}`
-          }
-        });
-        if (!response.ok) {
-          throw new Error(`Failed to fetch user info: ${response.status}`);
-        }
-        const user2 = await response.json();
-        if (user2.error) {
-          log("error fetching user", user2.error);
-          throw new Error(`User info error: ${user2.error}`);
-        }
-        if (token?.refresh_token) {
-          await storageAdapter.set(STORAGE_KEYS.REFRESH_TOKEN, token.refresh_token);
-        }
-        await storageAdapter.set(STORAGE_KEYS.USER_INFO, JSON.stringify(user2));
-        log("Cached user info in storage");
-        setCookie("basic_access_token", token?.access_token || "", { httpOnly: false });
-        setCookie("basic_token", JSON.stringify(token));
-        setUser(user2);
-        setIsSignedIn(true);
-        setIsAuthReady(true);
+        await syncRef.current.close();
+        await syncRef.current.delete({ disableAutoOpen: false });
+        syncRef.current = null;
+        window?.location?.reload();
       } catch (error2) {
-        log("Failed to fetch user info:", error2);
-        setIsAuthReady(true);
-      }
-    }
-    async function checkToken() {
-      if (!token) {
-        log("error: no user token found");
-        setIsAuthReady(true);
-        return;
+        console.error("Error during database cleanup:", error2);
       }
-      const decoded = jwtDecode(token?.access_token);
-      const expirationBuffer = 5;
-      const isExpired = decoded.exp && decoded.exp < Date.now() / 1e3 + expirationBuffer;
-      if (isExpired) {
-        log("token is expired - refreshing ...");
-        const refreshToken = token?.refresh_token;
-        if (!refreshToken) {
-          log("Error: No refresh token available for expired token");
-          setIsAuthReady(true);
-          return;
-        }
-        try {
-          const newToken = await fetchToken(refreshToken, true);
-          fetchUser(newToken?.access_token || "");
-        } catch (error2) {
-          log("Failed to refresh token in checkToken:", error2);
-          if (error2.message.includes("offline") || error2.message.includes("Network")) {
-            log("Network issue - continuing with expired token until online");
-            fetchUser(token?.access_token || "");
-          } else {
-            setIsAuthReady(true);
-          }
-        }
-      } else {
-        fetchUser(token?.access_token || "");
-      }
-    }
-    if (token) {
-      checkToken();
-    }
-  }, [token]);
-  const getSignInLink = async (redirectUri) => {
-    try {
-      log("getting sign in link...");
-      if (!project_id) {
-        throw new Error("Project ID is required to generate sign-in link");
-      }
-      const randomState = Math.random().toString(36).substring(6);
-      await storageAdapter.set(STORAGE_KEYS.AUTH_STATE, randomState);
-      const redirectUrl = redirectUri || window.location.href;
-      if (!redirectUrl || !redirectUrl.startsWith("http://") && !redirectUrl.startsWith("https://")) {
-        throw new Error("Invalid redirect URI provided");
-      }
-      await storageAdapter.set(STORAGE_KEYS.REDIRECT_URI, redirectUrl);
-      log("Stored redirect_uri for token exchange:", redirectUrl);
-      let baseUrl = `${authConfig.server_url}/auth/authorize`;
-      baseUrl += `?client_id=${project_id}`;
-      baseUrl += `&redirect_uri=${encodeURIComponent(redirectUrl)}`;
-      baseUrl += `&response_type=code`;
-      baseUrl += `&scope=${encodeURIComponent(scopesString)}`;
-      baseUrl += `&state=${randomState}`;
-      log("Generated sign-in link successfully with scopes:", scopesString);
-      return baseUrl;
-    } catch (error2) {
-      log("Error generating sign-in link:", error2);
-      throw error2;
     }
   };
-  const signin = async () => {
+  const handleSignIn = async () => {
     try {
-      log("signing in...");
-      if (!project_id) {
-        log("Error: project_id is required for sign-in");
-        throw new Error("Project ID is required for authentication");
-      }
-      const signInLink = await getSignInLink();
-      log("Generated sign-in link:", signInLink);
-      try {
-        new URL(signInLink);
-      } catch {
-        log("Error: Invalid sign-in link generated");
-        throw new Error("Failed to generate valid sign-in URL");
-      }
-      window.location.href = signInLink;
+      await authRef.current.signIn();
     } catch (error2) {
-      log("Error during sign-in:", error2);
       if (isDevMode()) {
         setError({
           code: "signin_error",
@@ -1368,255 +2824,19 @@ function BasicProvider({
       throw error2;
     }
   };
-  const signinWithCode = async (code, state) => {
+  const handleSignInWithHandle = async (handle) => {
     try {
-      log("signinWithCode called with code:", code);
-      if (!code || typeof code !== "string") {
-        return { success: false, error: "Invalid authorization code" };
-      }
-      if (state) {
-        const storedState = await storageAdapter.get(STORAGE_KEYS.AUTH_STATE);
-        if (storedState && storedState !== state) {
-          log("State parameter mismatch:", { provided: state, stored: storedState });
-          return { success: false, error: "State parameter mismatch" };
-        }
-      }
-      await storageAdapter.remove(STORAGE_KEYS.AUTH_STATE);
-      cleanOAuthParams();
-      const token2 = await fetchToken(code, false);
-      if (token2) {
-        log("signinWithCode successful");
-        return { success: true };
-      } else {
-        return { success: false, error: "Failed to exchange code for token" };
-      }
+      await authRef.current.signInWithHandle(handle);
     } catch (error2) {
-      log("signinWithCode error:", error2);
-      return {
-        success: false,
-        error: error2.message || "Authentication failed"
-      };
-    }
-  };
-  const signout = async () => {
-    log("signing out!");
-    setUser({});
-    setIsSignedIn(false);
-    setToken(null);
-    clearCookie("basic_token");
-    clearCookie("basic_access_token");
-    await storageAdapter.remove(STORAGE_KEYS.AUTH_STATE);
-    await storageAdapter.remove(STORAGE_KEYS.REFRESH_TOKEN);
-    await storageAdapter.remove(STORAGE_KEYS.USER_INFO);
-    await storageAdapter.remove(STORAGE_KEYS.REDIRECT_URI);
-    await storageAdapter.remove(STORAGE_KEYS.SERVER_URL);
-    if (syncRef.current) {
-      (async () => {
-        try {
-          await syncRef.current?.close();
-          await syncRef.current?.delete({ disableAutoOpen: false });
-          syncRef.current = null;
-          window?.location?.reload();
-        } catch (error2) {
-          console.error("Error during database cleanup:", error2);
-        }
-      })();
-    }
-  };
-  const getToken = async () => {
-    log("getting token...");
-    if (!token) {
-      const refreshToken = await storageAdapter.get(STORAGE_KEYS.REFRESH_TOKEN);
-      if (refreshToken) {
-        log("No token in memory, attempting to refresh from storage");
-        if (refreshPromiseRef.current) {
-          log("Token refresh already in progress, waiting...");
-          try {
-            const newToken = await refreshPromiseRef.current;
-            if (newToken?.access_token) {
-              return newToken.access_token;
-            }
-          } catch (error2) {
-            log("In-flight refresh failed:", error2);
-            throw error2;
-          }
-        }
-        try {
-          const newToken = await fetchToken(refreshToken, true);
-          if (newToken?.access_token) {
-            return newToken.access_token;
-          }
-        } catch (error2) {
-          log("Failed to refresh token from storage:", error2);
-          if (error2.message.includes("offline") || error2.message.includes("Network")) {
-            log("Network issue - continuing with potentially expired token");
-            const lastToken = localStorage.getItem("basic_access_token");
-            if (lastToken) {
-              return lastToken;
-            }
-            throw new Error("Network offline - authentication will be retried when online");
-          }
-          throw new Error("Authentication expired. Please sign in again.");
-        }
-      }
-      log("no token found");
-      throw new Error("no token found");
-    }
-    const decoded = jwtDecode(token?.access_token);
-    const expirationBuffer = 5;
-    const isExpired = decoded.exp && decoded.exp < Date.now() / 1e3 + expirationBuffer;
-    if (isExpired) {
-      log("token is expired - refreshing ...");
-      if (refreshPromiseRef.current) {
-        log("Token refresh already in progress, waiting...");
-        try {
-          const newToken = await refreshPromiseRef.current;
-          return newToken?.access_token || "";
-        } catch (error2) {
-          log("In-flight refresh failed:", error2);
-          if (error2.message.includes("offline") || error2.message.includes("Network")) {
-            log("Network issue - using expired token until network is restored");
-            return token.access_token;
-          }
-          throw error2;
-        }
-      }
-      const refreshToken = token?.refresh_token || await storageAdapter.get(STORAGE_KEYS.REFRESH_TOKEN);
-      if (refreshToken) {
-        try {
-          const newToken = await fetchToken(refreshToken, true);
-          return newToken?.access_token || "";
-        } catch (error2) {
-          log("Failed to refresh expired token:", error2);
-          if (error2.message.includes("offline") || error2.message.includes("Network")) {
-            log("Network issue - using expired token until network is restored");
-            return token.access_token;
-          }
-          throw new Error("Authentication expired. Please sign in again.");
-        }
-      } else {
-        throw new Error("no refresh token available");
-      }
-    }
-    return token?.access_token || "";
-  };
-  const fetchToken = async (codeOrRefreshToken, isRefreshToken = false) => {
-    if (!codeOrRefreshToken || codeOrRefreshToken.trim() === "") {
-      const errorMsg = isRefreshToken ? "Refresh token is empty or undefined" : "Authorization code is empty or undefined";
-      log("Error:", errorMsg);
-      throw new Error(errorMsg);
-    }
-    if (isRefreshToken && refreshPromiseRef.current) {
-      log("Reusing in-flight refresh token request");
-      return refreshPromiseRef.current;
-    }
-    const refreshPromise = (async () => {
-      try {
-        if (!isOnline) {
-          log("Network is offline, marking refresh as pending");
-          setPendingRefresh(true);
-          throw new Error("Network offline - refresh will be retried when online");
-        }
-        let requestBody;
-        if (isRefreshToken) {
-          requestBody = {
-            grant_type: "refresh_token",
-            refresh_token: codeOrRefreshToken
-          };
-          if (project_id) {
-            requestBody.client_id = project_id;
-          }
-        } else {
-          requestBody = {
-            grant_type: "authorization_code",
-            code: codeOrRefreshToken
-          };
-          const storedRedirectUri = await storageAdapter.get(STORAGE_KEYS.REDIRECT_URI);
-          if (storedRedirectUri) {
-            requestBody.redirect_uri = storedRedirectUri;
-            log("Including redirect_uri in token exchange:", storedRedirectUri);
-          } else {
-            log("Warning: No redirect_uri found in storage for token exchange");
-          }
-          if (project_id) {
-            requestBody.client_id = project_id;
-          }
-        }
-        log("Token exchange request body:", { ...requestBody, refresh_token: isRefreshToken ? "[REDACTED]" : void 0, code: !isRefreshToken ? "[REDACTED]" : void 0 });
-        const token2 = await fetch(`${authConfig.server_url}/auth/token`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json"
-          },
-          body: JSON.stringify(requestBody)
-        }).then((response) => response.json()).catch((error2) => {
-          log("Network error fetching token:", error2);
-          if (!isOnline) {
-            setPendingRefresh(true);
-            throw new Error("Network offline - refresh will be retried when online");
-          }
-          throw new Error("Network error during token refresh");
+      if (isDevMode()) {
+        setError({
+          code: "signin_error",
+          title: "Sign-in Failed",
+          message: error2.message || "An error occurred during sign-in. Please try again."
         });
-        if (token2.error) {
-          log("error fetching token", token2.error);
-          if (token2.error.includes("network") || token2.error.includes("timeout")) {
-            setPendingRefresh(true);
-            throw new Error("Network issue - refresh will be retried when online");
-          }
-          await storageAdapter.remove(STORAGE_KEYS.REFRESH_TOKEN);
-          await storageAdapter.remove(STORAGE_KEYS.USER_INFO);
-          await storageAdapter.remove(STORAGE_KEYS.REDIRECT_URI);
-          await storageAdapter.remove(STORAGE_KEYS.SERVER_URL);
-          clearCookie("basic_token");
-          clearCookie("basic_access_token");
-          setUser({});
-          setIsSignedIn(false);
-          setToken(null);
-          setIsAuthReady(true);
-          throw new Error(`Token refresh failed: ${token2.error}`);
-        } else {
-          setToken(token2);
-          setPendingRefresh(false);
-          if (token2.refresh_token) {
-            await storageAdapter.set(STORAGE_KEYS.REFRESH_TOKEN, token2.refresh_token);
-            log("Updated refresh token in storage");
-          }
-          if (!isRefreshToken) {
-            await storageAdapter.remove(STORAGE_KEYS.REDIRECT_URI);
-            log("Cleaned up redirect_uri from storage after successful exchange");
-          }
-          setCookie("basic_access_token", token2.access_token, { httpOnly: false });
-          setCookie("basic_token", JSON.stringify(token2));
-          log("Updated access token and full token in cookies");
-        }
-        return token2;
-      } catch (error2) {
-        log("Token refresh error:", error2);
-        if (!error2.message.includes("offline") && !error2.message.includes("Network")) {
-          await storageAdapter.remove(STORAGE_KEYS.REFRESH_TOKEN);
-          await storageAdapter.remove(STORAGE_KEYS.USER_INFO);
-          await storageAdapter.remove(STORAGE_KEYS.REDIRECT_URI);
-          await storageAdapter.remove(STORAGE_KEYS.SERVER_URL);
-          clearCookie("basic_token");
-          clearCookie("basic_access_token");
-          setUser({});
-          setIsSignedIn(false);
-          setToken(null);
-          setIsAuthReady(true);
-        }
-        throw error2;
       }
-    })();
-    if (isRefreshToken) {
-      refreshPromiseRef.current = refreshPromise;
-      refreshPromise.finally(() => {
-        if (refreshPromiseRef.current === refreshPromise) {
-          refreshPromiseRef.current = null;
-          log("Cleared refresh promise reference");
-        }
-      });
+      throw error2;
     }
-    return refreshPromise;
   };
   const getCurrentDb = () => {
     if (dbMode === "remote") {
@@ -1625,69 +2845,81 @@ function BasicProvider({
     return syncRef.current || noDb;
   };
   const contextValue = {
-    // Auth state (new naming)
-    isReady: isAuthReady,
-    isSignedIn,
-    user,
-    // Auth actions (new camelCase naming)
-    signIn: signin,
-    signOut: signout,
-    signInWithCode: signinWithCode,
-    // Token management
-    getToken,
-    getSignInUrl: getSignInLink,
-    // DB access
+    isReady: authState.isAuthReady,
+    isSignedIn: authState.isSignedIn,
+    user: authState.user,
+    did: authState.did,
+    scope: authState.tokenScope,
+    hasScope: (s) => authRef.current.hasScope(s),
+    missingScopes: () => authRef.current.missingScopes(),
+    signIn: handleSignIn,
+    signInWithHandle: handleSignInWithHandle,
+    signOut: handleSignOut,
+    signInWithCode: (code, state) => authRef.current.signInWithCode(code, state),
+    getToken: (opts) => authRef.current.getToken(opts),
+    getSignInUrl: (redirectUri) => authRef.current.getSignInUrl(redirectUri),
     db: getCurrentDb(),
     dbStatus,
     dbMode,
-    // Legacy aliases (deprecated)
-    isAuthReady,
-    signin,
-    signout,
-    signinWithCode,
-    getSignInLink
+    devInfo: schemaDevInfo,
+    refreshSchemaStatus,
+    isAuthReady: authState.isAuthReady,
+    signin: handleSignIn,
+    signout: handleSignOut,
+    signinWithCode: (code, state) => authRef.current.signInWithCode(code, state),
+    getSignInLink: (redirectUri) => authRef.current.getSignInUrl(redirectUri)
   };
-  return /* @__PURE__ */ jsxs(BasicContext.Provider, { value: contextValue, children: [
-    error && isDevMode() && /* @__PURE__ */ jsx(ErrorDisplay, { error }),
+  return /* @__PURE__ */ jsxs2(BasicContext.Provider, { value: contextValue, children: [
+    error && isDevMode() && /* @__PURE__ */ jsx2(ErrorDisplay, { error }),
+    devToolbar && isDevMode() && /* @__PURE__ */ jsx2(Suspense, { fallback: null, children: /* @__PURE__ */ jsx2(BasicDevToolbar2, { debug }) }),
     isReady && children
   ] });
 }
 function ErrorDisplay({ error }) {
-  return /* @__PURE__ */ jsxs("div", { style: {
-    position: "absolute",
-    top: 20,
-    left: 20,
-    color: "black",
-    backgroundColor: "#f8d7da",
-    border: "1px solid #f5c6cb",
-    borderRadius: "4px",
-    padding: "20px",
-    maxWidth: "400px",
-    margin: "20px auto",
-    boxShadow: "0 2px 4px rgba(0, 0, 0, 0.1)",
-    fontFamily: "monospace"
-  }, children: [
-    /* @__PURE__ */ jsxs("h3", { style: { fontSize: "0.8rem", opacity: 0.8 }, children: [
-      "code: ",
-      error.code
-    ] }),
-    /* @__PURE__ */ jsx("h1", { style: { fontSize: "1.2rem", lineHeight: "1.5" }, children: error.title }),
-    /* @__PURE__ */ jsx("p", { children: error.message })
-  ] });
-}
-function useBasic() {
-  return useContext(BasicContext);
+  return /* @__PURE__ */ jsxs2(
+    "div",
+    {
+      style: {
+        position: "absolute",
+        top: 20,
+        left: 20,
+        color: "black",
+        backgroundColor: "#f8d7da",
+        border: "1px solid #f5c6cb",
+        borderRadius: "4px",
+        padding: "20px",
+        maxWidth: "400px",
+        margin: "20px auto",
+        boxShadow: "0 2px 4px rgba(0, 0, 0, 0.1)",
+        fontFamily: "monospace"
+      },
+      children: [
+        /* @__PURE__ */ jsxs2("h3", { style: { fontSize: "0.8rem", opacity: 0.8 }, children: [
+          "code: ",
+          error.code
+        ] }),
+        /* @__PURE__ */ jsx2("h1", { style: { fontSize: "1.2rem", lineHeight: 1.5 }, children: error.title }),
+        /* @__PURE__ */ jsx2("p", { children: error.message })
+      ]
+    }
+  );
 }
 
 // src/index.ts
+init_BasicDevToolbar();
 import { useLiveQuery as useQuery } from "dexie-react-hooks";
 export {
+  BasicDevToolbar,
   BasicProvider,
+  DBStatus,
   NotAuthenticatedError,
   RemoteCollection,
   RemoteDB,
   RemoteDBError,
   STORAGE_KEYS,
+  resolveDid,
+  resolveDidWebUrl,
+  resolveHandle,
   useBasic,
   useQuery
 };