@basictech/react 0.8.0-beta.3 → 0.9.0-beta.0

package/dist/index.mjs

@@ -8,6 +8,16 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/react/context.ts
+import { createContext } from "react";
+var BasicClientContext;
+var init_context = __esm({
+  "src/react/context.ts"() {
+    "use strict";
+    BasicClientContext = createContext(null);
+  }
+});
+
 // src/config.ts
 var log;
 var init_config = __esm({
@@ -24,227 +34,11 @@ var init_config = __esm({
   }
 });
 
-// src/sync/tokenRegistry.ts
-function setTokenGetter(url, fn) {
-  registry.set(url, fn);
-}
-function getTokenGetter(url) {
-  return registry.get(url);
-}
-var registry;
-var init_tokenRegistry = __esm({
-  "src/sync/tokenRegistry.ts"() {
-    "use strict";
-    registry = /* @__PURE__ */ new Map();
-  }
-});
-
-// src/sync/syncProtocol.js
-var syncProtocol_exports = {};
-__export(syncProtocol_exports, {
-  syncProtocol: () => syncProtocol
-});
-import { Dexie } from "dexie";
-function decodeJwtExp(token) {
-  try {
-    var parts = token.split(".");
-    if (parts.length !== 3) return null;
-    var payload = JSON.parse(atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")));
-    return typeof payload.exp === "number" ? payload.exp : null;
-  } catch (_) {
-    return null;
-  }
-}
-var syncProtocol;
-var init_syncProtocol = __esm({
-  "src/sync/syncProtocol.js"() {
-    "use strict";
-    "use client";
-    init_config();
-    init_tokenRegistry();
-    syncProtocol = function() {
-      log("Initializing syncProtocol");
-      var RECONNECT_DELAY = 5e3;
-      var TOKEN_REFRESH_BUFFER = 60;
-      Dexie.Syncable.registerSyncProtocol("websocket", {
-        sync: function(context, url, options, baseRevision, syncedRevision, changes, partial, applyRemoteChanges, onChangesAccepted, onSuccess, onError) {
-          var requestId = 0;
-          var acceptCallbacks = {};
-          var refreshTimer = null;
-          log("Connecting to", url);
-          var ws = new WebSocket(url);
-          function sendChanges(changes2, baseRevision2, partial2, onChangesAccepted2) {
-            log("sendChanges", changes2.length, baseRevision2);
-            ++requestId;
-            acceptCallbacks[requestId.toString()] = onChangesAccepted2;
-            ws.send(
-              JSON.stringify({
-                type: "changes",
-                changes: changes2,
-                partial: partial2,
-                baseRevision: baseRevision2,
-                requestId
-              })
-            );
-          }
-          function clearRefreshTimer() {
-            if (refreshTimer) {
-              clearTimeout(refreshTimer);
-              refreshTimer = null;
-            }
-          }
-          function resolveGetToken() {
-            var fn = getTokenGetter(url);
-            if (!fn) throw new Error("No token getter registered for " + url);
-            return fn;
-          }
-          function scheduleTokenRefresh(tokenStr) {
-            clearRefreshTimer();
-            var exp = decodeJwtExp(tokenStr);
-            if (!exp) return;
-            var msUntilRefresh = (exp - TOKEN_REFRESH_BUFFER) * 1e3 - Date.now();
-            if (msUntilRefresh <= 0) return;
-            log("Scheduling proactive token refresh in", Math.round(msUntilRefresh / 1e3), "s");
-            refreshTimer = setTimeout(async function() {
-              try {
-                var newToken = await resolveGetToken()({ forceRefresh: true });
-                if (ws.readyState === WebSocket.OPEN) {
-                  log("Sending tokenUpdate on existing WebSocket");
-                  ws.send(JSON.stringify({ type: "tokenUpdate", authToken: newToken }));
-                  scheduleTokenRefresh(newToken);
-                }
-              } catch (err) {
-                log("Proactive token refresh failed (non-fatal):", err);
-              }
-            }, msUntilRefresh);
-          }
-          ws.onopen = async function(event) {
-            try {
-              var token = await resolveGetToken()();
-              log("Opening socket - sending clientIdentity", context.clientIdentity);
-              ws.send(
-                JSON.stringify({
-                  type: "clientIdentity",
-                  clientIdentity: context.clientIdentity || null,
-                  authToken: token,
-                  schema: options.schema
-                })
-              );
-              scheduleTokenRefresh(token);
-            } catch (err) {
-              log("Failed to get token for WebSocket:", err);
-              ws.close();
-              onError("Authentication failed: " + (err.message || err), RECONNECT_DELAY);
-            }
-          };
-          function handleVisibilityResume() {
-            if (document.visibilityState === "visible" && ws.readyState === WebSocket.OPEN) {
-              log("Page became visible - refreshing token for WebSocket");
-              resolveGetToken()({ forceRefresh: true }).then(function(newToken) {
-                if (ws.readyState === WebSocket.OPEN) {
-                  ws.send(JSON.stringify({ type: "tokenUpdate", authToken: newToken }));
-                  scheduleTokenRefresh(newToken);
-                }
-              }).catch(function(err) {
-                log("Token refresh on visibility resume failed:", err);
-              });
-            }
-          }
-          if (typeof document !== "undefined") {
-            document.addEventListener("visibilitychange", handleVisibilityResume);
-          }
-          function cleanupVisibilityListener() {
-            if (typeof document !== "undefined") {
-              document.removeEventListener("visibilitychange", handleVisibilityResume);
-            }
-          }
-          ws.onerror = function(event) {
-            clearRefreshTimer();
-            cleanupVisibilityListener();
-            ws.close();
-            log("ws.onerror", event);
-            onError(event?.message, RECONNECT_DELAY);
-          };
-          ws.onclose = function(event) {
-            clearRefreshTimer();
-            cleanupVisibilityListener();
-            onError("Socket closed: " + event.reason, RECONNECT_DELAY);
-          };
-          var isFirstRound = true;
-          ws.onmessage = function(event) {
-            try {
-              var requestFromServer = JSON.parse(event.data);
-              log("requestFromServer", requestFromServer, { isFirstRound });
-              if (requestFromServer.type == "clientIdentity") {
-                context.clientIdentity = requestFromServer.clientIdentity;
-                context.save();
-                sendChanges(changes, baseRevision, partial, onChangesAccepted);
-                ws.send(
-                  JSON.stringify({
-                    type: "subscribe",
-                    syncedRevision
-                  })
-                );
-              } else if (requestFromServer.type == "changes") {
-                applyRemoteChanges(
-                  requestFromServer.changes,
-                  requestFromServer.currentRevision,
-                  requestFromServer.partial
-                );
-                if (isFirstRound && !requestFromServer.partial) {
-                  onSuccess({
-                    // Specify a react function that will react on additional client changes
-                    react: function(changes2, baseRevision2, partial2, onChangesAccepted2) {
-                      sendChanges(
-                        changes2,
-                        baseRevision2,
-                        partial2,
-                        onChangesAccepted2
-                      );
-                    },
-                    disconnect: function() {
-                      clearRefreshTimer();
-                      cleanupVisibilityListener();
-                      ws.close();
-                    }
-                  });
-                  isFirstRound = false;
-                }
-              } else if (requestFromServer.type == "ack") {
-                var requestId2 = requestFromServer.requestId;
-                var acceptCallback = acceptCallbacks[requestId2.toString()];
-                acceptCallback();
-                delete acceptCallbacks[requestId2.toString()];
-              } else if (requestFromServer.type == "error") {
-                ws.close();
-                if (requestFromServer.code === "TOKEN_EXPIRED" || requestFromServer.code === "UNAUTHORIZED") {
-                  log("Auth error from server, will reconnect with fresh token:", requestFromServer.message);
-                  onError(requestFromServer.message, RECONNECT_DELAY);
-                } else {
-                  onError(requestFromServer.message, Infinity);
-                }
-              } else {
-                log("unknown message", requestFromServer);
-                ws.close();
-                onError("unknown message", Infinity);
-              }
-            } catch (e) {
-              ws.close();
-              log("caught error", e);
-              onError(e, Infinity);
-            }
-          };
-        }
-      });
-    };
-  }
-});
-
 // package.json
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.8.0-beta.3";
+    version = "0.9.0-beta.0";
   }
 });
 
@@ -333,24 +127,6 @@ function cleanOAuthParamsFromUrl() {
     log("Cleaned OAuth parameters from URL");
   }
 }
-function getSyncStatus(statusCode) {
-  switch (statusCode) {
-    case -1:
-      return "ERROR";
-    case 0:
-      return "OFFLINE";
-    case 1:
-      return "CONNECTING";
-    case 2:
-      return "ONLINE";
-    case 3:
-      return "SYNCING";
-    case 4:
-      return "ERROR_WILL_RETRY";
-    default:
-      return "UNKNOWN";
-  }
-}
 var init_network = __esm({
   "src/utils/network.ts"() {
     "use strict";
@@ -359,57 +135,147 @@ var init_network = __esm({
   }
 });
 
-// src/context.tsx
-import { createContext, useContext } from "react";
-function useBasic() {
-  return useContext(BasicContext);
+// src/react/hooks.ts
+import { useContext, useEffect, useMemo, useState, useSyncExternalStore } from "react";
+import { useLiveQuery } from "dexie-react-hooks";
+function useBasicClient() {
+  const client = useContext(BasicClientContext);
+  if (!client) {
+    throw new Error("useBasic must be used within a <BasicProvider>");
+  }
+  return client;
 }
-var DBStatus, noDb, BasicContext;
-var init_context = __esm({
-  "src/context.tsx"() {
-    "use strict";
-    DBStatus = /* @__PURE__ */ ((DBStatus2) => {
-      DBStatus2["LOADING"] = "LOADING";
-      DBStatus2["OFFLINE"] = "OFFLINE";
-      DBStatus2["CONNECTING"] = "CONNECTING";
-      DBStatus2["ONLINE"] = "ONLINE";
-      DBStatus2["SYNCING"] = "SYNCING";
-      DBStatus2["ERROR"] = "ERROR";
-      DBStatus2["ERROR_WILL_RETRY"] = "ERROR_WILL_RETRY";
-      DBStatus2["ERROR_TOKEN_EXPIRED"] = "ERROR_TOKEN_EXPIRED";
-      return DBStatus2;
-    })(DBStatus || {});
-    noDb = {
-      collection: () => {
-        throw new Error("no basicdb found - initialization failed. double check your schema.");
+function useClientSnapshot(client) {
+  return useSyncExternalStore(client.subscribe, client.getSnapshot, client.getSnapshot);
+}
+function useAuth() {
+  const client = useBasicClient();
+  const snapshot = useClientSnapshot(client);
+  return useMemo(
+    () => ({
+      isReady: snapshot.isReady,
+      isSignedIn: snapshot.isSignedIn,
+      status: snapshot.authStatus,
+      errorCode: snapshot.authErrorCode,
+      user: snapshot.user,
+      did: snapshot.did,
+      scope: snapshot.scope,
+      hasScope: (s) => client.auth.hasScope(s),
+      missingScopes: () => client.auth.missingScopes(),
+      signIn: (redirectUri) => client.auth.signIn(redirectUri),
+      signInWithHandle: (handle) => client.auth.signInWithHandle(handle),
+      signInWithCode: (code, state) => client.auth.signInWithCode(code, state),
+      signOut: () => client.signOut(),
+      getToken: (options) => client.auth.getToken(options),
+      getSignInUrl: (redirectUri) => client.auth.getSignInUrl(redirectUri)
+    }),
+    [client, snapshot]
+  );
+}
+function useDb() {
+  const client = useBasicClient();
+  return client.db;
+}
+function useSyncStatus() {
+  const client = useBasicClient();
+  const snapshot = useClientSnapshot(client);
+  return useMemo(
+    () => ({
+      status: snapshot.syncStatus,
+      enabled: snapshot.syncEnabled,
+      pendingCount: snapshot.pendingCount,
+      listRejected: () => client.listRejected(),
+      clearRejected: () => client.clearRejected()
+    }),
+    [client, snapshot]
+  );
+}
+function useShares() {
+  const client = useBasicClient();
+  const snapshot = useClientSnapshot(client);
+  const [state, setState] = useState({ granted: [], received: [], isLoading: false, error: null });
+  const isSignedIn = snapshot.isSignedIn && snapshot.authStatus === "authenticated";
+  const refresh = useMemo(
+    () => async () => {
+      setState((s) => ({ ...s, isLoading: true, error: null }));
+      try {
+        const { granted, received } = await client.listShares();
+        setState({ granted, received, isLoading: false, error: null });
+      } catch (err) {
+        setState((s) => ({
+          ...s,
+          isLoading: false,
+          error: err instanceof Error ? err : new Error(String(err))
+        }));
       }
-    };
-    BasicContext = createContext({
-      isReady: false,
-      isSignedIn: false,
-      user: null,
-      did: null,
-      scope: null,
-      hasScope: () => false,
-      missingScopes: () => [],
-      signIn: () => Promise.resolve(),
-      signInWithHandle: () => Promise.resolve(),
-      signOut: () => Promise.resolve(),
-      signInWithCode: () => Promise.resolve({ success: false }),
-      getToken: (_options) => Promise.reject(new Error("no token")),
-      getSignInUrl: () => Promise.resolve(""),
-      db: noDb,
-      dbStatus: "LOADING" /* LOADING */,
-      dbMode: "sync",
-      devInfo: null,
-      refreshSchemaStatus: async () => {
-      },
-      isAuthReady: false,
-      signin: () => Promise.resolve(),
-      signout: () => Promise.resolve(),
-      signinWithCode: () => Promise.resolve({ success: false }),
-      getSignInLink: () => Promise.resolve("")
+    },
+    [client]
+  );
+  useEffect(() => {
+    if (isSignedIn) void refresh();
+  }, [isSignedIn, refresh]);
+  return { ...state, refresh };
+}
+function useShare(shareId) {
+  const client = useBasicClient();
+  const snapshot = useClientSnapshot(client);
+  const [handle, setHandle] = useState(null);
+  const [error, setError] = useState(null);
+  const [revoked, setRevoked] = useState(false);
+  const canMount = !!shareId && snapshot.isSignedIn && snapshot.authStatus !== "reauth_required";
+  useEffect(() => {
+    if (!canMount || !shareId) return;
+    let cancelled = false;
+    setError(null);
+    setRevoked(false);
+    client.mountShare(shareId).then((h) => {
+      if (!cancelled) setHandle(h);
+    }).catch((err) => {
+      if (!cancelled) setError(err instanceof Error ? err : new Error(String(err)));
     });
+    const offSubError = client.engine?.on("suberror", ({ sub, code }) => {
+      if (sub === `share:${shareId}` && (code === "SHARE_REVOKED" || code === "CONNECTION_REVOKED")) {
+        setRevoked(true);
+        setHandle(null);
+      }
+    });
+    return () => {
+      cancelled = true;
+      offSubError?.();
+      setHandle(null);
+      void client.unmountShare(shareId).catch(() => {
+      });
+    };
+  }, [client, shareId, canMount]);
+  return {
+    db: handle?.db ?? null,
+    status: revoked ? "revoked" : error ? "error" : handle ? "mounted" : "mounting",
+    error
+  };
+}
+function useBasic() {
+  const client = useBasicClient();
+  const snapshot = useClientSnapshot(client);
+  const auth = useAuth();
+  const sync = useSyncStatus();
+  return useMemo(
+    () => ({
+      ...auth,
+      db: client.db,
+      sync,
+      devInfo: snapshot.devInfo,
+      refreshSchemaStatus: () => client.refreshSchemaStatus(),
+      client
+    }),
+    [client, snapshot, auth, sync]
+  );
+}
+var useQuery;
+var init_hooks = __esm({
+  "src/react/hooks.ts"() {
+    "use strict";
+    init_context();
+    useQuery = useLiveQuery;
   }
 });
 
@@ -418,18 +284,18 @@ var BasicDevToolbar_exports = {};
 __export(BasicDevToolbar_exports, {
   BasicDevToolbar: () => BasicDevToolbar
 });
-import { useCallback, useMemo, useState } from "react";
+import { useCallback, useMemo as useMemo2, useState as useState2 } from "react";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 function toneForAuth(isReady, isSignedIn) {
   if (!isReady) return "muted";
   if (isSignedIn) return "ok";
   return "warn";
 }
-function toneForDb(dbMode, dbStatus) {
-  if (dbMode === "remote") return dbStatus === "ONLINE" /* ONLINE */ ? "ok" : "warn";
-  if (dbStatus === "ONLINE" /* ONLINE */ || dbStatus === "SYNCING" /* SYNCING */) return "ok";
-  if (dbStatus === "CONNECTING" /* CONNECTING */ || dbStatus === "LOADING" /* LOADING */) return "warn";
-  if (dbStatus === "OFFLINE" /* OFFLINE */) return "muted";
+function toneForSync(mode, status) {
+  if (mode === "rest") return "muted";
+  if (status === "online") return "ok";
+  if (status === "connecting") return "warn";
+  if (status === "offline" || status === "idle" || status === "stopped") return "muted";
   return "bad";
 }
 function toneForSchema(info) {
@@ -439,24 +305,22 @@ function toneForSchema(info) {
   if (info.status === "no_schema") return "muted";
   return "bad";
 }
-function dbStatusLabel(status) {
+function syncStatusLabel(status) {
   switch (status) {
-    case "LOADING" /* LOADING */:
-      return "Initializing";
-    case "OFFLINE" /* OFFLINE */:
-      return "Offline";
-    case "CONNECTING" /* CONNECTING */:
+    case "idle":
+      return "Idle";
+    case "connecting":
       return "Connecting";
-    case "ONLINE" /* ONLINE */:
+    case "online":
       return "Connected";
-    case "SYNCING" /* SYNCING */:
-      return "Syncing";
-    case "ERROR" /* ERROR */:
-      return "Error";
-    case "ERROR_WILL_RETRY" /* ERROR_WILL_RETRY */:
-      return "Retrying";
-    case "ERROR_TOKEN_EXPIRED" /* ERROR_TOKEN_EXPIRED */:
-      return "Token refresh";
+    case "offline":
+      return "Offline";
+    case "auth_required":
+      return "Reauth required";
+    case "revoked":
+      return "Connection revoked";
+    case "stopped":
+      return "Stopped";
     default:
       return String(status);
   }
@@ -545,7 +409,7 @@ function CopyableRow({
   onCopied,
   children
 }) {
-  const [hover, setHover] = useState(false);
+  const [hover, setHover] = useState2(false);
   const canCopy = copyText.length > 0;
   const handleClick = useCallback(
     (e) => {
@@ -625,20 +489,23 @@ function BasicDevToolbar({ enabled = true, debug }) {
     did,
     scope,
     missingScopes,
-    dbMode,
-    dbStatus,
+    sync,
     devInfo,
-    refreshSchemaStatus
+    refreshSchemaStatus,
+    client
   } = useBasic();
-  const [open, setOpen] = useState(false);
-  const [refreshing, setRefreshing] = useState(false);
-  const [copied, setCopied] = useState(false);
-  const [rowCopied, setRowCopied] = useState(null);
+  const dbMode = client.mode;
+  const syncStatus = sync.status;
+  const indexedDbName = dbMode === "sync" && client.projectId ? `basic-sync:${client.projectId}` : null;
+  const [open, setOpen] = useState2(false);
+  const [refreshing, setRefreshing] = useState2(false);
+  const [copied, setCopied] = useState2(false);
+  const [rowCopied, setRowCopied] = useState2(null);
   const show = enabled && typeof window !== "undefined" && isDevelopment(debug);
   const authTone = toneForAuth(isReady, isSignedIn);
-  const dbTone = toneForDb(dbMode, dbStatus);
+  const dbTone = toneForSync(dbMode, syncStatus);
   const schemaTone = toneForSchema(devInfo);
-  const syncTone = dbMode === "remote" ? "muted" : dbTone === "ok" || dbStatus === "SYNCING" /* SYNCING */ ? "ok" : dbTone === "warn" ? "warn" : dbTone === "bad" ? "bad" : "muted";
+  const syncTone = dbTone;
   const handleRefreshSchema = useCallback(async () => {
     setRefreshing(true);
     try {
@@ -648,7 +515,7 @@ function BasicDevToolbar({ enabled = true, debug }) {
     }
   }, [refreshSchemaStatus]);
   const missingList = missingScopes();
-  const debugPayload = useMemo(() => {
+  const debugPayload = useMemo2(() => {
     return {
       sdkVersion: version,
       isReady,
@@ -663,11 +530,12 @@ function BasicDevToolbar({ enabled = true, debug }) {
       scope,
       missingScopes: missingList,
       dbMode,
-      dbStatus,
-      indexedDbName: dbMode === "sync" ? INDEXED_DB_NAME : null,
+      syncStatus,
+      pendingOps: sync.pendingCount,
+      indexedDbName,
       schema: devInfo
     };
-  }, [isReady, isSignedIn, did, user, scope, dbMode, dbStatus, devInfo, missingList]);
+  }, [isReady, isSignedIn, did, user, scope, dbMode, syncStatus, sync.pendingCount, indexedDbName, devInfo, missingList]);
   const handleCopy = useCallback(async () => {
     try {
       await navigator.clipboard.writeText(JSON.stringify(debugPayload, null, 2));
@@ -750,7 +618,7 @@ function BasicDevToolbar({ enabled = true, debug }) {
     minWidth: 300,
     maxWidth: "min(560px, calc(100vw - 24px))"
   };
-  const syncStatusText = dbStatusLabel(dbStatus);
+  const syncStatusText = dbMode === "rest" ? "REST mode" : `${syncStatusLabel(syncStatus)}${sync.pendingCount > 0 ? ` (${sync.pendingCount} pending)` : ""}`;
   return /* @__PURE__ */ jsxs("div", { style: shell, children: [
     open && /* @__PURE__ */ jsxs("div", { style: panel, children: [
       /* @__PURE__ */ jsxs("div", { style: { marginBottom: 12 }, children: [
@@ -845,10 +713,10 @@ function BasicDevToolbar({ enabled = true, debug }) {
         {
           rowKey: "indexedDb",
           label: "IndexedDB",
-          copyText: dbMode === "sync" ? INDEXED_DB_NAME : "",
+          copyText: indexedDbName ?? "",
           copiedKey: rowCopied,
           onCopied: onRowCopied,
-          children: dbMode === "sync" ? INDEXED_DB_NAME : "\u2014"
+          children: indexedDbName ?? "\u2014"
         }
       ),
       /* @__PURE__ */ jsx(
@@ -1028,605 +896,119 @@ function BasicDevToolbar({ enabled = true, debug }) {
     )
   ] });
 }
-var INDEXED_DB_NAME, PANEL_PAD_X;
+var PANEL_PAD_X;
 var init_BasicDevToolbar = __esm({
   "src/dev/BasicDevToolbar.tsx"() {
     "use strict";
     "use client";
-    init_context();
+    init_hooks();
     init_package();
     init_network();
-    INDEXED_DB_NAME = "basicdb";
     PANEL_PAD_X = 12;
   }
 });
 
-// src/AuthContext.tsx
-import { useCallback as useCallback2, useEffect, useRef, useState as useState2, Suspense, lazy } from "react";
+// src/react/BasicProvider.tsx
+init_context();
+import { Suspense, lazy, useEffect as useEffect2, useRef, useSyncExternalStore as useSyncExternalStore2 } from "react";
 
-// src/sync/index.ts
-init_config();
-init_tokenRegistry();
-import { v7 as uuidv7 } from "uuid";
-import { Dexie as Dexie2 } from "dexie";
-import { validateData } from "@basictech/schema";
-var dexieExtensionsLoaded = false;
-var initPromise = null;
-async function initDexieExtensions() {
-  if (dexieExtensionsLoaded) return;
-  if (typeof window === "undefined") return;
-  if (initPromise) return initPromise;
-  initPromise = (async () => {
-    try {
-      await import("dexie-syncable");
-      await import("dexie-observable");
-      const { syncProtocol: syncProtocol2 } = await Promise.resolve().then(() => (init_syncProtocol(), syncProtocol_exports));
-      syncProtocol2();
-      dexieExtensionsLoaded = true;
-      log("Dexie extensions loaded successfully");
-    } catch (error) {
-      console.error("Failed to load Dexie extensions:", error);
-      throw error;
-    }
-  })();
-  return initPromise;
-}
-var BasicSync = class extends Dexie2 {
-  basic_schema;
-  constructor(name, options) {
-    super(name, options);
-    this.basic_schema = options.schema;
-    this.version(1).stores(this._convertSchemaToDxSchema(this.basic_schema));
-    this.version(2).stores({});
-    this.Collection.prototype.get = this.Collection.prototype.toArray;
-  }
-  async connect({ getToken, ws_url }) {
-    const WS_URL = ws_url || "wss://pds.basic.id/ws";
-    log("Connecting to", WS_URL);
-    setTokenGetter(WS_URL, getToken);
-    await this.updateSyncNodes();
-    log("Starting connection...");
-    return this.syncable.connect("websocket", WS_URL, { schema: this.basic_schema });
-  }
-  async disconnect({ ws_url } = {}) {
-    const WS_URL = ws_url || "wss://pds.basic.id/ws";
-    return this.syncable.disconnect(WS_URL);
-  }
-  async updateSyncNodes() {
-    try {
-      const syncNodes = await this.table("_syncNodes").toArray();
-      const localSyncNodes = syncNodes.filter((node) => node.type === "local");
-      log("Local sync nodes:", localSyncNodes);
-      if (localSyncNodes.length > 1) {
-        const largestNodeId = Math.max(...localSyncNodes.map((node) => node.id));
-        const largestNode = localSyncNodes.find((node) => node.id === largestNodeId);
-        if (largestNode && largestNode.isMaster === 1) {
-          log("Largest node is already the master. No changes needed.");
-          return;
-        }
-        log("Largest node id:", largestNodeId);
-        log("HEISENBUG: More than one local sync node found.");
-        for (const node of localSyncNodes) {
-          log(`Local sync node keys:`, node.id, node.isMaster);
-          await this.table("_syncNodes").update(node.id, { isMaster: node.id === largestNodeId ? 1 : 0 });
-          log(`HEISENBUG: Setting ${node.id} to ${node.id === largestNodeId ? "master" : "0"}`);
-        }
-        await new Promise((resolve) => setTimeout(resolve, 1e3));
-        if (typeof window !== "undefined") {
-          window.location.reload();
-        }
-      }
-      log("Sync nodes updated");
-    } catch (error) {
-      console.error("Error updating _syncNodes table:", error);
-    }
-  }
-  handleStatusChange(fn) {
-    this.syncable.on("statusChanged", fn);
-  }
-  _convertSchemaToDxSchema(schema) {
-    const stores = Object.entries(schema.tables).map(([key, table]) => {
-      const indexedFields = Object.entries(table.fields).filter(([, field]) => field.indexed).map(([fieldKey]) => `,${fieldKey}`).join("");
-      return {
-        [key]: "id" + indexedFields
-      };
-    });
-    return Object.assign({}, ...stores);
+// src/core/auth/AuthManager.ts
+import { jwtDecode } from "jwt-decode";
+
+// src/utils/storage.ts
+var LocalStorageAdapter = class {
+  async get(key) {
+    return localStorage.getItem(key);
   }
-  debugeroo() {
-    return this.syncable;
+  async set(key, value) {
+    localStorage.setItem(key, value);
   }
-  collection(name) {
-    if (this.basic_schema?.tables && !this.basic_schema.tables[name]) {
-      throw new Error(`Table "${name}" not found in schema`);
-    }
-    const table = this.table(name);
-    return {
-      /**
-       * Returns the underlying Dexie table
-       * @type {Dexie.Table}
-       */
-      ref: table,
-      // --- WRITE ---- // 
-      /**
-       * Add a new record - returns the full object with generated id
-       */
-      add: async (data) => {
-        const valid = validateData(this.basic_schema, name, data);
-        if (!valid.valid) {
-          log("Invalid data", valid);
-          throw new Error(valid.message || "Data validation failed");
-        }
-        const id = uuidv7();
-        const fullData = { id, ...data };
-        await table.add(fullData);
-        return fullData;
-      },
-      /**
-       * Put (upsert) a record - returns the full object
-       */
-      put: async (data) => {
-        if (!data.id) {
-          throw new Error("put() requires an id field");
-        }
-        const valid = validateData(this.basic_schema, name, data);
-        if (!valid.valid) {
-          log("Invalid data", valid);
-          throw new Error(valid.message || "Data validation failed");
-        }
-        await table.put(data);
-        return data;
-      },
-      /**
-       * Update an existing record - returns updated object or null
-       */
-      update: async (id, data) => {
-        if (!id) {
-          throw new Error("update() requires an id");
-        }
-        const valid = validateData(this.basic_schema, name, data, false);
-        if (!valid.valid) {
-          log("Invalid data", valid);
-          throw new Error(valid.message || "Data validation failed");
-        }
-        const updated = await table.update(id, data);
-        if (updated === 0) {
-          return null;
-        }
-        const record = await table.get(id);
-        return record || null;
-      },
-      /**
-       * Delete a record - returns true if deleted, false if not found
-       */
-      delete: async (id) => {
-        if (!id) {
-          throw new Error("delete() requires an id");
-        }
-        const exists = await table.get(id);
-        if (!exists) {
-          return false;
-        }
-        await table.delete(id);
-        return true;
-      },
-      // --- READ ---- // 
-      /**
-       * Get a single record by id - returns null if not found
-       */
-      get: async (id) => {
-        if (!id) {
-          throw new Error("get() requires an id");
-        }
-        const record = await table.get(id);
-        return record || null;
-      },
-      /**
-       * Get all records in the collection
-       */
-      getAll: async () => {
-        return table.toArray();
-      },
-      // --- QUERY ---- // 
-      /**
-       * Filter records using a predicate function
-       */
-      filter: async (fn) => {
-        return table.filter(fn).toArray();
-      },
-      /**
-       * Get the raw Dexie table for advanced queries
-       * @deprecated Use ref instead
-       */
-      query: () => table
-    };
+  async remove(key) {
+    localStorage.removeItem(key);
   }
 };
+var STORAGE_KEYS = {
+  REFRESH_TOKEN: "basic_refresh_token",
+  USER_INFO: "basic_user_info",
+  AUTH_STATE: "basic_auth_state",
+  REDIRECT_URI: "basic_redirect_uri",
+  SERVER_URL: "basic_server_url",
+  PDS_ENDPOINTS: "basic_pds_endpoints",
+  LAST_CONNECT_REPORT: "basic_last_connect_report",
+  DEBUG: "basic_debug",
+  CODE_VERIFIER: "basic_code_verifier"
+};
 
-// src/core/db/types.ts
-var RemoteDBError = class extends Error {
-  status;
-  response;
-  constructor(message, status, response) {
-    super(message);
-    this.name = "RemoteDBError";
-    this.status = status;
-    this.response = response;
+// src/utils/normalizeClientId.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function normalizeClientId(projectId, adminHostname = "api.basic.tech") {
+  if (!projectId) return projectId;
+  if (projectId === "self") return projectId;
+  if (projectId.startsWith("did:")) return projectId;
+  if (UUID_RE.test(projectId)) {
+    const hex = projectId.replace(/-/g, "").toLowerCase();
+    return `did:web:${adminHostname}:projects:${hex}`;
   }
-};
+  return projectId;
+}
 
-// src/core/db/RemoteCollection.ts
-import { validateData as validateData2 } from "@basictech/schema";
-var NotAuthenticatedError = class extends Error {
-  constructor(message = "Not authenticated") {
-    super(message);
-    this.name = "NotAuthenticatedError";
+// src/utils/resolveDid.ts
+function resolveDidWebUrl(did) {
+  if (!did.startsWith("did:web:")) return null;
+  const rest = did.slice(8);
+  if (!rest) return null;
+  const parts = rest.split(":");
+  const hostname = parts[0].replace(/%3A/gi, ":");
+  if (parts.length === 1) {
+    return `https://${hostname}/.well-known/did.json`;
   }
-};
-var RemoteCollection = class {
-  tableName;
-  config;
-  constructor(tableName, config) {
-    this.tableName = tableName;
-    this.config = config;
+  const pathParts = parts.slice(1).map((p) => decodeURIComponent(p));
+  return `https://${hostname}/${pathParts.join("/")}/did.json`;
+}
+async function resolveFromDocument(did, didDocument) {
+  const services = didDocument.service;
+  const pdsService = services?.find(
+    (s) => s.id === "#basic_pds" || s.id === `${did}#basic_pds`
+  );
+  if (!pdsService) {
+    throw new Error(`DID document has no #basic_pds service entry`);
   }
-  log(...args) {
-    if (this.config.debug) {
-      console.log("[RemoteDB]", ...args);
-    }
+  const pdsUrl = pdsService.serviceEndpoint.replace(/\/+$/, "");
+  const oauthRes = await fetch(`${pdsUrl}/auth/.well-known/openid-configuration`);
+  if (!oauthRes.ok) {
+    throw new Error(`Failed to fetch OpenID configuration from ${pdsUrl}: ${oauthRes.status}`);
   }
-  /**
-   * Check if an error is a "not authenticated" error
-   */
-  isNotAuthenticatedError(error) {
-    if (error instanceof Error) {
-      const message = error.message.toLowerCase();
-      return message.includes("no token") || message.includes("not authenticated") || message.includes("please sign in");
-    }
-    return false;
+  const oauth = await oauthRes.json();
+  return {
+    did,
+    didDocument,
+    pdsUrl,
+    authorization_endpoint: oauth.authorization_endpoint,
+    token_endpoint: oauth.token_endpoint,
+    userinfo_endpoint: oauth.userinfo_endpoint
+  };
+}
+async function resolveDid(did) {
+  const url = resolveDidWebUrl(did);
+  if (!url) {
+    throw new Error(`Unsupported DID method: ${did}`);
   }
-  /**
-   * Helper to make authenticated API requests
-   * Automatically retries once on 401 (token expired) by refreshing the token
-   */
-  async request(method, path, body, isRetry = false) {
-    const token = await this.config.getToken();
-    const url = `${this.config.serverUrl}${path}`;
-    this.log(`${method} ${url}`, body ? JSON.stringify(body) : "");
-    const headers = {
-      "Authorization": `Bearer ${token}`
-    };
-    if (body) {
-      headers["Content-Type"] = "application/json";
-    }
-    const response = await fetch(url, {
-      method,
-      headers,
-      ...body ? { body: JSON.stringify(body) } : {}
-    });
-    const responseData = await response.json().catch(() => ({}));
-    if (!response.ok) {
-      if (response.status === 401 && !isRetry) {
-        this.log("Got 401, forcing token refresh and retrying...");
-        await this.config.getToken({ forceRefresh: true });
-        return this.request(method, path, body, true);
-      }
-      if (this.config.debug) {
-        console.error(`[RemoteDB] Error ${response.status}:`, responseData);
-      }
-      if (this.config.onAuthError) {
-        if (response.status === 401) {
-          this.config.onAuthError({
-            status: response.status,
-            message: "Authentication failed",
-            response: responseData,
-            errorType: "expired",
-            afterRetry: isRetry
-          });
-        } else if (response.status === 403) {
-          this.config.onAuthError({
-            status: response.status,
-            message: responseData.message || "Forbidden - insufficient permissions or missing scope",
-            response: responseData,
-            errorType: "forbidden",
-            afterRetry: isRetry
-          });
-        }
-      }
-      const errorMessage = responseData.message || responseData.error || responseData.detail || (typeof responseData === "string" ? responseData : `API request failed: ${response.status}`);
-      throw new RemoteDBError(errorMessage, response.status, responseData);
-    }
-    this.log("Response:", responseData);
-    return responseData;
+  const didRes = await fetch(url);
+  if (!didRes.ok) {
+    throw new Error(`Failed to fetch DID document at ${url}: ${didRes.status}`);
   }
-  /**
-   * Validate data against schema if available
-   */
-  validateData(data, checkRequired = true) {
-    if (this.config.schema) {
-      const result = validateData2(this.config.schema, this.tableName, data, checkRequired);
-      if (!result.valid) {
-        throw new Error(result.message || "Data validation failed");
-      }
-    }
+  const didDocument = await didRes.json();
+  return resolveFromDocument(did, didDocument);
+}
+async function resolveHandle(handle) {
+  const res = await fetch(`https://${handle}/.well-known/did.json`);
+  if (!res.ok) {
+    throw new Error(`Handle resolution failed for ${handle}: ${res.status}`);
   }
-  /**
-   * Get the base path for this collection
-   */
-  get basePath() {
-    return `/account/${this.config.projectId}/db/${this.tableName}`;
-  }
-  /**
-   * Add a new record to the collection
-   * The server generates the ID
-   * Requires authentication - throws NotAuthenticatedError if not signed in
-   */
-  async add(data) {
-    this.validateData(data, true);
-    try {
-      const result = await this.request(
-        "POST",
-        this.basePath,
-        { value: data }
-      );
-      return result.data;
-    } catch (error) {
-      if (this.isNotAuthenticatedError(error)) {
-        throw new NotAuthenticatedError("Sign in required to add items");
-      }
-      throw error;
-    }
-  }
-  /**
-   * Put (upsert) a record - requires id
-   * Requires authentication - throws NotAuthenticatedError if not signed in
-   */
-  async put(data) {
-    if (!data.id) {
-      throw new Error("put() requires an id field");
-    }
-    const { id, ...rest } = data;
-    this.validateData(rest, true);
-    try {
-      const result = await this.request(
-        "PUT",
-        `${this.basePath}/${id}`,
-        { value: rest }
-      );
-      return result.data || data;
-    } catch (error) {
-      if (this.isNotAuthenticatedError(error)) {
-        throw new NotAuthenticatedError("Sign in required to update items");
-      }
-      throw error;
-    }
-  }
-  /**
-   * Update an existing record by id
-   * Requires authentication - throws NotAuthenticatedError if not signed in
-   */
-  async update(id, data) {
-    if (!id) {
-      throw new Error("update() requires an id");
-    }
-    this.validateData(data, false);
-    try {
-      const result = await this.request(
-        "PATCH",
-        `${this.basePath}/${id}`,
-        { value: data }
-      );
-      return result.data || null;
-    } catch (error) {
-      if (error instanceof RemoteDBError && error.status === 404) {
-        return null;
-      }
-      if (this.isNotAuthenticatedError(error)) {
-        throw new NotAuthenticatedError("Sign in required to update items");
-      }
-      throw error;
-    }
-  }
-  /**
-   * Delete a record by id
-   * Requires authentication - throws NotAuthenticatedError if not signed in
-   */
-  async delete(id) {
-    if (!id) {
-      throw new Error("delete() requires an id");
-    }
-    try {
-      await this.request(
-        "DELETE",
-        `${this.basePath}/${id}`
-      );
-      return true;
-    } catch (error) {
-      if (error instanceof RemoteDBError && error.status === 404) {
-        return false;
-      }
-      if (this.isNotAuthenticatedError(error)) {
-        throw new NotAuthenticatedError("Sign in required to delete items");
-      }
-      throw error;
-    }
-  }
-  /**
-   * Get a single record by id
-   * Returns null if not authenticated (graceful degradation for read operations)
-   */
-  async get(id) {
-    if (!id) {
-      throw new Error("get() requires an id");
-    }
-    try {
-      const result = await this.request(
-        "GET",
-        `${this.basePath}?id=${id}`
-      );
-      return result.data?.[0] || null;
-    } catch (error) {
-      if (this.isNotAuthenticatedError(error)) {
-        this.log("Not authenticated - returning null for get()");
-      }
-      return null;
-    }
-  }
-  /**
-   * Get all records in the collection
-   * Returns empty array if not authenticated (graceful degradation for read operations)
-   */
-  async getAll() {
-    try {
-      const result = await this.request(
-        "GET",
-        this.basePath
-      );
-      return result.data || [];
-    } catch (error) {
-      if (this.isNotAuthenticatedError(error)) {
-        this.log("Not authenticated - returning empty array for getAll()");
-        return [];
-      }
-      throw error;
-    }
-  }
-  /**
-   * Filter records using a predicate function
-   * Note: This fetches all records and filters client-side
-   * Returns empty array if not authenticated (graceful degradation for read operations)
-   */
-  async filter(fn) {
-    const all = await this.getAll();
-    return all.filter(fn);
-  }
-  /**
-   * ref is not available for remote collections
-   */
-  ref = void 0;
-};
-
-// src/core/db/RemoteDB.ts
-var RemoteDB = class {
-  config;
-  collections = /* @__PURE__ */ new Map();
-  constructor(config) {
-    this.config = config;
-  }
-  /**
-   * Get a collection by name
-   * Collections are cached for reuse
-   */
-  collection(name) {
-    if (this.collections.has(name)) {
-      return this.collections.get(name);
-    }
-    if (this.config.schema?.tables && !this.config.schema.tables[name]) {
-      throw new Error(`Table "${name}" not found in schema`);
-    }
-    const collection = new RemoteCollection(name, this.config);
-    this.collections.set(name, collection);
-    return collection;
-  }
-};
-
-// src/core/auth/AuthManager.ts
-import { jwtDecode } from "jwt-decode";
-
-// src/utils/storage.ts
-var LocalStorageAdapter = class {
-  async get(key) {
-    return localStorage.getItem(key);
-  }
-  async set(key, value) {
-    localStorage.setItem(key, value);
-  }
-  async remove(key) {
-    localStorage.removeItem(key);
-  }
-};
-var STORAGE_KEYS = {
-  REFRESH_TOKEN: "basic_refresh_token",
-  USER_INFO: "basic_user_info",
-  AUTH_STATE: "basic_auth_state",
-  REDIRECT_URI: "basic_redirect_uri",
-  SERVER_URL: "basic_server_url",
-  PDS_ENDPOINTS: "basic_pds_endpoints",
-  LAST_CONNECT_REPORT: "basic_last_connect_report",
-  DEBUG: "basic_debug",
-  CODE_VERIFIER: "basic_code_verifier"
-};
-
-// src/utils/normalizeClientId.ts
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function normalizeClientId(projectId, adminHostname = "api.basic.tech") {
-  if (!projectId) return projectId;
-  if (projectId === "self") return projectId;
-  if (projectId.startsWith("did:")) return projectId;
-  if (UUID_RE.test(projectId)) {
-    const hex = projectId.replace(/-/g, "").toLowerCase();
-    return `did:web:${adminHostname}:projects:${hex}`;
-  }
-  return projectId;
-}
-
-// src/utils/resolveDid.ts
-function resolveDidWebUrl(did) {
-  if (!did.startsWith("did:web:")) return null;
-  const rest = did.slice(8);
-  if (!rest) return null;
-  const parts = rest.split(":");
-  const hostname = parts[0].replace(/%3A/gi, ":");
-  if (parts.length === 1) {
-    return `https://${hostname}/.well-known/did.json`;
-  }
-  const pathParts = parts.slice(1).map((p) => decodeURIComponent(p));
-  return `https://${hostname}/${pathParts.join("/")}/did.json`;
-}
-async function resolveFromDocument(did, didDocument) {
-  const services = didDocument.service;
-  const pdsService = services?.find(
-    (s) => s.id === "#basic_pds" || s.id === `${did}#basic_pds`
-  );
-  if (!pdsService) {
-    throw new Error(`DID document has no #basic_pds service entry`);
-  }
-  const pdsUrl = pdsService.serviceEndpoint.replace(/\/+$/, "");
-  const oauthRes = await fetch(`${pdsUrl}/auth/.well-known/openid-configuration`);
-  if (!oauthRes.ok) {
-    throw new Error(`Failed to fetch OpenID configuration from ${pdsUrl}: ${oauthRes.status}`);
-  }
-  const oauth = await oauthRes.json();
-  return {
-    did,
-    didDocument,
-    pdsUrl,
-    authorization_endpoint: oauth.authorization_endpoint,
-    token_endpoint: oauth.token_endpoint,
-    userinfo_endpoint: oauth.userinfo_endpoint
-  };
-}
-async function resolveDid(did) {
-  const url = resolveDidWebUrl(did);
-  if (!url) {
-    throw new Error(`Unsupported DID method: ${did}`);
-  }
-  const didRes = await fetch(url);
-  if (!didRes.ok) {
-    throw new Error(`Failed to fetch DID document at ${url}: ${didRes.status}`);
-  }
-  const didDocument = await didRes.json();
-  return resolveFromDocument(did, didDocument);
-}
-async function resolveHandle(handle) {
-  const res = await fetch(`https://${handle}/.well-known/did.json`);
-  if (!res.ok) {
-    throw new Error(`Handle resolution failed for ${handle}: ${res.status}`);
-  }
-  const didDocument = await res.json();
-  const did = didDocument.id;
-  if (!did) {
-    throw new Error(`Handle response has no 'id' field`);
+  const didDocument = await res.json();
+  const did = didDocument.id;
+  if (!did) {
+    throw new Error(`Handle response has no 'id' field`);
   }
   const resolved = await resolveFromDocument(did, didDocument);
   resolved.handle = handle;
@@ -1636,6 +1018,21 @@ async function resolveHandle(handle) {
 // src/core/auth/AuthManager.ts
 init_network();
 init_config();
+var DEFINITIVE_TOKEN_ERRORS = /* @__PURE__ */ new Set([
+  "invalid_grant",
+  "invalid_client",
+  "unauthorized_client"
+]);
+var USER_RECOVERY_RETRY_COOLDOWN_MS = 3e4;
+var SESSION_RECONCILE_THROTTLE_MS = 5e3;
+var DefinitiveAuthError = class extends Error {
+  code;
+  constructor(code) {
+    super(`Definitive auth failure: ${code}`);
+    this.name = "DefinitiveAuthError";
+    this.code = code;
+  }
+};
 function generateCodeVerifier() {
   const array = new Uint8Array(32);
   crypto.getRandomValues(array);
@@ -1643,7 +1040,9 @@ function generateCodeVerifier() {
 }
 async function generateCodeChallenge(verifier) {
   if (typeof crypto === "undefined" || !crypto.subtle) {
-    log("crypto.subtle unavailable (non-secure context?) -- falling back to plain PKCE challenge");
+    log(
+      "crypto.subtle unavailable (non-secure context?) -- falling back to plain PKCE challenge"
+    );
     return { challenge: verifier, method: "plain" };
   }
   const encoder = new TextEncoder();
@@ -1664,6 +1063,8 @@ var AuthManager = class {
   user = null;
   isSignedIn = false;
   isAuthReady = false;
+  authStatus = "bootstrapping";
+  authErrorCode = null;
   did = null;
   /** Space-separated scopes granted in the current access token */
   tokenScope = null;
@@ -1680,6 +1081,9 @@ var AuthManager = class {
   pendingRefresh = false;
   isOnline = typeof navigator !== "undefined" ? navigator.onLine : true;
   channel = null;
+  nextUserRecoveryAt = 0;
+  sessionCheckPromise = null;
+  lastSessionCheckAt = 0;
   constructor(config, storage, notify) {
     this.config = config;
     this.storage = storage;
@@ -1694,30 +1098,22 @@ var AuthManager = class {
       this.channel.onmessage = (event) => {
         if (event.data?.type === "token_refreshed") {
           log("Received token refresh from another tab");
-          if (event.data.accessToken && this.token) {
-            this.token = { ...this.token, access_token: event.data.accessToken };
-          }
-          if (event.data.did) this.did = event.data.did;
-          if (event.data.tokenScope) this.tokenScope = event.data.tokenScope;
-          this.notify();
+          void this.handleExternalTokenRefresh(event.data);
         }
         if (event.data?.type === "signed_in") {
-          log("Received sign-in from another tab, reloading");
-          if (typeof window !== "undefined") {
-            window.location.reload();
-          }
+          log("Received sign-in from another tab, restoring session");
+          void this.restoreStoredSession("cross-tab sign-in");
         }
         if (event.data?.type === "signed_out") {
-          log("Received sign-out from another tab, reloading");
-          this.user = null;
-          this.isSignedIn = false;
-          this.token = null;
-          this.did = null;
-          this.tokenScope = null;
+          log("Received sign-out from another tab");
+          this.resetAuthState("signed_out");
           this.notify();
-          if (typeof window !== "undefined") {
-            window.location.reload();
-          }
+        }
+        if (event.data?.type === "session_invalidated") {
+          log("Received session invalidation from another tab");
+          void this.markReauthRequired(event.data.code || "invalid_grant", {
+            broadcast: false
+          });
         }
       };
     } catch {
@@ -1738,6 +1134,9 @@ var AuthManager = class {
   broadcastSignOut() {
     this.channel?.postMessage({ type: "signed_out" });
   }
+  broadcastSessionInvalidated(code) {
+    this.channel?.postMessage({ type: "session_invalidated", code });
+  }
   // ------------------------------------------------------------------
   // Public API
   // ------------------------------------------------------------------
@@ -1746,7 +1145,11 @@ var AuthManager = class {
    * from refresh token, or load cached user for offline mode.
    */
   async initialize() {
-    await this.storage.set(STORAGE_KEYS.DEBUG, this.config.debug ? "true" : "false");
+    this.updateAuthStatus("bootstrapping");
+    await this.storage.set(
+      STORAGE_KEYS.DEBUG,
+      this.config.debug ? "true" : "false"
+    );
     const storedServerUrl = await this.storage.get(STORAGE_KEYS.SERVER_URL);
     if (storedServerUrl && storedServerUrl !== this.config.pdsUrl) {
       log("PDS URL changed, clearing stored tokens");
@@ -1758,7 +1161,7 @@ var AuthManager = class {
       if (params.has("code")) {
         const code = params.get("code");
         if (!code) {
-          this.isAuthReady = true;
+          this.updateAuthStatus("signed_out");
           this.notify();
           return;
         }
@@ -1766,7 +1169,7 @@ var AuthManager = class {
         const urlState = params.get("state");
         if (!state || state !== urlState) {
           log("error: auth state does not match");
-          this.isAuthReady = true;
+          this.updateAuthStatus("signed_out");
           this.notify();
           await this.storage.remove(STORAGE_KEYS.AUTH_STATE);
           cleanOAuthParamsFromUrl();
@@ -1777,34 +1180,18 @@ var AuthManager = class {
         this.freshSignIn = true;
         this.exchangeToken(code, false).catch((error) => {
           log("Error fetching token:", error);
+          this.freshSignIn = false;
+          void this.restoreCachedUser({
+            hasRecoverableSession: !this.isDefinitiveAuthFailure(error)
+          });
         });
       } else {
-        const refreshToken = await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);
-        if (refreshToken) {
-          log("Found refresh token in storage, attempting to refresh access token");
-          this.exchangeToken(refreshToken, true).catch(async (error) => {
-            log("Error fetching refresh token:", error);
-            if (this.isNetworkError(error)) {
-              await this.restoreCachedUser();
-            }
-          });
-        } else {
-          const cachedUserInfo = await this.storage.get(STORAGE_KEYS.USER_INFO);
-          if (cachedUserInfo) {
-            try {
-              this.user = JSON.parse(cachedUserInfo);
-              this.isSignedIn = true;
-              log("Loaded cached user info for offline mode");
-            } catch (error) {
-              log("Error parsing cached user info:", error);
-            }
-          }
-          this.isAuthReady = true;
-          this.notify();
-        }
+        await this.restoreStoredSession("initialize");
       }
     } catch (e) {
       log("error getting token", e);
+      this.updateAuthStatus("signed_out");
+      this.notify();
     }
   }
   /**
@@ -1814,7 +1201,7 @@ var AuthManager = class {
   async getToken(options) {
     log("getting token...");
     if (!this.token) {
-      const refreshToken = await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);
+      const refreshToken = await this.getRefreshToken();
       if (refreshToken) {
         log("No token in memory, attempting to refresh from storage");
         if (this.refreshPromise) {
@@ -1837,7 +1224,12 @@ var AuthManager = class {
         } catch (error) {
           log("Failed to refresh token from storage:", error);
           if (this.isNetworkError(error)) {
-            throw new Error("Network offline - authentication will be retried when online");
+            throw new Error(
+              "Network offline - authentication will be retried when online"
+            );
+          }
+          if (!this.isDefinitiveAuthFailure(error)) {
+            throw error;
           }
           throw new Error("Authentication expired. Please sign in again.");
         }
@@ -1850,12 +1242,15 @@ var AuthManager = class {
     const isExpired = decoded.exp && decoded.exp < Date.now() / 1e3 + expirationBuffer;
     const shouldRefresh = isExpired || options?.forceRefresh === true;
     if (shouldRefresh) {
-      log(options?.forceRefresh ? "force refreshing token..." : "token is expired - refreshing ...");
+      log(
+        options?.forceRefresh ? "force refreshing token..." : "token is expired - refreshing ..."
+      );
       if (this.refreshPromise) {
         log("Token refresh already in progress, waiting...");
         try {
           const newToken = await this.refreshPromise;
-          if (!newToken?.access_token) throw new Error("Token refresh returned empty access token");
+          if (!newToken?.access_token)
+            throw new Error("Token refresh returned empty access token");
           return newToken.access_token;
         } catch (error) {
           log("In-flight refresh failed:", error);
@@ -1866,11 +1261,12 @@ var AuthManager = class {
           throw error;
         }
       }
-      const refreshToken = this.token.refresh_token || await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);
+      const refreshToken = await this.getRefreshToken();
       if (refreshToken) {
         try {
           const newToken = await this.exchangeToken(refreshToken, true);
-          if (!newToken?.access_token) throw new Error("Token refresh returned empty access token");
+          if (!newToken?.access_token)
+            throw new Error("Token refresh returned empty access token");
           return newToken.access_token;
         } catch (error) {
           log("Failed to refresh expired token:", error);
@@ -1878,13 +1274,17 @@ var AuthManager = class {
             log("Network issue - using expired token until network is restored");
             return this.token.access_token;
           }
+          if (!this.isDefinitiveAuthFailure(error)) {
+            throw error;
+          }
           throw new Error("Authentication expired. Please sign in again.");
         }
       } else {
         throw new Error("no refresh token available");
       }
     }
-    if (!this.token.access_token) throw new Error("Token exists but access_token is empty");
+    if (!this.token.access_token)
+      throw new Error("Token exists but access_token is empty");
     return this.token.access_token;
   }
   async getSignInUrl(redirectUri, endpoints) {
@@ -1893,8 +1293,13 @@ var AuthManager = class {
       throw new Error("Project ID is required to generate sign-in link");
     }
     const pdsEndpoints = endpoints || this.defaultPdsEndpoints();
-    await this.storage.set(STORAGE_KEYS.PDS_ENDPOINTS, JSON.stringify(pdsEndpoints));
-    const randomState = base64UrlEncode(crypto.getRandomValues(new Uint8Array(16)));
+    await this.storage.set(
+      STORAGE_KEYS.PDS_ENDPOINTS,
+      JSON.stringify(pdsEndpoints)
+    );
+    const randomState = base64UrlEncode(
+      crypto.getRandomValues(new Uint8Array(16))
+    );
     await this.storage.set(STORAGE_KEYS.AUTH_STATE, randomState);
     const redirectUrl = redirectUri || window.location.href;
     if (!redirectUrl || !redirectUrl.startsWith("http://") && !redirectUrl.startsWith("https://")) {
@@ -1963,7 +1368,10 @@ var AuthManager = class {
       if (state) {
         const storedState = await this.storage.get(STORAGE_KEYS.AUTH_STATE);
         if (storedState && storedState !== state) {
-          log("State parameter mismatch:", { provided: state, stored: storedState });
+          log("State parameter mismatch:", {
+            provided: state,
+            stored: storedState
+          });
           return { success: false, error: "State parameter mismatch" };
         }
       }
@@ -1979,6 +1387,7 @@ var AuthManager = class {
       }
     } catch (error) {
       log("signInWithCode error:", error);
+      this.freshSignIn = false;
       return {
         success: false,
         error: error.message || "Authentication failed"
@@ -1986,18 +1395,95 @@ var AuthManager = class {
     }
   }
   /**
-   * Clear auth state and storage. Does NOT handle sync/DB cleanup —
-   * the UI layer (BasicProvider) wraps this to add sync teardown.
+   * Sign out: revoke the session server-side (`POST /auth/logout`, best
+   * effort), then clear auth state and storage. Does NOT handle sync/DB
+   * cleanup — the client layer wraps this to add sync teardown.
    */
   async signOut() {
     log("signing out!");
-    this.resetAuthState();
+    await this.revokeSessionOnServer();
+    this.resetAuthState("signed_out");
     await this.storage.remove(STORAGE_KEYS.AUTH_STATE);
     await this.storage.remove(STORAGE_KEYS.LAST_CONNECT_REPORT);
     await this.clearStoredAuth();
     this.broadcastSignOut();
     this.notify();
   }
+  /**
+   * Best-effort server-side revocation of the current device/session and
+   * its refresh chain (Step 2 auth: logout is finally server-side).
+   * Never blocks or fails the local sign-out.
+   */
+  async revokeSessionOnServer() {
+    try {
+      let accessToken = null;
+      try {
+        accessToken = await this.getToken();
+      } catch {
+        accessToken = this.token?.access_token ?? null;
+      }
+      if (!accessToken) return;
+      const endpoints = await this.getActivePdsEndpoints();
+      await fetch(`${endpoints.pds_url}/auth/logout`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${accessToken}` }
+      });
+      log("Server-side logout succeeded");
+    } catch (error) {
+      log("Server-side logout failed (non-blocking):", error);
+    }
+  }
+  async reconcileSession(reason = "manual", options) {
+    if (this.authStatus === "signed_out" || this.authStatus === "reauth_required") {
+      return;
+    }
+    if (!this.isOnline) {
+      this.updateAuthStatus("recovering", this.authErrorCode);
+      this.notify();
+      return;
+    }
+    const throttleMs = options?.throttleMs ?? SESSION_RECONCILE_THROTTLE_MS;
+    const forceRefresh = options?.forceRefresh === true;
+    const now = Date.now();
+    if (this.sessionCheckPromise) {
+      return this.sessionCheckPromise;
+    }
+    if (!forceRefresh && now - this.lastSessionCheckAt < throttleMs) {
+      return;
+    }
+    this.lastSessionCheckAt = now;
+    let sessionCheck = null;
+    sessionCheck = (async () => {
+      try {
+        const accessToken = await this.getToken(
+          forceRefresh ? { forceRefresh: true } : void 0
+        );
+        const currentSession = await this.fetchCurrentSession(accessToken);
+        if (currentSession?.active) {
+          this.updateAuthStatus("authenticated");
+          this.notify();
+          if (!this.user) {
+            await this.recoverMissingUserProfile(reason, accessToken);
+          }
+        }
+      } catch (error) {
+        log(`Session reconciliation failed on ${reason}:`, error);
+        if (this.isDefinitiveAuthFailure(error)) {
+          return;
+        }
+        if (this.isNetworkError(error)) {
+          this.updateAuthStatus("recovering", this.authErrorCode);
+          this.notify();
+        }
+      } finally {
+        if (this.sessionCheckPromise === sessionCheck) {
+          this.sessionCheckPromise = null;
+        }
+      }
+    })();
+    this.sessionCheckPromise = sessionCheck;
+    return sessionCheck;
+  }
   hasScope(scope) {
     if (!this.tokenScope) return false;
     return this.tokenScope.split(/[\s,]+/).filter(Boolean).includes(scope);
@@ -2023,16 +1509,26 @@ var AuthManager = class {
     const handleOnline = async () => {
       log("Network came back online");
       this.isOnline = true;
-      if (this.pendingRefresh && this.token) {
+      if (this.pendingRefresh) {
         log("Retrying pending token refresh");
         this.pendingRefresh = false;
-        const refreshToken = this.token.refresh_token || await this.storage.get(STORAGE_KEYS.REFRESH_TOKEN);
+        const refreshToken = await this.getRefreshToken();
         if (refreshToken) {
           this.exchangeToken(refreshToken, true).catch((error) => {
             log("Retry refresh failed:", error);
           });
         }
       }
+      if (this.isSignedIn) {
+        this.reconcileSession("online event", {
+          forceRefresh: true,
+          throttleMs: 0
+        }).catch((error) => {
+          log("Session reconciliation on online failed:", error);
+        });
+      } else if (this.user) {
+        await this.restoreStoredSession("online restore");
+      }
     };
     const handleOffline = () => {
       log("Network went offline");
@@ -2040,9 +1536,11 @@ var AuthManager = class {
     };
     const handleVisibilityChange = () => {
       if (document.visibilityState === "visible" && this.isSignedIn) {
-        log("App became visible - checking token freshness");
-        this.getToken().catch((err) => {
-          log("Token refresh on visibility resume failed:", err);
+        log("App became visible - reconciling auth session");
+        this.reconcileSession("visibility resume", {
+          forceRefresh: true
+        }).catch((err) => {
+          log("Session reconciliation on visibility resume failed:", err);
         });
       }
     };
@@ -2095,12 +1593,18 @@ var AuthManager = class {
       if (elapsed < 24 * 60 * 60 * 1e3) return;
     }
     try {
-      await fetch(`${this.config.adminUrl}/project/${this.config.projectId}/user/connect`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ token: accessToken })
-      });
-      await this.storage.set(STORAGE_KEYS.LAST_CONNECT_REPORT, Date.now().toString());
+      await fetch(
+        `${this.config.adminUrl}/project/${this.config.projectId}/user/connect`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ token: accessToken })
+        }
+      );
+      await this.storage.set(
+        STORAGE_KEYS.LAST_CONNECT_REPORT,
+        Date.now().toString()
+      );
       log("Reported connection to admin server");
     } catch (err) {
       log("Failed to report connection (non-blocking):", err);
@@ -2111,32 +1615,37 @@ var AuthManager = class {
    */
   async processNewToken() {
     if (!this.token) {
-      this.isAuthReady = true;
+      this.updateAuthStatus("signed_out");
       this.notify();
       return;
     }
     try {
       const decoded = jwtDecode(this.token.access_token);
-      if (decoded.sub) this.did = decoded.sub;
-      if (decoded.scope) this.tokenScope = decoded.scope;
+      this.applyTokenClaims(decoded);
+      this.updateAuthStatus("authenticated");
+      this.notify();
+      this.broadcastSessionUpdate();
       await this.fetchUser(this.token.access_token);
     } catch (error) {
       log("Error processing token:", error);
-      this.isAuthReady = true;
+      this.updateAuthStatus("recovering");
       this.notify();
     }
   }
-  async restoreCachedUser() {
+  async restoreCachedUser(options) {
     const cached = await this.storage.get(STORAGE_KEYS.USER_INFO);
-    if (cached) {
+    if (cached && options?.hasRecoverableSession) {
       try {
         this.user = JSON.parse(cached);
-        this.isSignedIn = true;
-        log("Restored cached user info for offline mode");
+        log("Restored cached user info for recoverable session");
       } catch {
       }
+    } else {
+      this.user = null;
     }
-    this.isAuthReady = true;
+    this.updateAuthStatus(
+      options?.hasRecoverableSession ? "recovering" : "signed_out"
+    );
     this.notify();
   }
   async fetchUser(accessToken) {
@@ -2145,7 +1654,7 @@ var AuthManager = class {
       const endpoints = await this.getActivePdsEndpoints();
       const response = await fetch(endpoints.userinfo_endpoint, {
         method: "GET",
-        headers: { "Authorization": `Bearer ${accessToken}` }
+        headers: { Authorization: `Bearer ${accessToken}` }
       });
       if (!response.ok) {
         throw new Error(`Failed to fetch user info: ${response.status}`);
@@ -2156,28 +1665,22 @@ var AuthManager = class {
         throw new Error(`User info error: ${user.error}`);
       }
       if (this.token?.refresh_token) {
-        await this.storage.set(STORAGE_KEYS.REFRESH_TOKEN, this.token.refresh_token);
+        await this.storage.set(
+          STORAGE_KEYS.REFRESH_TOKEN,
+          this.token.refresh_token
+        );
       }
       await this.storage.set(STORAGE_KEYS.USER_INFO, JSON.stringify(user));
       log("Cached user info in storage");
       this.user = user;
-      this.isSignedIn = true;
-      this.isAuthReady = true;
-      if (this.freshSignIn) {
-        this.freshSignIn = false;
-        this.broadcastSignIn();
-      } else {
-        this.broadcastTokenRefresh();
+      if (this.authStatus !== "reauth_required") {
+        this.updateAuthStatus("authenticated");
       }
+      this.nextUserRecoveryAt = 0;
       this.notify();
     } catch (error) {
       log("Failed to fetch user info:", error);
-      if (this.isNetworkError(error)) {
-        await this.restoreCachedUser();
-      } else {
-        this.isAuthReady = true;
-        this.notify();
-      }
+      await this.handleUserFetchFailure();
     }
   }
   /**
@@ -2204,7 +1707,9 @@ var AuthManager = class {
         if (!this.isOnline) {
           log("Network is offline, marking refresh as pending");
           this.pendingRefresh = true;
-          throw new Error("Network offline - refresh will be retried when online");
+          throw new Error(
+            "Network offline - refresh will be retried when online"
+          );
         }
         const endpoints = await this.getActivePdsEndpoints();
         let requestBody;
@@ -2214,26 +1719,36 @@ var AuthManager = class {
             refresh_token: codeOrRefreshToken
           };
           if (this.config.projectId) {
-            requestBody.client_id = normalizeClientId(this.config.projectId, this.adminHostname);
+            requestBody.client_id = normalizeClientId(
+              this.config.projectId,
+              this.adminHostname
+            );
           }
         } else {
           requestBody = {
             grant_type: "authorization_code",
             code: codeOrRefreshToken
           };
-          const storedRedirectUri = await this.storage.get(STORAGE_KEYS.REDIRECT_URI);
+          const storedRedirectUri = await this.storage.get(
+            STORAGE_KEYS.REDIRECT_URI
+          );
           if (storedRedirectUri) {
             requestBody.redirect_uri = storedRedirectUri;
             log("Including redirect_uri in token exchange:", storedRedirectUri);
           } else {
             log("Warning: No redirect_uri found in storage for token exchange");
           }
-          const codeVerifier = await this.storage.get(STORAGE_KEYS.CODE_VERIFIER);
+          const codeVerifier = await this.storage.get(
+            STORAGE_KEYS.CODE_VERIFIER
+          );
           if (codeVerifier) {
             requestBody.code_verifier = codeVerifier;
           }
           if (this.config.projectId) {
-            requestBody.client_id = normalizeClientId(this.config.projectId, this.adminHostname);
+            requestBody.client_id = normalizeClientId(
+              this.config.projectId,
+              this.adminHostname
+            );
           }
         }
         log("Token exchange request body:", {
@@ -2241,56 +1756,83 @@ var AuthManager = class {
           ...isRefreshToken ? { refresh_token: "[REDACTED]" } : { code: "[REDACTED]" },
           ...requestBody.code_verifier ? { code_verifier: "[REDACTED]" } : {}
         });
-        const token = await fetch(endpoints.token_endpoint, {
+        const response = await fetch(endpoints.token_endpoint, {
           method: "POST",
           headers: { "Content-Type": "application/json" },
           body: JSON.stringify(requestBody)
-        }).then((response) => response.json()).catch((error) => {
+        }).catch((error) => {
           log("Network error fetching token:", error);
           if (!this.isOnline) {
             this.pendingRefresh = true;
-            throw new Error("Network offline - refresh will be retried when online");
+            throw new Error(
+              "Network offline - refresh will be retried when online"
+            );
           }
           throw new Error("Network error during token refresh");
         });
+        if (response.status === 429) {
+          log("Token endpoint rate limited (429) - will retry later");
+          this.pendingRefresh = true;
+          throw new Error(
+            "Token endpoint rate limited - refresh will be retried"
+          );
+        }
+        const token = await response.json().catch(() => {
+          throw new Error(
+            `Token endpoint returned invalid JSON (status ${response.status})`
+          );
+        });
         if (token.access_token) {
           try {
             const decoded = jwtDecode(token.access_token);
             if (decoded.typ === "refresh") {
               log("Error: received refresh token as access token");
-              throw new Error("Invalid token: received refresh token instead of access token");
+              throw new Error(
+                "Invalid token: received refresh token instead of access token"
+              );
             }
           } catch (decodeError) {
             if (decodeError.message.includes("Invalid token")) {
               throw decodeError;
             }
-            log("Warning: could not decode access token for type check:", decodeError);
+            log(
+              "Warning: could not decode access token for type check:",
+              decodeError
+            );
           }
         }
         if (token.error) {
           log("error fetching token", token.error);
           if (typeof token.error === "string" && (token.error.includes("network") || token.error.includes("timeout"))) {
             this.pendingRefresh = true;
-            throw new Error("Network issue - refresh will be retried when online");
+            throw new Error(
+              "Network issue - refresh will be retried when online"
+            );
           }
-          const definitiveErrors = ["invalid_grant", "invalid_client", "unauthorized_client"];
-          if (typeof token.error === "string" && definitiveErrors.includes(token.error)) {
-            await this.clearStoredAuth();
-            this.resetAuthState();
-            this.notify();
+          if (this.isDefinitiveTokenErrorCode(token.error)) {
+            await this.markReauthRequired(token.error);
+            throw new DefinitiveAuthError(token.error);
           }
           throw new Error(`Token refresh failed: ${token.error}`);
         } else {
+          if (!token.access_token) {
+            throw new Error("Token response missing access token");
+          }
           this.token = token;
           this.pendingRefresh = false;
           if (token.refresh_token) {
-            await this.storage.set(STORAGE_KEYS.REFRESH_TOKEN, token.refresh_token);
+            await this.storage.set(
+              STORAGE_KEYS.REFRESH_TOKEN,
+              token.refresh_token
+            );
             log("Updated refresh token in storage");
           }
           if (!isRefreshToken) {
             await this.storage.remove(STORAGE_KEYS.REDIRECT_URI);
             await this.storage.remove(STORAGE_KEYS.CODE_VERIFIER);
-            log("Cleaned up redirect_uri and code_verifier from storage after successful exchange");
+            log(
+              "Cleaned up redirect_uri and code_verifier from storage after successful exchange"
+            );
           }
           this.reportConnection(token.access_token).catch(() => {
           });
@@ -2299,12 +1841,12 @@ var AuthManager = class {
         return token;
       } catch (error) {
         log("Token refresh error:", error);
-        const msg = error instanceof Error ? error.message : "";
-        const alreadyHandled = msg.startsWith("Token refresh failed:");
-        if (!alreadyHandled && !this.isNetworkError(error)) {
-          await this.clearStoredAuth();
-          this.resetAuthState();
-          this.notify();
+        if (this.isDefinitiveAuthFailure(error)) {
+          log("Preserving cleared auth state after definitive token rejection");
+        } else if (this.isNetworkError(error)) {
+          log("Recoverable network auth failure - preserving session state");
+        } else {
+          log("Recoverable auth failure - preserving session state");
         }
         throw error;
       }
@@ -2328,13 +1870,15 @@ var AuthManager = class {
     }
     return tokenPromise;
   }
-  resetAuthState() {
-    this.user = null;
-    this.isSignedIn = false;
+  resetAuthState(status = "signed_out") {
+    this.user = status === "reauth_required" ? this.user : null;
     this.token = null;
-    this.did = null;
+    if (status !== "reauth_required") {
+      this.did = null;
+    }
     this.tokenScope = null;
-    this.isAuthReady = true;
+    this.nextUserRecoveryAt = 0;
+    this.updateAuthStatus(status);
   }
   async clearStoredAuth() {
     await this.storage.remove(STORAGE_KEYS.REFRESH_TOKEN);
@@ -2347,147 +1891,1649 @@ var AuthManager = class {
   isNetworkError(error) {
     if (error instanceof TypeError) return true;
     if (error instanceof Error) {
-      return error.message.includes("offline") || error.message.includes("Network");
+      return error.message.includes("offline") || error.message.includes("Network") || // 429 on the token endpoint: transient, keep the session alive
+      error.message.includes("rate limited");
     }
     return false;
   }
-};
-
-// src/AuthContext.tsx
-init_config();
-init_package();
-
-// src/updater/versionUpdater.ts
-init_config();
-var VersionUpdater = class {
-  storage;
-  currentVersion;
-  migrations;
-  versionKey = "basic_app_version";
-  constructor(storage, currentVersion, migrations = []) {
-    this.storage = storage;
-    this.currentVersion = currentVersion;
-    this.migrations = migrations.sort((a, b) => this.compareVersions(a.fromVersion, b.fromVersion));
+  async getRefreshToken() {
+    const storedRefreshToken = await this.storage.get(
+      STORAGE_KEYS.REFRESH_TOKEN
+    );
+    if (storedRefreshToken) {
+      log("Using refresh token from storage");
+      if (this.token && this.token.refresh_token !== storedRefreshToken) {
+        this.token = { ...this.token, refresh_token: storedRefreshToken };
+      }
+      return storedRefreshToken;
+    }
+    const memoryRefreshToken = this.token?.refresh_token ?? null;
+    if (memoryRefreshToken) {
+      log("Using refresh token from memory fallback");
+    } else {
+      log("No refresh token available in storage or memory");
+    }
+    return memoryRefreshToken;
+  }
+  async syncRefreshTokenFromStorage() {
+    const storedRefreshToken = await this.storage.get(
+      STORAGE_KEYS.REFRESH_TOKEN
+    );
+    if (storedRefreshToken && this.token && this.token.refresh_token !== storedRefreshToken) {
+      this.token = { ...this.token, refresh_token: storedRefreshToken };
+      log("Synced refresh token from shared storage into memory");
+    }
+  }
+  applyTokenClaims(decoded) {
+    this.did = decoded.sub || null;
+    this.tokenScope = decoded.scope || null;
+  }
+  broadcastSessionUpdate() {
+    if (this.freshSignIn) {
+      this.freshSignIn = false;
+      this.broadcastSignIn();
+    } else {
+      this.broadcastTokenRefresh();
+    }
+  }
+  async handleUserFetchFailure() {
+    if (this.isCompatibleUser(this.user)) {
+      log("Preserving existing user after userinfo failure");
+    } else if (this.user) {
+      log("Discarding stale in-memory user after userinfo failure");
+      this.user = null;
+    }
+    if (!this.user) {
+      const cached = await this.storage.get(STORAGE_KEYS.USER_INFO);
+      if (cached) {
+        try {
+          const parsed = JSON.parse(cached);
+          if (this.isCompatibleUser(parsed)) {
+            this.user = parsed;
+            log("Recovered cached user after userinfo failure");
+          } else {
+            log("Cached user did not match the active session");
+          }
+        } catch (error) {
+          log("Failed to parse cached user after userinfo failure:", error);
+        }
+      }
+    }
+    if (!this.user) {
+      log("No compatible cached user available after userinfo failure");
+      this.nextUserRecoveryAt = Date.now() + USER_RECOVERY_RETRY_COOLDOWN_MS;
+    } else {
+      this.nextUserRecoveryAt = 0;
+    }
+    if (this.authStatus === "bootstrapping") {
+      this.updateAuthStatus(this.token ? "authenticated" : "recovering");
+    }
+    this.notify();
+  }
+  isCompatibleUser(user) {
+    if (!user) return false;
+    if (!this.did) return true;
+    return user.sub === this.did;
+  }
+  async recoverMissingUserProfile(reason, accessToken) {
+    if (!this.isSignedIn || this.user) return;
+    const now = Date.now();
+    if (this.nextUserRecoveryAt > now) {
+      log(
+        `Skipping user profile recovery on ${reason} until ${new Date(this.nextUserRecoveryAt).toISOString()}`
+      );
+      return;
+    }
+    log(`Attempting user profile recovery on ${reason}`);
+    const token = accessToken ?? await this.getToken();
+    if (this.user) return;
+    await this.fetchUser(token);
+  }
+  isDefinitiveTokenErrorCode(code) {
+    return typeof code === "string" && DEFINITIVE_TOKEN_ERRORS.has(code);
+  }
+  isDefinitiveAuthFailure(error) {
+    return error instanceof DefinitiveAuthError;
   }
   /**
-   * Check current stored version and run migrations if needed
-   * Only compares major.minor versions, ignoring beta/prerelease parts
-   * Example: "0.7.0-beta.1" and "0.7.0" are treated as the same version
+   * Centralised auth status setter. Derives `isSignedIn` and `isAuthReady`
+   * from the status so they stay consistent.
+   *
+   * `isSignedIn` is intentionally `true` during `reauth_required` so the
+   * UI layer can still display user info while prompting re-authentication.
+   * Consumers should check `authStatus` (or a future convenience getter)
+   * when they need to distinguish "healthy session" from "needs re-auth".
    */
-  async checkAndUpdate() {
-    const storedVersion = await this.getStoredVersion();
-    if (!storedVersion) {
-      await this.setStoredVersion(this.currentVersion);
-      return { updated: false, toVersion: this.currentVersion };
-    }
-    if (storedVersion === this.currentVersion) {
-      return { updated: false, toVersion: this.currentVersion };
+  updateAuthStatus(status, errorCode = null) {
+    this.authStatus = status;
+    this.authErrorCode = errorCode;
+    this.isSignedIn = status === "authenticated" || status === "recovering" || status === "reauth_required";
+    this.isAuthReady = status !== "bootstrapping";
+  }
+  async clearStoredSessionTokens() {
+    await this.storage.remove(STORAGE_KEYS.REFRESH_TOKEN);
+    await this.storage.remove(STORAGE_KEYS.REDIRECT_URI);
+    await this.storage.remove(STORAGE_KEYS.CODE_VERIFIER);
+  }
+  async restoreStoredSession(reason) {
+    const refreshToken = await this.getRefreshToken();
+    if (!refreshToken) {
+      log(`No stored refresh token available during ${reason}`);
+      await this.restoreCachedUser({ hasRecoverableSession: false });
+      return;
     }
-    const migrationsToRun = this.getMigrationsToRun(storedVersion, this.currentVersion);
-    if (migrationsToRun.length === 0) {
-      await this.setStoredVersion(this.currentVersion);
-      return { updated: true, fromVersion: storedVersion, toVersion: this.currentVersion };
+    log(`Restoring stored session during ${reason}`);
+    await this.restoreCachedUser({ hasRecoverableSession: true });
+    if (!this.isOnline) {
+      return;
     }
-    for (const migration of migrationsToRun) {
+    this.exchangeToken(refreshToken, true).catch(async (error) => {
+      log(`Stored session refresh failed during ${reason}:`, error);
+      if (this.isDefinitiveAuthFailure(error)) {
+        return;
+      }
+      await this.restoreCachedUser({ hasRecoverableSession: true });
+    });
+  }
+  async handleExternalTokenRefresh(data) {
+    await this.syncRefreshTokenFromStorage();
+    const refreshToken = await this.getRefreshToken();
+    if (data.accessToken && refreshToken) {
       try {
-        log(`Running migration from ${migration.fromVersion} to ${migration.toVersion}`);
-        await migration.migrate(this.storage);
+        const decoded = jwtDecode(data.accessToken);
+        const expiresIn = decoded.exp != null ? Math.max(0, decoded.exp - Math.floor(Date.now() / 1e3)) : 0;
+        this.token = {
+          access_token: data.accessToken,
+          token_type: "Bearer",
+          expires_in: expiresIn,
+          refresh_token: refreshToken
+        };
+        this.applyTokenClaims(decoded);
       } catch (error) {
-        console.error(`Migration failed from ${migration.fromVersion} to ${migration.toVersion}:`, error);
-        throw new Error(`Migration failed: ${error}`);
+        log("Failed to decode token refreshed by another tab:", error);
+        this.token = {
+          access_token: data.accessToken,
+          token_type: "Bearer",
+          expires_in: 0,
+          refresh_token: refreshToken
+        };
+      }
+      if (this.authStatus !== "reauth_required") {
+        this.updateAuthStatus("authenticated");
       }
+    } else if (refreshToken) {
+      await this.restoreCachedUser({ hasRecoverableSession: true });
     }
-    await this.setStoredVersion(this.currentVersion);
-    return { updated: true, fromVersion: storedVersion, toVersion: this.currentVersion };
+    if (data.did) this.did = data.did;
+    if (data.tokenScope) this.tokenScope = data.tokenScope;
+    this.notify();
   }
-  async getStoredVersion() {
-    try {
-      const versionData = await this.storage.get(this.versionKey);
-      if (!versionData) return null;
-      const versionInfo = JSON.parse(versionData);
-      return versionInfo.version;
-    } catch (error) {
-      console.warn("Failed to get stored version:", error);
-      return null;
+  async fetchCurrentSession(accessToken) {
+    const endpoints = await this.getActivePdsEndpoints();
+    const response = await fetch(`${endpoints.pds_url}/auth/session`, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${accessToken}` }
+    });
+    const data = await response.json().catch(() => ({}));
+    if (response.status === 401 && data.reauth_required) {
+      await this.markReauthRequired(data.error || "invalid_session");
+      throw new DefinitiveAuthError(data.error || "invalid_session");
+    }
+    if (!response.ok) {
+      throw new Error(`Failed to reconcile session: ${response.status}`);
     }
+    return data;
   }
-  async setStoredVersion(version2) {
-    const versionInfo = {
-      version: version2,
-      lastUpdated: Date.now()
-    };
-    await this.storage.set(this.versionKey, JSON.stringify(versionInfo));
+  async markReauthRequired(code, options) {
+    log("Marking auth session as requiring reauthentication:", code);
+    await this.clearStoredSessionTokens();
+    if (!this.user) {
+      const cached = await this.storage.get(STORAGE_KEYS.USER_INFO);
+      if (cached) {
+        try {
+          this.user = JSON.parse(cached);
+        } catch {
+        }
+      }
+    }
+    this.token = null;
+    this.tokenScope = null;
+    this.nextUserRecoveryAt = 0;
+    this.updateAuthStatus("reauth_required", code);
+    if (options?.broadcast !== false) {
+      this.broadcastSessionInvalidated(code);
+    }
+    this.notify();
   }
-  getMigrationsToRun(fromVersion, toVersion) {
-    return this.migrations.filter((migration) => {
-      const storedLessThanMigrationTo = this.compareVersions(fromVersion, migration.toVersion) < 0;
-      const currentGreaterThanOrEqualMigrationTo = this.compareVersions(toVersion, migration.toVersion) >= 0;
-      const shouldRun = storedLessThanMigrationTo && currentGreaterThanOrEqualMigrationTo;
-      log(`Migration ${migration.fromVersion} \u2192 ${migration.toVersion}: shouldRun=${shouldRun}`);
-      return shouldRun;
-    });
+};
+
+// src/core/http/RestClient.ts
+var RestError = class extends Error {
+  status;
+  code;
+  response;
+  constructor(message, status, code, response) {
+    super(message);
+    this.name = "RestError";
+    this.status = status;
+    this.code = code;
+    this.response = response;
+  }
+};
+var NotAuthenticatedError = class extends Error {
+  constructor(message = "Not authenticated") {
+    super(message);
+    this.name = "NotAuthenticatedError";
   }
+};
+var RestClient = class {
+  opts;
+  constructor(opts) {
+    this.opts = { ...opts, baseUrl: opts.baseUrl.replace(/\/$/, "") };
+  }
+  get projectId() {
+    return this.opts.projectId;
+  }
+  // -------------------------------------------------------------------
+  // Sync surface
+  // -------------------------------------------------------------------
+  /** `GET /account/:project_id/db` — tables, enforced schema version, channel head. */
+  async getDbInfo() {
+    const res = await this.request("GET", `${this.dbPath}`);
+    return res.data;
+  }
+  /** Bootstrap snapshot (SPEC §5). `share` bootstraps a mount; `table` filters. */
+  async getSnapshot(options) {
+    const query = new URLSearchParams();
+    if (options?.share) query.set("share", options.share);
+    if (options?.table) query.set("table", options.table);
+    const qs = query.toString();
+    const res = await this.request(
+      "GET",
+      `${this.dbPath}/snapshot${qs ? `?${qs}` : ""}`
+    );
+    return res.data;
+  }
+  /** Pull ordered ops after a cursor — the non-WebSocket sync path. */
+  async getChanges(options) {
+    const query = new URLSearchParams({ cursor: String(options.cursor) });
+    if (options.limit) query.set("limit", String(options.limit));
+    if (options.share) query.set("share", options.share);
+    if (options.table) query.set("table", options.table);
+    const res = await this.request(
+      "GET",
+      `${this.dbPath}/changes?${query.toString()}`
+    );
+    return res.data;
+  }
+  // -------------------------------------------------------------------
+  // Shares (multiplayer v1)
+  // -------------------------------------------------------------------
   /**
-   * Simple semantic version comparison (major.minor only, ignoring beta/prerelease)
-   * Returns: -1 if a < b, 0 if a === b, 1 if a > b
+   * Shares granted by and received by the caller. App tokens see only
+   * shares involving their own app (the ones they can mount).
    */
-  compareVersions(a, b) {
-    const aMajorMinor = this.extractMajorMinor(a);
-    const bMajorMinor = this.extractMajorMinor(b);
-    if (aMajorMinor.major !== bMajorMinor.major) {
-      return aMajorMinor.major - bMajorMinor.major;
+  async listShares() {
+    const res = await this.request(
+      "GET",
+      "/account/shares"
+    );
+    return res.data;
+  }
+  // -------------------------------------------------------------------
+  // CRUD on materialized state (REST-mode table API)
+  // -------------------------------------------------------------------
+  async list(table, query) {
+    const qs = query ? `?${new URLSearchParams(query).toString()}` : "";
+    const res = await this.request(
+      "GET",
+      `${this.dbPath}/${encodeURIComponent(table)}${qs}`
+    );
+    return res.data ?? [];
+  }
+  async getRecord(table, id) {
+    try {
+      const res = await this.request(
+        "GET",
+        `${this.dbPath}/${encodeURIComponent(table)}/${encodeURIComponent(id)}`
+      );
+      return res.data ?? null;
+    } catch (err) {
+      if (err instanceof RestError && err.status === 404) return null;
+      throw err;
     }
-    return aMajorMinor.minor - bMajorMinor.minor;
   }
-  /**
-   * Extract major.minor from version string, ignoring beta/prerelease
-   * Examples: "0.7.0-beta.1" -> {major: 0, minor: 7}
-   *           "1.2.3" -> {major: 1, minor: 2}
-   */
-  extractMajorMinor(version2) {
-    const cleanVersion = version2.split("-")[0]?.split("+")[0] || version2;
-    const parts = cleanVersion.split(".").map(Number);
-    return {
-      major: parts[0] || 0,
-      minor: parts[1] || 0
-    };
+  /** `POST` — server mints the record id. */
+  async createRecord(table, value) {
+    const res = await this.request(
+      "POST",
+      `${this.dbPath}/${encodeURIComponent(table)}`,
+      { value }
+    );
+    return res.data;
   }
-  /**
-   * Add a migration to the updater
-   */
-  addMigration(migration) {
-    this.migrations.push(migration);
-    this.migrations.sort((a, b) => this.compareVersions(a.fromVersion, b.fromVersion));
+  /** `PUT` — full replace. REST semantics: 404 for missing records. */
+  async putRecord(table, id, value) {
+    try {
+      const res = await this.request(
+        "PUT",
+        `${this.dbPath}/${encodeURIComponent(table)}/${encodeURIComponent(id)}`,
+        { value }
+      );
+      return res.data ?? null;
+    } catch (err) {
+      if (err instanceof RestError && err.status === 404) return null;
+      throw err;
+    }
+  }
+  /** `PATCH` — partial merge. 404 → null. */
+  async patchRecord(table, id, value) {
+    try {
+      const res = await this.request(
+        "PATCH",
+        `${this.dbPath}/${encodeURIComponent(table)}/${encodeURIComponent(id)}`,
+        { value }
+      );
+      return res.data ?? null;
+    } catch (err) {
+      if (err instanceof RestError && err.status === 404) return null;
+      throw err;
+    }
+  }
+  /** `DELETE`. Returns false when the record did not exist. */
+  async deleteRecord(table, id) {
+    try {
+      await this.request(
+        "DELETE",
+        `${this.dbPath}/${encodeURIComponent(table)}/${encodeURIComponent(id)}`
+      );
+      return true;
+    } catch (err) {
+      if (err instanceof RestError && err.status === 404) return false;
+      throw err;
+    }
+  }
+  // -------------------------------------------------------------------
+  // Internals
+  // -------------------------------------------------------------------
+  get dbPath() {
+    return `/account/${encodeURIComponent(this.opts.projectId)}/db`;
+  }
+  /** Authenticated request; retries once with a force-refreshed token on 401. */
+  async request(method, path, body, isRetry = false) {
+    let token;
+    try {
+      token = await this.opts.getToken(isRetry ? { forceRefresh: true } : void 0);
+    } catch (err) {
+      throw new NotAuthenticatedError(
+        err instanceof Error ? err.message : "could not get access token"
+      );
+    }
+    const url = `${this.opts.baseUrl}${path}`;
+    this.opts.log?.("[rest]", method, url);
+    const headers = { Authorization: `Bearer ${token}` };
+    if (body !== void 0) headers["Content-Type"] = "application/json";
+    const response = await fetch(url, {
+      method,
+      headers,
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+    });
+    const responseData = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      if (response.status === 401 && !isRetry) {
+        this.opts.log?.("[rest] 401 \u2014 refreshing token and retrying once");
+        return this.request(method, path, body, true);
+      }
+      const code = typeof responseData.error === "string" ? responseData.error : void 0;
+      const message = typeof responseData.message === "string" && responseData.message || code || `request failed: ${response.status}`;
+      throw new RestError(message, response.status, code, responseData);
+    }
+    return responseData;
   }
 };
-function createVersionUpdater(storage, currentVersion, migrations = []) {
-  return new VersionUpdater(storage, currentVersion, migrations);
-}
 
-// src/updater/updateMigrations.ts
-init_config();
-var addMigrationTimestamp = {
-  fromVersion: "0.6.0",
-  toVersion: "0.7.0",
-  async migrate(storage) {
-    log("Running migration 0.6.0 \u2192 0.7.0");
-    storage.set("test_migration", "true");
-  }
+// src/core/sync/SyncEngine.ts
+import { validateData } from "@basictech/schema";
+
+// src/core/sync/protocol.ts
+var PROTOCOL_VERSION = 1;
+var TERMINAL_OP_ERRORS = /* @__PURE__ */ new Set([
+  "SCHEMA_VALIDATION_FAILED",
+  "UNKNOWN_TABLE",
+  "RECORD_NOT_FOUND",
+  "PERMISSION_DENIED",
+  "PAYLOAD_TOO_LARGE",
+  "CHANNEL_FULL",
+  "BAD_MESSAGE"
+]);
+function isTerminalOpError(code, terminalFlag) {
+  if (terminalFlag !== void 0) return terminalFlag;
+  return code !== void 0 && TERMINAL_OP_ERRORS.has(code);
+}
+function isRebootstrapError(code) {
+  return code === "SNAPSHOT_REQUIRED" || code === "RESET_REQUIRED";
+}
+function isRevocationError(code) {
+  return code === "SHARE_REVOKED" || code === "CONNECTION_REVOKED";
+}
+function isAuthError(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_EXPIRED";
+}
+var DEFAULT_LIMITS = {
+  max_ops_per_push: 500,
+  max_op_bytes: 64 * 1024,
+  replay_limit: 1e3
 };
-function getMigrations() {
-  return [
-    addMigrationTimestamp
-  ];
+function mintOpId() {
+  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
+    return crypto.randomUUID();
+  }
+  return "op-" + Math.random().toString(36).slice(2) + Date.now().toString(36);
+}
+function cloneData(value) {
+  return value === void 0 ? value : JSON.parse(JSON.stringify(value));
+}
+function applyOpToData(existing, op) {
+  switch (op.type) {
+    case "put":
+      return cloneData(op.data ?? {});
+    case "patch":
+      if (existing === void 0) return void 0;
+      return { ...existing, ...cloneData(op.data ?? {}) };
+    case "delete":
+      return void 0;
+  }
 }
 
-// src/AuthContext.tsx
-init_network();
-
-// src/utils/schema.ts
-init_config();
-import { validateSchema, compareSchemas } from "@basictech/schema";
-async function getSchemaStatus(schema) {
-  const projectId = schema.project_id;
+// src/core/sync/SyncConnection.ts
+var INITIAL_RECONNECT_DELAY_MS = 500;
+var MAX_RECONNECT_DELAY_MS = 3e4;
+var SyncConnection = class {
+  opts;
+  WS;
+  heartbeatMs;
+  ws = null;
+  _status = "idle";
+  stopped = true;
+  reconnectDelay = INITIAL_RECONNECT_DELAY_MS;
+  timers = /* @__PURE__ */ new Set();
+  heartbeatTimer = null;
+  /** One forced-refresh reconnect attempt per auth rejection. */
+  authRetryUsed = false;
+  removeOnlineListener = null;
+  constructor(opts) {
+    this.opts = opts;
+    this.WS = opts.WebSocketImpl ?? globalThis.WebSocket;
+    this.heartbeatMs = opts.heartbeatMs ?? 3e4;
+  }
+  get status() {
+    return this._status;
+  }
+  get isOnline() {
+    return this._status === "online" && this.ws?.readyState === 1;
+  }
+  start() {
+    if (!this.stopped && this.ws) return;
+    this.stopped = false;
+    this.authRetryUsed = false;
+    this.listenForNetwork();
+    this.open();
+  }
+  stop() {
+    this.stopped = true;
+    this.clearTimers();
+    this.removeOnlineListener?.();
+    this.removeOnlineListener = null;
+    if (this.ws) {
+      try {
+        this.ws.close();
+      } catch {
+      }
+      this.ws = null;
+    }
+    this.setStatus("stopped");
+  }
+  /** Send a message; returns false when the socket is not open. */
+  send(msg) {
+    if (this.ws?.readyState === 1) {
+      this.ws.send(JSON.stringify(msg));
+      return true;
+    }
+    return false;
+  }
+  /** Refresh auth on the live socket (no reconnect). */
+  async sendToken() {
+    if (!this.isOnline) return;
+    try {
+      const token = await this.opts.getToken();
+      this.send({ type: "token", token });
+    } catch {
+    }
+  }
+  /**
+   * The server rejected our token (`UNAUTHORIZED` / `TOKEN_EXPIRED` + close).
+   * Retry once with a force-refreshed token; give up (status `auth_failed`)
+   * when the refresh itself fails or a fresh token is rejected again.
+   */
+  handleAuthRejection() {
+    if (this.stopped) return;
+    if (this.authRetryUsed) {
+      this.log("fresh token rejected \u2014 giving up until reauth");
+      this.stopped = true;
+      this.clearTimers();
+      this.setStatus("auth_failed");
+      return;
+    }
+    this.authRetryUsed = true;
+    this.log("token rejected \u2014 force refreshing and reconnecting");
+    void (async () => {
+      try {
+        await this.opts.getToken({ forceRefresh: true });
+        this.scheduleReconnect(0);
+      } catch (err) {
+        this.log("token refresh failed after auth rejection:", err);
+        this.stopped = true;
+        this.setStatus("auth_failed");
+      }
+    })();
+  }
+  // -------------------------------------------------------------------
+  // Internals
+  // -------------------------------------------------------------------
+  open() {
+    if (this.stopped) return;
+    if (this.ws && (this.ws.readyState === 0 || this.ws.readyState === 1)) return;
+    if (!this.WS) {
+      this.log("no WebSocket implementation available");
+      this.setStatus("offline");
+      return;
+    }
+    this.setStatus("connecting");
+    const ws = new this.WS(this.opts.wsUrl);
+    this.ws = ws;
+    ws.onopen = () => {
+      void (async () => {
+        try {
+          const token = await this.opts.getToken();
+          if (this.ws !== ws || ws.readyState !== 1) return;
+          const hello = { type: "hello", version: PROTOCOL_VERSION, token };
+          ws.send(JSON.stringify(hello));
+        } catch (err) {
+          this.log("could not get token for hello:", err);
+          try {
+            ws.close();
+          } catch {
+          }
+        }
+      })();
+    };
+    ws.onmessage = (event) => {
+      let msg;
+      try {
+        const text = typeof event.data === "string" ? event.data : new TextDecoder().decode(event.data);
+        msg = JSON.parse(text);
+      } catch {
+        return;
+      }
+      this.handleMessage(msg);
+    };
+    ws.onclose = () => {
+      if (this.ws !== ws) return;
+      this.ws = null;
+      this.stopHeartbeat();
+      if (this.stopped) return;
+      this.setStatus("offline");
+      this.scheduleReconnect();
+    };
+    ws.onerror = () => {
+    };
+  }
+  handleMessage(msg) {
+    if (msg.type === "welcome") {
+      this.reconnectDelay = INITIAL_RECONNECT_DELAY_MS;
+      this.authRetryUsed = false;
+      this.setStatus("online");
+      this.startHeartbeat();
+      this.opts.onWelcome(msg);
+      return;
+    }
+    if (msg.type === "error" && !("sub" in msg && msg.sub) && isAuthError(msg.code)) {
+      this.handleAuthRejection();
+      this.opts.onMessage(msg);
+      return;
+    }
+    this.opts.onMessage(msg);
+  }
+  startHeartbeat() {
+    this.stopHeartbeat();
+    const tick = () => {
+      if (this.stopped) return;
+      this.send({ type: "ping" });
+      this.heartbeatTimer = setTimeout(tick, this.heartbeatMs);
+      this.timers.add(this.heartbeatTimer);
+    };
+    this.heartbeatTimer = setTimeout(tick, this.heartbeatMs);
+    this.timers.add(this.heartbeatTimer);
+  }
+  stopHeartbeat() {
+    if (this.heartbeatTimer) {
+      clearTimeout(this.heartbeatTimer);
+      this.timers.delete(this.heartbeatTimer);
+      this.heartbeatTimer = null;
+    }
+  }
+  scheduleReconnect(delayOverride) {
+    if (this.stopped) return;
+    const delay = delayOverride ?? this.reconnectDelay;
+    this.reconnectDelay = Math.min(this.reconnectDelay * 2, MAX_RECONNECT_DELAY_MS);
+    this.log(`reconnecting in ${delay}ms`);
+    const timer = setTimeout(() => {
+      this.timers.delete(timer);
+      this.open();
+    }, delay);
+    this.timers.add(timer);
+  }
+  listenForNetwork() {
+    if (this.removeOnlineListener || typeof window === "undefined") return;
+    const handleOnline = () => {
+      if (this.stopped) return;
+      this.log("network online \u2014 reconnecting immediately");
+      this.reconnectDelay = INITIAL_RECONNECT_DELAY_MS;
+      this.open();
+    };
+    window.addEventListener("online", handleOnline);
+    this.removeOnlineListener = () => window.removeEventListener("online", handleOnline);
+  }
+  clearTimers() {
+    for (const t of this.timers) clearTimeout(t);
+    this.timers.clear();
+    this.heartbeatTimer = null;
+  }
+  setStatus(status) {
+    if (this._status === status) return;
+    this._status = status;
+    this.opts.onStatus(status);
+  }
+  log(...args) {
+    this.opts.log?.("[sync-connection]", ...args);
+  }
+};
+
+// src/core/sync/SyncStore.ts
+import Dexie from "dexie";
+var META_CURSOR = "cursor";
+var META_CHANNEL = "channel";
+var SyncStore = class {
+  db;
+  name;
+  tableNames;
+  constructor(name, schema) {
+    this.name = name;
+    this.tableNames = Object.keys(schema.tables);
+    this.db = new Dexie(name);
+    const stores = {
+      _server: "[table+record_id], table",
+      _pending: "++idx, op_id",
+      _rejected: "++idx, op_id",
+      _meta: "key"
+    };
+    for (const [tableName, table] of Object.entries(schema.tables)) {
+      const indexed = Object.entries(table.fields).filter(([, f]) => f.indexed).map(([fieldName]) => `,${fieldName}`).join("");
+      stores[tableName] = "id" + indexed;
+    }
+    this.db.version(Math.max(schema.version ?? 1, 1)).stores(stores);
+  }
+  /** The Dexie view table for an app table (what liveQuery reads). */
+  view(table) {
+    return this.db.table(table);
+  }
+  hasTable(table) {
+    return this.tableNames.includes(table);
+  }
+  get tables() {
+    return [...this.tableNames];
+  }
+  get server() {
+    return this.db.table("_server");
+  }
+  get pending() {
+    return this.db.table("_pending");
+  }
+  get rejected() {
+    return this.db.table("_rejected");
+  }
+  get meta() {
+    return this.db.table("_meta");
+  }
+  get allStores() {
+    return ["_server", "_pending", "_rejected", "_meta", ...this.tableNames];
+  }
+  // -------------------------------------------------------------------
+  // Meta
+  // -------------------------------------------------------------------
+  async getCursor() {
+    const row = await this.meta.get(META_CURSOR);
+    return typeof row?.value === "number" ? row.value : null;
+  }
+  async getChannel() {
+    const row = await this.meta.get(META_CHANNEL);
+    return typeof row?.value === "string" ? row.value : null;
+  }
+  // -------------------------------------------------------------------
+  // Pending / rejected
+  // -------------------------------------------------------------------
+  /** All pending ops in creation order (used to warm the in-memory queue). */
+  async loadPending() {
+    return this.pending.orderBy("idx").toArray();
+  }
+  async listRejected() {
+    return this.rejected.orderBy("idx").toArray();
+  }
+  async clearRejected() {
+    await this.rejected.clear();
+  }
+  /** Record a server ack for a pending op (echo not yet seen). */
+  async markAcked(opId, seq) {
+    await this.pending.where("op_id").equals(opId).modify({ acked_seq: seq });
+  }
+  // -------------------------------------------------------------------
+  // Writes
+  // -------------------------------------------------------------------
+  /**
+   * Enqueue a local op and apply it optimistically to the view.
+   * Returns the resulting view record (null when the op deletes it).
+   */
+  async addPending(op) {
+    return this.db.transaction("rw", this.allStores, async () => {
+      await this.pending.add({ op_id: op.op_id, op: cloneData(op) });
+      return this.recomputeViewRecord(op.table, op.record_id);
+    });
+  }
+  /**
+   * Commit a batch of incoming server ops (already filtered/deduped by the
+   * engine): update `_server`, drop confirmed pending ops, advance the
+   * cursor, and rebase every affected view record — in one transaction.
+   */
+  async commitIncoming(params) {
+    const { applyOps, confirmedOpIds, cursor } = params;
+    await this.db.transaction("rw", this.allStores, async () => {
+      const affected = /* @__PURE__ */ new Set();
+      for (const op of applyOps) affected.add(`${op.table}\0${op.record_id}`);
+      for (const op of applyOps) {
+        await this.applyToServer(op);
+      }
+      if (confirmedOpIds.length > 0) {
+        const confirmedRows = await this.pending.where("op_id").anyOf(confirmedOpIds).toArray();
+        for (const row of confirmedRows) affected.add(`${row.op.table}\0${row.op.record_id}`);
+        await this.pending.where("op_id").anyOf(confirmedOpIds).delete();
+      }
+      await this.meta.put({ key: META_CURSOR, value: cursor });
+      for (const key of affected) {
+        const [table, recordId] = key.split("\0");
+        await this.recomputeViewRecord(table, recordId);
+      }
+    });
+  }
+  /** Persist a cursor advance with no ops (empty `ops` message / pushed cursor). */
+  async setCursor(cursor) {
+    await this.meta.put({ key: META_CURSOR, value: cursor });
+  }
+  /**
+   * Terminal rejection: remove from pending, park in the rejected store,
+   * roll the view record back to server state + remaining pending ops.
+   */
+  async rejectPending(opId, error, message) {
+    return this.db.transaction("rw", this.allStores, async () => {
+      const row = await this.pending.where("op_id").equals(opId).first();
+      if (!row) return null;
+      await this.pending.where("op_id").equals(opId).delete();
+      const rejectedRow = {
+        op_id: opId,
+        op: row.op,
+        error,
+        message,
+        rejected_at: Date.now()
+      };
+      await this.rejected.add(rejectedRow);
+      await this.recomputeViewRecord(row.op.table, row.op.record_id);
+      return rejectedRow;
+    });
+  }
+  // -------------------------------------------------------------------
+  // Bootstrap
+  // -------------------------------------------------------------------
+  /**
+   * Replace all server state from a snapshot (cold start or
+   * SNAPSHOT_REQUIRED/RESET_REQUIRED recovery). Pending ops survive and are
+   * re-applied on top of the fresh state.
+   */
+  async replaceFromSnapshot(params) {
+    const { channel, records, cursor } = params;
+    await this.db.transaction("rw", this.allStores, async () => {
+      await this.server.clear();
+      for (const tableName of this.tableNames) {
+        await this.view(tableName).clear();
+      }
+      for (const [tableName, tableRecords] of Object.entries(records)) {
+        if (!this.hasTable(tableName)) continue;
+        const serverRows = [];
+        const viewRows = [];
+        for (const [recordId, data] of Object.entries(tableRecords)) {
+          serverRows.push({ table: tableName, record_id: recordId, data: data ?? {} });
+          viewRows.push({ id: recordId, ...data ?? {} });
+        }
+        await this.server.bulkPut(serverRows);
+        await this.view(tableName).bulkPut(viewRows);
+      }
+      const pendingRows = await this.pending.orderBy("idx").toArray();
+      const affected = /* @__PURE__ */ new Set();
+      for (const row of pendingRows) affected.add(`${row.op.table}\0${row.op.record_id}`);
+      for (const key of affected) {
+        const [table, recordId] = key.split("\0");
+        if (this.hasTable(table)) await this.recomputeViewRecord(table, recordId);
+      }
+      await this.meta.put({ key: META_CURSOR, value: cursor });
+      await this.meta.put({ key: META_CHANNEL, value: channel });
+    });
+  }
+  // -------------------------------------------------------------------
+  // Reads
+  // -------------------------------------------------------------------
+  async getViewRecord(table, id) {
+    const record = await this.view(table).get(id);
+    return record ?? null;
+  }
+  async getViewRecords(table) {
+    return this.view(table).toArray();
+  }
+  // -------------------------------------------------------------------
+  // Lifecycle
+  // -------------------------------------------------------------------
+  close() {
+    this.db.close();
+  }
+  /** Delete the underlying IndexedDB database (sign-out / revoked mount). */
+  async destroy() {
+    this.db.close();
+    await Dexie.delete(this.name);
+  }
+  // -------------------------------------------------------------------
+  // Internals
+  // -------------------------------------------------------------------
+  async applyToServer(op) {
+    if (!this.hasTable(op.table)) return;
+    const existing = await this.server.get([op.table, op.record_id]);
+    const next = applyOpToData(existing?.data, op);
+    if (next === void 0) {
+      await this.server.delete([op.table, op.record_id]);
+    } else {
+      await this.server.put({ table: op.table, record_id: op.record_id, data: next });
+    }
+  }
+  /**
+   * Rebase one record: view = server data + pending ops for that record in
+   * creation order. Must run inside a transaction covering all stores.
+   */
+  async recomputeViewRecord(table, recordId) {
+    if (!this.hasTable(table)) return null;
+    const serverRow = await this.server.get([table, recordId]);
+    let data = serverRow ? cloneData(serverRow.data) : void 0;
+    const pendingRows = await this.pending.orderBy("idx").toArray();
+    for (const row of pendingRows) {
+      if (row.op.table === table && row.op.record_id === recordId) {
+        data = applyOpToData(data, row.op);
+      }
+    }
+    if (data === void 0) {
+      await this.view(table).delete(recordId);
+      return null;
+    }
+    const viewRecord = { id: recordId, ...data };
+    await this.view(table).put(viewRecord);
+    return viewRecord;
+  }
+};
+
+// src/core/sync/SyncEngine.ts
+var OWN_SUB = "own";
+function shareSubKey(shareId) {
+  return `share:${shareId}`;
+}
+var BoundedSet = class {
+  constructor(cap = 2048) {
+    this.cap = cap;
+  }
+  set = /* @__PURE__ */ new Set();
+  order = [];
+  has(value) {
+    return this.set.has(value);
+  }
+  add(value) {
+    if (this.set.has(value)) return;
+    this.set.add(value);
+    this.order.push(value);
+    if (this.order.length > this.cap) {
+      const evicted = this.order.shift();
+      if (evicted !== void 0) this.set.delete(evicted);
+    }
+  }
+  clear() {
+    this.set.clear();
+    this.order = [];
+  }
+};
+var RETRY_FLUSH_DELAY_MS = 1200;
+var SyncEngine = class {
+  projectId;
+  schema;
+  opts;
+  connection;
+  subs = /* @__PURE__ */ new Map();
+  limits = { ...DEFAULT_LIMITS };
+  actor = null;
+  started = false;
+  revokedInfo = null;
+  connectionStatus = "idle";
+  _status = "idle";
+  listeners = /* @__PURE__ */ new Map();
+  timers = /* @__PURE__ */ new Set();
+  constructor(opts) {
+    this.opts = opts;
+    this.projectId = opts.projectId;
+    this.schema = opts.schema;
+    this.connection = new SyncConnection({
+      wsUrl: opts.wsUrl,
+      getToken: opts.getToken,
+      WebSocketImpl: opts.WebSocketImpl,
+      heartbeatMs: opts.heartbeatMs,
+      onWelcome: (msg) => this.handleWelcome(msg),
+      onMessage: (msg) => this.handleMessage(msg),
+      onStatus: (status) => this.handleConnectionStatus(status),
+      log: opts.log
+    });
+  }
+  // -------------------------------------------------------------------
+  // Events
+  // -------------------------------------------------------------------
+  on(event, fn) {
+    if (!this.listeners.has(event)) this.listeners.set(event, /* @__PURE__ */ new Set());
+    const set = this.listeners.get(event);
+    set.add(fn);
+    return () => set.delete(fn);
+  }
+  emit(event, data) {
+    const set = this.listeners.get(event);
+    if (!set) return;
+    for (const fn of set) {
+      try {
+        fn(data);
+      } catch (err) {
+        this.log("listener error:", err);
+      }
+    }
+  }
+  // -------------------------------------------------------------------
+  // Public state
+  // -------------------------------------------------------------------
+  get status() {
+    return this._status;
+  }
+  get syncLimits() {
+    return { ...this.limits };
+  }
+  get serverActor() {
+    return this.actor;
+  }
+  getSubscription(key) {
+    return this.subs.get(key);
+  }
+  get own() {
+    return this.subs.get(OWN_SUB);
+  }
+  get pendingCount() {
+    let n = 0;
+    for (const sub of this.subs.values()) n += sub.pending.length;
+    return n;
+  }
+  async listRejected(subKey = OWN_SUB) {
+    const sub = this.subs.get(subKey);
+    if (!sub) return [];
+    return sub.store.listRejected();
+  }
+  async clearRejected(subKey = OWN_SUB) {
+    await this.subs.get(subKey)?.store.clearRejected();
+  }
+  // -------------------------------------------------------------------
+  // Lifecycle
+  // -------------------------------------------------------------------
+  /** Open the own-channel keyspace and connect. Idempotent. */
+  async start() {
+    if (this.started) {
+      if (this.connectionStatus === "auth_failed" || this._status === "auth_required") {
+        this.connection.start();
+      }
+      return;
+    }
+    this.started = true;
+    this.revokedInfo = null;
+    if (!this.subs.has(OWN_SUB)) {
+      const sub = await this.openSub(OWN_SUB, null);
+      this.subs.set(OWN_SUB, sub);
+    }
+    this.connection.start();
+    this.recomputeStatus();
+  }
+  /** Close the socket and stores; local data is kept. */
+  stop() {
+    this.started = false;
+    this.connection.stop();
+    for (const t of this.timers) clearTimeout(t);
+    this.timers.clear();
+    for (const sub of this.subs.values()) {
+      sub.active = false;
+      sub.store.close();
+    }
+    this.subs.clear();
+    this.recomputeStatus();
+  }
+  /**
+   * Stop and delete every local database for this project (sign-out).
+   * Best-effort discovery of mount keyspaces from previous sessions.
+   */
+  async destroyLocal() {
+    const open = [...this.subs.values()];
+    this.stop();
+    for (const sub of open) {
+      try {
+        await sub.store.destroy();
+      } catch (err) {
+        this.log("failed deleting local db:", err);
+      }
+    }
+    try {
+      const idb = globalThis.indexedDB;
+      if (idb && typeof idb.databases === "function") {
+        const prefix = `${this.dbPrefix}:${this.projectId}`;
+        const dbs = await idb.databases();
+        for (const info of dbs) {
+          if (info.name && info.name.startsWith(prefix)) {
+            await new Promise((resolve) => {
+              const req = idb.deleteDatabase(info.name);
+              req.onsuccess = req.onerror = req.onblocked = () => resolve();
+            });
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  // -------------------------------------------------------------------
+  // Shares (mounts)
+  // -------------------------------------------------------------------
+  /**
+   * Mount a share: separate keyspace `(project, share)` with its own cursor
+   * and pending queue. Bootstraps + subscribes when the socket is online.
+   */
+  async mountShare(shareId) {
+    const key = shareSubKey(shareId);
+    const existing = this.subs.get(key);
+    if (existing) return existing;
+    const sub = await this.openSub(key, shareId);
+    this.subs.set(key, sub);
+    if (this.connection.isOnline) {
+      this.enqueue(sub, () => this.activateSub(sub));
+    }
+    return sub;
+  }
+  /** Unsubscribe a mount. Local cache is kept unless `purge` is set. */
+  async unmountShare(shareId, options) {
+    const key = shareSubKey(shareId);
+    const sub = this.subs.get(key);
+    if (!sub) return;
+    if (sub.active) {
+      this.connection.send({ type: "unsubscribe", sub: key });
+    }
+    this.subs.delete(key);
+    if (options?.purge) {
+      await sub.store.destroy();
+    } else {
+      sub.store.close();
+    }
+  }
+  // -------------------------------------------------------------------
+  // Writes (responsibility 2 + 6: pending queue + optimistic rebase)
+  // -------------------------------------------------------------------
+  /**
+   * Queue a local op, apply it optimistically, and push when online.
+   * Returns the resulting view record (null when deleted).
+   * Throws on local validation failure (fail fast — the server would
+   * terminally reject it anyway).
+   */
+  async apply(subKey, partial) {
+    const sub = this.subs.get(subKey);
+    if (!sub) throw new Error(`unknown subscription '${subKey}' \u2014 is the engine started?`);
+    if (!sub.store.hasTable(partial.table)) {
+      throw new Error(`table "${partial.table}" not found in schema`);
+    }
+    if (this.opts.validateWrites !== false && partial.type !== "delete") {
+      const result = validateData(
+        this.schema,
+        partial.table,
+        partial.data ?? {},
+        partial.type === "put"
+      );
+      if (!result.valid) {
+        throw new Error(result.message || "data validation failed");
+      }
+    }
+    const op = {
+      op_id: mintOpId(),
+      type: partial.type,
+      table: partial.table,
+      record_id: partial.record_id,
+      ...partial.type !== "delete" ? { data: partial.data ?? {} } : {},
+      base_seq: Math.max(sub.cursor, 0)
+    };
+    const bytes = JSON.stringify(op).length;
+    if (bytes > this.limits.max_op_bytes) {
+      throw new Error(
+        `op exceeds max_op_bytes (${bytes} > ${this.limits.max_op_bytes}) \u2014 PAYLOAD_TOO_LARGE`
+      );
+    }
+    let view = null;
+    await this.enqueue(sub, async () => {
+      view = await sub.store.addPending(op);
+      sub.pending.push({ op, sent: false });
+    });
+    this.emit("change", { sub: sub.key, tables: [op.table] });
+    this.flush(sub);
+    return view;
+  }
+  // -------------------------------------------------------------------
+  // Connection handling
+  // -------------------------------------------------------------------
+  handleConnectionStatus(status) {
+    this.connectionStatus = status;
+    if (status === "offline" || status === "connecting" || status === "auth_failed") {
+      for (const sub of this.subs.values()) {
+        sub.active = false;
+        for (const p of sub.pending) {
+          p.sent = false;
+          p.ackedSeq = void 0;
+        }
+      }
+    }
+    this.recomputeStatus();
+  }
+  handleWelcome(msg) {
+    this.actor = msg.actor;
+    if (msg.limits) this.limits = { ...this.limits, ...msg.limits };
+    for (const sub of this.subs.values()) {
+      if (sub.status === "revoked") continue;
+      this.enqueue(sub, () => this.activateSub(sub));
+    }
+  }
+  handleMessage(msg) {
+    switch (msg.type) {
+      case "subscribed":
+        this.handleSubscribed(msg);
+        return;
+      case "ops": {
+        const sub = this.subs.get(msg.sub);
+        if (sub) this.enqueue(sub, () => this.processOps(sub, msg));
+        return;
+      }
+      case "pushed": {
+        const sub = this.subs.get(msg.sub);
+        if (sub) this.enqueue(sub, () => this.processPushed(sub, msg));
+        return;
+      }
+      case "error":
+        this.handleError(msg);
+        return;
+      case "pong":
+      case "token_ok":
+      case "unsubscribed":
+      case "welcome":
+        return;
+      default:
+        return;
+    }
+  }
+  handleSubscribed(msg) {
+    const sub = this.subs.get(msg.sub);
+    if (!sub) return;
+    sub.active = true;
+    sub.status = "live";
+    sub.schemaVersion = msg.schema_version;
+    this.log(`subscribed '${sub.key}' channel=${msg.channel} cursor=${msg.cursor} head=${msg.head}`);
+    this.flush(sub);
+  }
+  handleError(msg) {
+    const subKey = msg.sub;
+    this.log(`server error${subKey ? ` (sub ${subKey})` : ""}: ${msg.code} \u2014 ${msg.message ?? ""}`);
+    if (subKey) {
+      const sub = this.subs.get(subKey);
+      if (!sub) return;
+      this.emit("suberror", { sub: subKey, code: msg.code, message: msg.message });
+      if (isRebootstrapError(msg.code)) {
+        sub.active = false;
+        sub.bootstrapped = false;
+        for (const p of sub.pending) {
+          p.sent = false;
+          p.ackedSeq = void 0;
+        }
+        this.enqueue(sub, async () => {
+          await this.activateSub(sub);
+        });
+        return;
+      }
+      if (msg.code === "SHARE_REVOKED" || msg.code === "CONNECTION_REVOKED") {
+        sub.active = false;
+        sub.status = "revoked";
+        sub.revokedCode = msg.code;
+        this.subs.delete(subKey);
+        void sub.store.destroy().catch(() => {
+        });
+        return;
+      }
+      return;
+    }
+    switch (msg.code) {
+      case "CONNECTION_REVOKED":
+        this.revokedInfo = { code: msg.code, message: msg.message };
+        this.started = false;
+        this.connection.stop();
+        this.recomputeStatus();
+        this.emit("revoked", { code: msg.code, message: msg.message });
+        return;
+      case "UNSUPPORTED_VERSION":
+        this.started = false;
+        this.connection.stop();
+        this.recomputeStatus();
+        return;
+      case "TOO_MANY_OPS":
+      case "RATE_LIMITED": {
+        for (const sub of this.subs.values()) {
+          for (const p of sub.pending) {
+            if (p.ackedSeq === void 0) p.sent = false;
+          }
+        }
+        this.timer(() => {
+          for (const sub of this.subs.values()) this.flush(sub);
+        }, RETRY_FLUSH_DELAY_MS);
+        return;
+      }
+      case "UNAUTHORIZED":
+      case "TOKEN_EXPIRED":
+        return;
+      case "SNAPSHOT_REQUIRED":
+      case "RESET_REQUIRED":
+        for (const sub of this.subs.values()) {
+          sub.active = false;
+          sub.bootstrapped = false;
+          this.enqueue(sub, () => this.activateSub(sub));
+        }
+        return;
+      default:
+        return;
+    }
+  }
+  // -------------------------------------------------------------------
+  // Subscription state machine (serialized per sub via `chain`)
+  // -------------------------------------------------------------------
+  async openSub(key, shareId) {
+    const name = shareId ? `${this.dbPrefix}:${this.projectId}:share:${shareId}` : `${this.dbPrefix}:${this.projectId}`;
+    const store = new SyncStore(name, this.schema);
+    const [cursor, pendingRows] = await Promise.all([store.getCursor(), store.loadPending()]);
+    return {
+      key,
+      shareId,
+      store,
+      cursor: cursor ?? -1,
+      // -1 = never bootstrapped
+      pending: pendingRows.map((row) => ({ op: row.op, sent: false })),
+      active: false,
+      bootstrapped: cursor !== null,
+      status: "initializing",
+      appliedOpIds: new BoundedSet(),
+      chain: Promise.resolve(),
+      schemaVersion: null
+    };
+  }
+  /** Bootstrap if needed, then bind the stream on the current socket. */
+  async activateSub(sub) {
+    if (!this.connection.isOnline) return;
+    if (!sub.bootstrapped || sub.cursor < 0) {
+      try {
+        await this.bootstrapSub(sub);
+      } catch (err) {
+        this.log(`bootstrap failed for '${sub.key}':`, err);
+        sub.status = "error";
+        return;
+      }
+    }
+    this.connection.send({
+      type: "subscribe",
+      sub: sub.key,
+      cursor: sub.cursor,
+      ...sub.shareId ? { share: sub.shareId } : this.opts.appName ? { app: this.opts.appName } : {}
+    });
+  }
+  /** Cold start = snapshot + tail; never log replay (§5). Pending survives. */
+  async bootstrapSub(sub) {
+    const snapshot = await this.opts.fetchSnapshot(
+      sub.shareId ? { share: sub.shareId } : void 0
+    );
+    await sub.store.replaceFromSnapshot({
+      channel: snapshot.channel,
+      records: snapshot.records ?? {},
+      cursor: snapshot.cursor ?? 0
+    });
+    sub.cursor = snapshot.cursor ?? 0;
+    sub.bootstrapped = true;
+    sub.appliedOpIds.clear();
+    this.log(`bootstrapped '${sub.key}' cursor=${sub.cursor}`);
+    this.emit("change", { sub: sub.key, tables: sub.store.tables });
+  }
+  /**
+   * Responsibilities 3+4+5: ordered apply, cursor advance, dedupe/confirm.
+   * Runs inside the sub's serial chain.
+   */
+  async processOps(sub, msg) {
+    const applyOps = [];
+    const confirmedOpIds = [];
+    for (const op of msg.ops) {
+      if (typeof op.seq !== "number" || op.seq <= sub.cursor) continue;
+      sub.cursor = op.seq;
+      if (sub.appliedOpIds.has(op.op_id)) continue;
+      const idx = sub.pending.findIndex((p) => p.op.op_id === op.op_id);
+      if (idx >= 0) {
+        sub.pending.splice(idx, 1);
+        confirmedOpIds.push(op.op_id);
+      }
+      if (!sub.store.hasTable(op.table)) {
+        sub.appliedOpIds.add(op.op_id);
+        continue;
+      }
+      applyOps.push(op);
+      sub.appliedOpIds.add(op.op_id);
+    }
+    if (typeof msg.cursor === "number" && msg.cursor > sub.cursor) {
+      sub.cursor = msg.cursor;
+    }
+    if (applyOps.length > 0 || confirmedOpIds.length > 0) {
+      await sub.store.commitIncoming({ applyOps, confirmedOpIds, cursor: sub.cursor });
+      const tables = [...new Set(applyOps.map((op) => op.table))];
+      this.emit("change", { sub: sub.key, tables });
+    } else {
+      await sub.store.setCursor(sub.cursor);
+    }
+  }
+  /**
+   * Push verdicts (§6.5, §8, §9). Success acks are recorded but the op stays
+   * pending until its echo arrives in seq order — this preserves strict
+   * ordered apply even when `pushed` races ahead of intermediate remote ops.
+   * Terminal errors apply the poison-op rule; retryables back off.
+   */
+  async processPushed(sub, msg) {
+    let needsRetry = false;
+    const changedTables = /* @__PURE__ */ new Set();
+    for (const result of msg.results) {
+      const idx = sub.pending.findIndex((p) => p.op.op_id === result.op_id);
+      if ("seq" in result && typeof result.seq === "number") {
+        if (idx >= 0) {
+          if (result.seq <= sub.cursor) {
+            const [entry] = sub.pending.splice(idx, 1);
+            await sub.store.commitIncoming({
+              applyOps: [],
+              confirmedOpIds: [entry.op.op_id],
+              cursor: sub.cursor
+            });
+            changedTables.add(entry.op.table);
+          } else {
+            sub.pending[idx].ackedSeq = result.seq;
+            await sub.store.markAcked(result.op_id, result.seq);
+          }
+        }
+        continue;
+      }
+      if ("error" in result) {
+        if (isTerminalOpError(result.error, result.terminal)) {
+          if (idx >= 0) sub.pending.splice(idx, 1);
+          const rejection = await sub.store.rejectPending(
+            result.op_id,
+            result.error,
+            result.message
+          );
+          if (rejection) {
+            changedTables.add(rejection.op.table);
+            this.emit("rejected", { sub: sub.key, rejection });
+            this.log(
+              `op rejected (${result.error}): ${rejection.op.type} ${rejection.op.table}/${rejection.op.record_id}`
+            );
+          }
+        } else if (idx >= 0) {
+          sub.pending[idx].sent = false;
+          needsRetry = true;
+        }
+      }
+    }
+    if (changedTables.size > 0) {
+      this.emit("change", { sub: sub.key, tables: [...changedTables] });
+    }
+    if (needsRetry) {
+      this.timer(() => this.flush(sub), RETRY_FLUSH_DELAY_MS);
+    }
+  }
+  /** Push unsent pending ops, chunked to `limits.max_ops_per_push`. */
+  flush(sub) {
+    if (!this.connection.isOnline || !sub.active) return;
+    const unsent = sub.pending.filter((p) => !p.sent && p.ackedSeq === void 0);
+    if (unsent.length === 0) return;
+    const chunkSize = Math.max(1, this.limits.max_ops_per_push);
+    for (let i = 0; i < unsent.length; i += chunkSize) {
+      const chunk = unsent.slice(i, i + chunkSize);
+      for (const p of chunk) p.sent = true;
+      const ok = this.connection.send({
+        type: "push",
+        sub: sub.key,
+        ops: chunk.map((p) => p.op)
+      });
+      if (!ok) {
+        for (const p of chunk) p.sent = false;
+        return;
+      }
+    }
+    this.log(`pushed ${unsent.length} op(s) on '${sub.key}'`);
+  }
+  // -------------------------------------------------------------------
+  // Internals
+  // -------------------------------------------------------------------
+  get dbPrefix() {
+    return this.opts.dbNamePrefix ?? "basic-sync";
+  }
+  enqueue(sub, task) {
+    sub.chain = sub.chain.then(task).catch((err) => {
+      this.log(`task failed on '${sub.key}':`, err);
+    });
+    return sub.chain;
+  }
+  timer(fn, ms) {
+    const t = setTimeout(() => {
+      this.timers.delete(t);
+      fn();
+    }, ms);
+    this.timers.add(t);
+  }
+  recomputeStatus() {
+    let status;
+    if (this.revokedInfo) status = "revoked";
+    else if (this.connectionStatus === "auth_failed") status = "auth_required";
+    else if (!this.started) status = this.connectionStatus === "stopped" ? "stopped" : "idle";
+    else if (this.connectionStatus === "online") status = "online";
+    else if (this.connectionStatus === "connecting") status = "connecting";
+    else if (this.connectionStatus === "idle") status = "connecting";
+    else status = "offline";
+    if (status !== this._status) {
+      this._status = status;
+      this.emit("status", status);
+    }
+  }
+  log(...args) {
+    this.opts.log?.("[sync-engine]", ...args);
+  }
+};
+
+// src/core/db.ts
+function mintRecordId() {
+  return mintOpId();
+}
+var SyncTable = class {
+  constructor(engine, subKey, name) {
+    this.engine = engine;
+    this.subKey = subKey;
+    this.name = name;
+  }
+  get store() {
+    const sub = this.engine.getSubscription(this.subKey);
+    if (!sub) {
+      throw new Error(
+        `subscription '${this.subKey}' is not open \u2014 sign in and wait for the db to be ready`
+      );
+    }
+    return sub.store;
+  }
+  get ref() {
+    return this.store.view(this.name);
+  }
+  async create(data) {
+    const id = mintRecordId();
+    const view = await this.engine.apply(this.subKey, {
+      type: "put",
+      table: this.name,
+      record_id: id,
+      data
+    });
+    return view ?? { id, ...data };
+  }
+  async put(id, data) {
+    if (!id) throw new Error("put() requires an id");
+    const view = await this.engine.apply(this.subKey, {
+      type: "put",
+      table: this.name,
+      record_id: id,
+      data
+    });
+    return view ?? { id, ...data };
+  }
+  async patch(id, data) {
+    if (!id) throw new Error("patch() requires an id");
+    const existing = await this.store.getViewRecord(this.name, id);
+    if (!existing) return null;
+    const view = await this.engine.apply(this.subKey, {
+      type: "patch",
+      table: this.name,
+      record_id: id,
+      data
+    });
+    return view;
+  }
+  async delete(id) {
+    if (!id) throw new Error("delete() requires an id");
+    await this.engine.apply(this.subKey, {
+      type: "delete",
+      table: this.name,
+      record_id: id
+    });
+  }
+  async get(id) {
+    return await this.store.getViewRecord(this.name, id);
+  }
+  async getAll() {
+    return await this.store.getViewRecords(this.name);
+  }
+  async find(predicate) {
+    const all = await this.getAll();
+    return all.filter(predicate);
+  }
+};
+var SyncDb = class {
+  constructor(engine, subKey = OWN_SUB) {
+    this.engine = engine;
+    this.subKey = subKey;
+  }
+  kind = "sync";
+  tables = /* @__PURE__ */ new Map();
+  table(name) {
+    if (!this.engine.schema.tables[name]) {
+      throw new Error(`table "${name}" not found in schema`);
+    }
+    if (!this.tables.has(name)) {
+      this.tables.set(name, new SyncTable(this.engine, this.subKey, name));
+    }
+    return this.tables.get(name);
+  }
+};
+var RestTable = class {
+  constructor(rest, name) {
+    this.rest = rest;
+    this.name = name;
+  }
+  async create(data) {
+    const record = await this.rest.createRecord(this.name, data);
+    return record;
+  }
+  async put(id, data) {
+    if (!id) throw new Error("put() requires an id");
+    const record = await this.rest.putRecord(this.name, id, data);
+    if (!record) throw new Error(`record ${this.name}/${id} not found (REST put is replace-only)`);
+    return record;
+  }
+  async patch(id, data) {
+    if (!id) throw new Error("patch() requires an id");
+    const record = await this.rest.patchRecord(this.name, id, data);
+    return record;
+  }
+  async delete(id) {
+    if (!id) throw new Error("delete() requires an id");
+    await this.rest.deleteRecord(this.name, id);
+  }
+  async get(id) {
+    const record = await this.rest.getRecord(this.name, id);
+    return record;
+  }
+  async getAll() {
+    return await this.rest.list(this.name);
+  }
+  async find(predicate) {
+    const all = await this.getAll();
+    return all.filter(predicate);
+  }
+};
+var RestDb = class {
+  constructor(rest, schema) {
+    this.rest = rest;
+    this.schema = schema;
+  }
+  kind = "rest";
+  tables = /* @__PURE__ */ new Map();
+  table(name) {
+    if (this.schema?.tables && !this.schema.tables[name]) {
+      throw new Error(`table "${name}" not found in schema`);
+    }
+    if (!this.tables.has(name)) {
+      this.tables.set(name, new RestTable(this.rest, name));
+    }
+    return this.tables.get(name);
+  }
+};
+
+// src/utils/schema.ts
+init_config();
+import { validateSchema, compareSchemas } from "@basictech/schema";
+async function getSchemaStatus(schema) {
+  const projectId = schema.project_id;
   const valid = validateSchema(schema);
   if (!valid.valid) {
     console.warn("BasicDB Error: your local schema is invalid. Please fix errors and try again - sync is disabled");
@@ -2541,434 +3587,573 @@ async function getSchemaStatus(schema) {
         latest: latestSchema
       };
     }
-  } else {
-    return {
-      valid: false,
-      status: "error",
-      latest: null
+  } else {
+    return {
+      valid: false,
+      status: "error",
+      latest: null
+    };
+  }
+}
+async function validateAndCheckSchema(schema) {
+  const valid = validateSchema(schema);
+  if (!valid.valid) {
+    log("Basic Schema is invalid!", valid.errors);
+    console.group("Schema Errors");
+    let errorMessage = "";
+    valid.errors.forEach((error, index) => {
+      log(`${index + 1}:`, error.message, ` - at ${error.instancePath}`);
+      errorMessage += `${index + 1}: ${error.message} - at ${error.instancePath}
+`;
+    });
+    console.groupEnd();
+    return {
+      isValid: false,
+      schemaStatus: { valid: false },
+      errors: valid.errors
+    };
+  }
+  let schemaStatus = { valid: false };
+  if (schema.version !== 0) {
+    schemaStatus = await getSchemaStatus(schema);
+    log("schemaStatus", schemaStatus);
+  } else {
+    schemaStatus = { valid: false, status: "unpublished" };
+    log("schema not published - at version 0");
+  }
+  return {
+    isValid: true,
+    schemaStatus
+  };
+}
+
+// src/updater/versionUpdater.ts
+init_config();
+var VersionUpdater = class {
+  storage;
+  currentVersion;
+  migrations;
+  versionKey = "basic_app_version";
+  constructor(storage, currentVersion, migrations = []) {
+    this.storage = storage;
+    this.currentVersion = currentVersion;
+    this.migrations = migrations.sort((a, b) => this.compareVersions(a.fromVersion, b.fromVersion));
+  }
+  /**
+   * Check current stored version and run migrations if needed
+   * Only compares major.minor versions, ignoring beta/prerelease parts
+   * Example: "0.7.0-beta.1" and "0.7.0" are treated as the same version
+   */
+  async checkAndUpdate() {
+    const storedVersion = await this.getStoredVersion();
+    if (!storedVersion) {
+      await this.setStoredVersion(this.currentVersion);
+      return { updated: false, toVersion: this.currentVersion };
+    }
+    if (storedVersion === this.currentVersion) {
+      return { updated: false, toVersion: this.currentVersion };
+    }
+    const migrationsToRun = this.getMigrationsToRun(storedVersion, this.currentVersion);
+    if (migrationsToRun.length === 0) {
+      await this.setStoredVersion(this.currentVersion);
+      return { updated: true, fromVersion: storedVersion, toVersion: this.currentVersion };
+    }
+    for (const migration of migrationsToRun) {
+      try {
+        log(`Running migration from ${migration.fromVersion} to ${migration.toVersion}`);
+        await migration.migrate(this.storage);
+      } catch (error) {
+        console.error(`Migration failed from ${migration.fromVersion} to ${migration.toVersion}:`, error);
+        throw new Error(`Migration failed: ${error}`);
+      }
+    }
+    await this.setStoredVersion(this.currentVersion);
+    return { updated: true, fromVersion: storedVersion, toVersion: this.currentVersion };
+  }
+  async getStoredVersion() {
+    try {
+      const versionData = await this.storage.get(this.versionKey);
+      if (!versionData) return null;
+      const versionInfo = JSON.parse(versionData);
+      return versionInfo.version;
+    } catch (error) {
+      console.warn("Failed to get stored version:", error);
+      return null;
+    }
+  }
+  async setStoredVersion(version2) {
+    const versionInfo = {
+      version: version2,
+      lastUpdated: Date.now()
     };
+    await this.storage.set(this.versionKey, JSON.stringify(versionInfo));
   }
-}
-async function validateAndCheckSchema(schema) {
-  const valid = validateSchema(schema);
-  if (!valid.valid) {
-    log("Basic Schema is invalid!", valid.errors);
-    console.group("Schema Errors");
-    let errorMessage = "";
-    valid.errors.forEach((error, index) => {
-      log(`${index + 1}:`, error.message, ` - at ${error.instancePath}`);
-      errorMessage += `${index + 1}: ${error.message} - at ${error.instancePath}
-`;
+  getMigrationsToRun(fromVersion, toVersion) {
+    return this.migrations.filter((migration) => {
+      const storedLessThanMigrationTo = this.compareVersions(fromVersion, migration.toVersion) < 0;
+      const currentGreaterThanOrEqualMigrationTo = this.compareVersions(toVersion, migration.toVersion) >= 0;
+      const shouldRun = storedLessThanMigrationTo && currentGreaterThanOrEqualMigrationTo;
+      log(`Migration ${migration.fromVersion} \u2192 ${migration.toVersion}: shouldRun=${shouldRun}`);
+      return shouldRun;
     });
-    console.groupEnd();
+  }
+  /**
+   * Simple semantic version comparison (major.minor only, ignoring beta/prerelease)
+   * Returns: -1 if a < b, 0 if a === b, 1 if a > b
+   */
+  compareVersions(a, b) {
+    const aMajorMinor = this.extractMajorMinor(a);
+    const bMajorMinor = this.extractMajorMinor(b);
+    if (aMajorMinor.major !== bMajorMinor.major) {
+      return aMajorMinor.major - bMajorMinor.major;
+    }
+    return aMajorMinor.minor - bMajorMinor.minor;
+  }
+  /**
+   * Extract major.minor from version string, ignoring beta/prerelease
+   * Examples: "0.7.0-beta.1" -> {major: 0, minor: 7}
+   *           "1.2.3" -> {major: 1, minor: 2}
+   */
+  extractMajorMinor(version2) {
+    const cleanVersion = version2.split("-")[0]?.split("+")[0] || version2;
+    const parts = cleanVersion.split(".").map(Number);
     return {
-      isValid: false,
-      schemaStatus: { valid: false },
-      errors: valid.errors
+      major: parts[0] || 0,
+      minor: parts[1] || 0
     };
   }
-  let schemaStatus = { valid: false };
-  if (schema.version !== 0) {
-    schemaStatus = await getSchemaStatus(schema);
-    log("schemaStatus", schemaStatus);
-  } else {
-    schemaStatus = { valid: false, status: "unpublished" };
-    log("schema not published - at version 0");
+  /**
+   * Add a migration to the updater
+   */
+  addMigration(migration) {
+    this.migrations.push(migration);
+    this.migrations.sort((a, b) => this.compareVersions(a.fromVersion, b.fromVersion));
   }
-  return {
-    isValid: true,
-    schemaStatus
-  };
+};
+function createVersionUpdater(storage, currentVersion, migrations = []) {
+  return new VersionUpdater(storage, currentVersion, migrations);
 }
 
-// src/AuthContext.tsx
-init_context();
-init_context();
-import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
-var BasicDevToolbar2 = lazy(
-  () => Promise.resolve().then(() => (init_BasicDevToolbar(), BasicDevToolbar_exports)).then((m) => ({ default: m.BasicDevToolbar }))
-);
-var DEFAULT_AUTH_CONFIG = {
+// src/updater/updateMigrations.ts
+init_config();
+var addMigrationTimestamp = {
+  fromVersion: "0.6.0",
+  toVersion: "0.7.0",
+  async migrate(storage) {
+    log("Running migration 0.6.0 \u2192 0.7.0");
+    storage.set("test_migration", "true");
+  }
+};
+var dropLegacySyncDb = {
+  fromVersion: "0.8.0",
+  toVersion: "0.9.0",
+  async migrate() {
+    log("Running migration 0.8.0 \u2192 0.9.0: deleting legacy basicdb");
+    try {
+      const idb = globalThis.indexedDB;
+      if (!idb) return;
+      await new Promise((resolve) => {
+        const req = idb.deleteDatabase("basicdb");
+        req.onsuccess = req.onerror = req.onblocked = () => resolve();
+      });
+    } catch {
+    }
+  }
+};
+function getMigrations() {
+  return [
+    addMigrationTimestamp,
+    dropLegacySyncDb
+  ];
+}
+
+// src/core/BasicClient.ts
+init_config();
+init_package();
+var DEFAULTS = {
   scopes: "profile,email,app:admin",
   pds_url: "https://pds.basic.id",
-  admin_url: "https://api.basic.tech",
-  ws_url: "wss://pds.basic.id/ws"
+  admin_url: "https://api.basic.tech"
 };
-function snapshotAuth(mgr) {
-  return {
-    isSignedIn: mgr.isSignedIn,
-    hasToken: !!mgr.token,
-    isAuthReady: mgr.isAuthReady,
-    user: mgr.user,
-    did: mgr.did,
-    tokenScope: mgr.tokenScope
-  };
+function deriveSyncUrl(pdsUrl) {
+  return pdsUrl.replace(/^http/, "ws").replace(/\/$/, "") + "/sync/";
 }
-function BasicProvider({
-  children,
-  project_id: project_id_prop,
-  schema,
-  debug = false,
-  storage,
-  auth,
-  dbMode = "sync",
-  devToolbar = false
-}) {
-  const project_id = schema?.project_id || project_id_prop;
-  if (auth?.server_url && !auth?.pds_url) {
-    log("Warning: auth.server_url is deprecated, use auth.pds_url instead");
-  }
-  const authConfig = {
-    scopes: auth?.scopes || DEFAULT_AUTH_CONFIG.scopes,
-    pds_url: auth?.pds_url || auth?.server_url || DEFAULT_AUTH_CONFIG.pds_url,
-    admin_url: auth?.admin_url || DEFAULT_AUTH_CONFIG.admin_url,
-    ws_url: auth?.ws_url || DEFAULT_AUTH_CONFIG.ws_url
-  };
-  const scopesString = Array.isArray(authConfig.scopes) ? authConfig.scopes.join(" ") : authConfig.scopes;
-  const storageRef = useRef(storage || new LocalStorageAdapter());
-  const storageAdapter = storageRef.current;
-  const schemaRef = useRef(schema);
-  schemaRef.current = schema;
-  const [authState, setAuthState] = useState2({
-    isSignedIn: false,
-    hasToken: false,
-    isAuthReady: false,
-    user: null,
-    did: null,
-    tokenScope: null
-  });
-  const authRef = useRef(null);
-  if (!authRef.current) {
-    authRef.current = new AuthManager(
+var BasicClient = class {
+  auth;
+  rest;
+  engine;
+  mode;
+  config;
+  projectId;
+  syncDb;
+  restDb;
+  debug;
+  devInfo = null;
+  syncEnabled = false;
+  schemaChecked = false;
+  started = false;
+  cleanupFns = [];
+  mounts = /* @__PURE__ */ new Map();
+  listeners = /* @__PURE__ */ new Set();
+  snapshot;
+  constructor(config) {
+    this.config = config;
+    this.debug = config.debug ?? false;
+    this.mode = config.mode ?? "sync";
+    this.projectId = config.schema?.project_id || config.project_id;
+    const authConfig = {
+      scopes: Array.isArray(config.auth?.scopes) ? config.auth.scopes.join(" ") : config.auth?.scopes || DEFAULTS.scopes,
+      pds_url: config.auth?.pds_url || DEFAULTS.pds_url,
+      admin_url: config.auth?.admin_url || DEFAULTS.admin_url
+    };
+    const syncUrl = config.auth?.sync_url || deriveSyncUrl(authConfig.pds_url);
+    const storage = config.storage || new LocalStorageAdapter();
+    this.auth = new AuthManager(
       {
-        projectId: project_id,
-        scopes: scopesString,
+        projectId: this.projectId,
+        scopes: authConfig.scopes,
         pdsUrl: authConfig.pds_url,
         adminUrl: authConfig.admin_url,
-        debug
+        debug: this.debug
       },
-      storageAdapter,
-      () => setAuthState(snapshotAuth(authRef.current))
+      storage,
+      () => this.handleAuthChange()
     );
-  }
-  const syncRef = useRef(null);
-  const remoteDbRef = useRef(null);
-  const [shouldConnect, setShouldConnect] = useState2(false);
-  const [dbStatus, setDbStatus] = useState2("OFFLINE" /* OFFLINE */);
-  const [isReady, setIsReady] = useState2(false);
-  const [error, setError] = useState2(null);
-  const [schemaDevInfo, setSchemaDevInfo] = useState2(null);
-  const isDevMode = () => isDevelopment(debug);
-  const refreshSchemaStatus = useCallback2(async () => {
-    const s = schemaRef.current;
-    if (!s) {
-      setSchemaDevInfo(
-        project_id ? {
-          projectId: project_id,
-          localVersion: void 0,
-          status: "no_schema",
-          valid: false,
-          lastCheckedAt: Date.now()
-        } : null
-      );
-      return;
-    }
-    const result = await validateAndCheckSchema(s);
-    if (!result.isValid) {
-      const errText = result.errors?.map((e) => e.message || "").join("; ") || "invalid";
-      setSchemaDevInfo({
-        projectId: s.project_id ?? null,
-        localVersion: s.version,
-        status: "invalid",
-        valid: false,
-        lastCheckedAt: Date.now(),
-        error: errText
+    this.rest = new RestClient({
+      baseUrl: authConfig.pds_url,
+      projectId: this.projectId ?? "",
+      getToken: (opts) => this.auth.getToken(opts),
+      log: this.debug ? log : void 0
+    });
+    if (this.mode === "sync" && this.projectId && this.config.schema?.tables) {
+      this.engine = new SyncEngine({
+        projectId: this.projectId,
+        schema: this.config.schema,
+        wsUrl: syncUrl,
+        getToken: (opts) => this.auth.getToken(opts),
+        fetchSnapshot: (opts) => this.rest.getSnapshot(opts),
+        WebSocketImpl: config.WebSocketImpl,
+        log
       });
-      return;
+      this.syncDb = new SyncDb(this.engine, OWN_SUB);
+      this.wireEngineEvents(this.engine);
+    } else {
+      this.engine = null;
+      this.syncDb = null;
     }
-    setSchemaDevInfo({
-      projectId: s.project_id ?? null,
-      localVersion: s.version,
-      status: result.schemaStatus.status ?? "unknown",
-      valid: result.schemaStatus.valid,
-      lastCheckedAt: Date.now()
-    });
-  }, [project_id]);
-  useEffect(() => {
-    const runVersionUpdater = async () => {
+    this.restDb = new RestDb(this.rest, this.config.schema);
+    this.snapshot = this.buildSnapshot();
+  }
+  // -------------------------------------------------------------------
+  // Public surface
+  // -------------------------------------------------------------------
+  /** The database handle: offline-first in sync mode, direct API in rest mode. */
+  get db() {
+    if (this.mode === "sync" && this.syncDb) return this.syncDb;
+    return this.restDb;
+  }
+  /** Bootstrap: version migrations, schema check, auth initialization. */
+  async start() {
+    if (this.started) return;
+    this.started = true;
+    try {
+      const updater = createVersionUpdater(this.auth.storage, version, getMigrations());
+      const result = await updater.checkAndUpdate();
+      if (result.updated) log(`SDK storage migrated ${result.fromVersion} \u2192 ${result.toVersion}`);
+    } catch (err) {
+      log("version updater failed:", err);
+    }
+    void this.checkSchema().then(() => this.maybeStartSync());
+    await this.auth.initialize();
+    const teardownNetwork = this.auth.setupNetworkListeners();
+    this.cleanupFns.push(teardownNetwork);
+  }
+  /** Sign out: server-side revoke, local auth clear, sync teardown + purge. */
+  async signOut() {
+    await this.auth.signOut();
+    await this.teardownLocalData();
+  }
+  /** Stop connections and listeners; local data is kept. */
+  stop() {
+    this.started = false;
+    this.engine?.stop();
+    for (const fn of this.cleanupFns) {
       try {
-        const versionUpdater = createVersionUpdater(storageAdapter, version, getMigrations());
-        const updateResult = await versionUpdater.checkAndUpdate();
-        if (updateResult.updated) {
-          log(`App updated from ${updateResult.fromVersion} to ${updateResult.toVersion}`);
-        } else {
-          log(`App version ${updateResult.toVersion} is current`);
-        }
-      } catch (error2) {
-        log("Version update failed:", error2);
+        fn();
+      } catch {
       }
+    }
+    this.cleanupFns = [];
+  }
+  /** Re-run the remote schema status check (dev toolbar). */
+  async refreshSchemaStatus() {
+    this.schemaChecked = false;
+    await this.checkSchema();
+    this.maybeStartSync();
+  }
+  async listRejected() {
+    return this.engine?.listRejected() ?? [];
+  }
+  async clearRejected() {
+    await this.engine?.clearRejected();
+    this.publish();
+  }
+  // ---------------- shares ----------------
+  /** Shares granted by / received by this user for this app. */
+  async listShares() {
+    return this.rest.listShares();
+  }
+  /** Mount a share: separate local keyspace + subscription. */
+  async mountShare(shareId) {
+    if (!this.engine) throw new Error("shares require sync mode");
+    const existing = this.mounts.get(shareId);
+    if (existing) return existing;
+    await this.engine.mountShare(shareId);
+    const handle = {
+      shareId,
+      db: new SyncDb(this.engine, shareSubKey(shareId))
     };
-    runVersionUpdater();
-    authRef.current.initialize();
-    return authRef.current.setupNetworkListeners();
-  }, []);
-  useEffect(() => {
-    async function initSyncDb(options) {
-      if (!syncRef.current) {
-        log("Initializing Basic Sync DB");
-        await initDexieExtensions();
-        syncRef.current = new BasicSync("basicdb", { schema });
-        syncRef.current.syncable.on("statusChanged", (status) => {
-          const newStatus = getSyncStatus(status);
-          setDbStatus(newStatus);
-          if (newStatus === "ERROR_WILL_RETRY" /* ERROR_WILL_RETRY */) {
-            log("Sync entered ERROR_WILL_RETRY - proactively refreshing token");
-            authRef.current.getToken({ forceRefresh: true }).catch(() => {
-            });
-          }
-        });
-        if (options.shouldConnect) {
-          setShouldConnect(true);
-        } else {
-          log("Sync is disabled");
-        }
-        setIsReady(true);
-      }
+    this.mounts.set(shareId, handle);
+    this.publish();
+    return handle;
+  }
+  async unmountShare(shareId, options) {
+    if (!this.engine) return;
+    await this.engine.unmountShare(shareId, options);
+    this.mounts.delete(shareId);
+    this.publish();
+  }
+  getMountedShare(shareId) {
+    return this.mounts.get(shareId);
+  }
+  // ---------------- React subscription surface ----------------
+  subscribe = (listener) => {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  };
+  getSnapshot = () => {
+    return this.snapshot;
+  };
+  // -------------------------------------------------------------------
+  // Orchestration
+  // -------------------------------------------------------------------
+  handleAuthChange() {
+    const status = this.auth.authStatus;
+    if (status === "reauth_required") {
+      this.engine?.stop();
+    } else if (status === "signed_out") {
+      void this.teardownLocalData();
+    } else {
+      this.maybeStartSync();
     }
-    function initRemoteDb() {
-      if (!remoteDbRef.current) {
-        if (!project_id) {
-          setError({
-            code: "missing_project_id",
-            title: "Project ID Required",
-            message: "Remote mode requires a project_id. Provide it via schema.project_id or the project_id prop."
-          });
-          setIsReady(true);
-          return;
-        }
-        log("Initializing Basic Remote DB");
-        remoteDbRef.current = new RemoteDB({
-          serverUrl: authConfig.pds_url,
-          projectId: project_id,
-          getToken: (opts) => authRef.current.getToken(opts),
-          schema,
-          debug,
-          onAuthError: (error2) => {
-            log("RemoteDB auth error:", error2);
-            if (error2.errorType === "forbidden") {
-              log("403 Forbidden - user lacks required scope, not signing out");
-              return;
-            }
-            handleSignOut();
-          }
-        });
-        setDbStatus("ONLINE" /* ONLINE */);
-        setIsReady(true);
+    this.publish();
+  }
+  maybeStartSync() {
+    if (!this.engine || !this.started) return;
+    if (!this.syncEnabled) return;
+    if (this.auth.isSignedIn && this.auth.token && this.auth.authStatus !== "reauth_required") {
+      void this.engine.start().catch((err) => log("sync start failed:", err));
+    }
+  }
+  async teardownLocalData() {
+    this.mounts.clear();
+    if (this.engine) {
+      try {
+        await this.engine.destroyLocal();
+      } catch (err) {
+        log("local data teardown failed:", err);
       }
     }
-    async function checkSchema() {
+    this.publish();
+  }
+  wireEngineEvents(engine) {
+    engine.on("status", () => this.publish());
+    engine.on("change", () => this.publish());
+    engine.on("rejected", ({ rejection }) => {
+      log("op rejected:", rejection.error, rejection.op);
+      this.publish();
+    });
+    engine.on("revoked", ({ code, message }) => {
+      log("connection revoked:", code, message);
+      void this.auth.reconcileSession("connection revoked", { forceRefresh: true, throttleMs: 0 }).catch(() => {
+      });
+      this.publish();
+    });
+  }
+  async checkSchema() {
+    if (this.schemaChecked) return;
+    const schema = this.config.schema;
+    if (!schema) {
+      this.devInfo = this.projectId ? {
+        projectId: this.projectId,
+        localVersion: void 0,
+        status: "no_schema",
+        valid: false,
+        lastCheckedAt: Date.now()
+      } : null;
+      this.syncEnabled = false;
+      this.publish();
+      return;
+    }
+    try {
       const result = await validateAndCheckSchema(schema);
       if (!result.isValid) {
-        let errorMessage = "";
-        if (result.errors) {
-          result.errors.forEach((err, index) => {
-            errorMessage += `${index + 1}: ${err.message} - at ${err.instancePath}
-`;
-          });
-        }
-        setSchemaDevInfo({
-          projectId: schema?.project_id ?? null,
-          localVersion: schema?.version,
+        const errText = result.errors?.map((e) => e.message || "").join("; ") || "invalid";
+        this.devInfo = {
+          projectId: schema.project_id ?? null,
+          localVersion: schema.version,
           status: "invalid",
           valid: false,
           lastCheckedAt: Date.now(),
-          error: errorMessage.trim() || void 0
-        });
-        setError({
-          code: "schema_invalid",
-          title: "Basic Schema is invalid!",
-          message: errorMessage
-        });
-        setIsReady(true);
-        return null;
-      }
-      setSchemaDevInfo({
-        projectId: schema?.project_id ?? null,
-        localVersion: schema?.version,
-        status: result.schemaStatus.status ?? "unknown",
-        valid: result.schemaStatus.valid,
-        lastCheckedAt: Date.now()
-      });
-      if (dbMode === "remote") {
-        initRemoteDb();
+          error: errText
+        };
+        this.syncEnabled = false;
       } else {
-        if (result.schemaStatus.valid) {
-          await initSyncDb({ shouldConnect: true });
-        } else {
-          if (result.schemaStatus.status === "unpublished") {
-            log("Schema not published yet (version 0) - sync is disabled. Publish your schema to enable sync.");
-          } else {
-            log("Schema is invalid!", result.schemaStatus);
+        const status = result.schemaStatus.status ?? "unknown";
+        this.devInfo = {
+          projectId: schema.project_id ?? null,
+          localVersion: schema.version,
+          status,
+          valid: result.schemaStatus.valid,
+          lastCheckedAt: Date.now()
+        };
+        const locallyPublishable = typeof schema.version === "number" && schema.version > 0;
+        const remoteCheckInconclusive = status === "error" || status === "unknown";
+        this.syncEnabled = result.schemaStatus.valid || remoteCheckInconclusive && locallyPublishable;
+        if (!result.schemaStatus.valid) {
+          if (status === "unpublished") {
+            log("Schema not published (version 0) \u2014 sync is disabled until you publish.");
+          } else if (remoteCheckInconclusive && locallyPublishable) {
+            log("Schema registry check failed \u2014 proceeding with the local schema (offline-first).");
           }
-          await initSyncDb({ shouldConnect: false });
         }
       }
-      checkForNewVersion();
-    }
-    if (schema) {
-      checkSchema();
-    } else {
-      setSchemaDevInfo(
-        project_id ? {
-          projectId: project_id,
-          localVersion: void 0,
-          status: "no_schema",
-          valid: false,
-          lastCheckedAt: Date.now()
-        } : null
-      );
-      if (dbMode === "remote" && project_id) {
-        initRemoteDb();
-      } else {
-        setIsReady(true);
-      }
-    }
-  }, []);
-  useEffect(() => {
-    if (authState.hasToken && syncRef.current && authState.isSignedIn && shouldConnect) {
-      log("connecting to db...");
-      syncRef.current?.connect({
-        getToken: (opts) => authRef.current.getToken(opts),
-        ws_url: authConfig.ws_url
-      }).catch((e) => {
-        log("error connecting to db", e);
-      });
+    } catch (err) {
+      log("schema check failed:", err);
+      this.syncEnabled = !!schema.version && schema.version > 0;
+      this.devInfo = {
+        projectId: schema.project_id ?? null,
+        localVersion: schema.version,
+        status: "unknown",
+        valid: this.syncEnabled,
+        lastCheckedAt: Date.now()
+      };
     }
-  }, [authState.isSignedIn, authState.hasToken, shouldConnect]);
-  const handleSignOut = async () => {
-    await authRef.current.signOut();
-    if (syncRef.current) {
+    this.schemaChecked = true;
+    this.publish();
+  }
+  buildSnapshot() {
+    return {
+      isReady: this.auth.isAuthReady,
+      isSignedIn: this.auth.isSignedIn,
+      authStatus: this.auth.authStatus,
+      authErrorCode: this.auth.authErrorCode,
+      user: this.auth.user,
+      did: this.auth.did,
+      scope: this.auth.tokenScope,
+      syncStatus: this.engine?.status ?? "idle",
+      pendingCount: this.engine?.pendingCount ?? 0,
+      syncEnabled: this.syncEnabled,
+      devInfo: this.devInfo,
+      mode: this.mode
+    };
+  }
+  publish() {
+    this.snapshot = this.buildSnapshot();
+    for (const listener of this.listeners) {
       try {
-        await syncRef.current.close();
-        await syncRef.current.delete({ disableAutoOpen: false });
-        syncRef.current = null;
-        window?.location?.reload();
-      } catch (error2) {
-        console.error("Error during database cleanup:", error2);
-      }
-    }
-  };
-  const handleSignIn = async () => {
-    try {
-      await authRef.current.signIn();
-    } catch (error2) {
-      if (isDevMode()) {
-        setError({
-          code: "signin_error",
-          title: "Sign-in Failed",
-          message: error2.message || "An error occurred during sign-in. Please try again."
-        });
-      }
-      throw error2;
-    }
-  };
-  const handleSignInWithHandle = async (handle) => {
-    try {
-      await authRef.current.signInWithHandle(handle);
-    } catch (error2) {
-      if (isDevMode()) {
-        setError({
-          code: "signin_error",
-          title: "Sign-in Failed",
-          message: error2.message || "An error occurred during sign-in. Please try again."
-        });
+        listener();
+      } catch {
       }
-      throw error2;
-    }
-  };
-  const getCurrentDb = () => {
-    if (dbMode === "remote") {
-      return remoteDbRef.current || noDb;
     }
-    return syncRef.current || noDb;
-  };
-  const contextValue = {
-    isReady: authState.isAuthReady,
-    isSignedIn: authState.isSignedIn,
-    user: authState.user,
-    did: authState.did,
-    scope: authState.tokenScope,
-    hasScope: (s) => authRef.current.hasScope(s),
-    missingScopes: () => authRef.current.missingScopes(),
-    signIn: handleSignIn,
-    signInWithHandle: handleSignInWithHandle,
-    signOut: handleSignOut,
-    signInWithCode: (code, state) => authRef.current.signInWithCode(code, state),
-    getToken: (opts) => authRef.current.getToken(opts),
-    getSignInUrl: (redirectUri) => authRef.current.getSignInUrl(redirectUri),
-    db: getCurrentDb(),
-    dbStatus,
-    dbMode,
-    devInfo: schemaDevInfo,
-    refreshSchemaStatus,
-    isAuthReady: authState.isAuthReady,
-    signin: handleSignIn,
-    signout: handleSignOut,
-    signinWithCode: (code, state) => authRef.current.signInWithCode(code, state),
-    getSignInLink: (redirectUri) => authRef.current.getSignInUrl(redirectUri)
-  };
-  return /* @__PURE__ */ jsxs2(BasicContext.Provider, { value: contextValue, children: [
-    error && isDevMode() && /* @__PURE__ */ jsx2(ErrorDisplay, { error }),
-    devToolbar && isDevMode() && /* @__PURE__ */ jsx2(Suspense, { fallback: null, children: /* @__PURE__ */ jsx2(BasicDevToolbar2, { debug }) }),
-    isReady && children
-  ] });
+  }
+};
+function createBasicClient(config) {
+  return new BasicClient(config);
 }
-function ErrorDisplay({ error }) {
-  return /* @__PURE__ */ jsxs2(
-    "div",
-    {
-      style: {
-        position: "absolute",
-        top: 20,
-        left: 20,
-        color: "black",
-        backgroundColor: "#f8d7da",
-        border: "1px solid #f5c6cb",
-        borderRadius: "4px",
-        padding: "20px",
-        maxWidth: "400px",
-        margin: "20px auto",
-        boxShadow: "0 2px 4px rgba(0, 0, 0, 0.1)",
-        fontFamily: "monospace"
-      },
-      children: [
-        /* @__PURE__ */ jsxs2("h3", { style: { fontSize: "0.8rem", opacity: 0.8 }, children: [
-          "code: ",
-          error.code
-        ] }),
-        /* @__PURE__ */ jsx2("h1", { style: { fontSize: "1.2rem", lineHeight: 1.5 }, children: error.title }),
-        /* @__PURE__ */ jsx2("p", { children: error.message })
-      ]
-    }
-  );
+
+// src/react/BasicProvider.tsx
+init_network();
+import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
+var BasicDevToolbar2 = lazy(
+  () => Promise.resolve().then(() => (init_BasicDevToolbar(), BasicDevToolbar_exports)).then((m) => ({ default: m.BasicDevToolbar }))
+);
+function BasicProvider({
+  children,
+  schema,
+  project_id,
+  auth,
+  storage,
+  debug = false,
+  mode = "sync",
+  devToolbar = false,
+  renderWhileLoading = false
+}) {
+  const clientRef = useRef(null);
+  if (!clientRef.current) {
+    clientRef.current = new BasicClient({
+      schema,
+      project_id,
+      auth,
+      storage,
+      debug,
+      mode
+    });
+  }
+  const client = clientRef.current;
+  useEffect2(() => {
+    void client.start();
+    void checkForNewVersion();
+    return () => client.stop();
+  }, []);
+  const snapshot = useSyncExternalStore2(client.subscribe, client.getSnapshot, client.getSnapshot);
+  const showDevTools = devToolbar && isDevelopment(debug);
+  const ready = snapshot.isReady;
+  return /* @__PURE__ */ jsxs2(BasicClientContext.Provider, { value: client, children: [
+    showDevTools && /* @__PURE__ */ jsx2(Suspense, { fallback: null, children: /* @__PURE__ */ jsx2(BasicDevToolbar2, { debug }) }),
+    (ready || renderWhileLoading) && children
+  ] });
 }
 
 // src/index.ts
+init_hooks();
 init_BasicDevToolbar();
-import { useLiveQuery as useQuery } from "dexie-react-hooks";
 export {
+  AuthManager,
+  BasicClient,
   BasicDevToolbar,
   BasicProvider,
-  DBStatus,
+  DEFAULT_LIMITS,
+  LocalStorageAdapter,
   NotAuthenticatedError,
-  RemoteCollection,
-  RemoteDB,
-  RemoteDBError,
+  OWN_SUB,
+  PROTOCOL_VERSION,
+  RestClient,
+  RestDb,
+  RestError,
   STORAGE_KEYS,
+  SyncConnection,
+  SyncDb,
+  SyncEngine,
+  SyncStore,
+  applyOpToData,
+  createBasicClient,
+  isAuthError,
+  isRebootstrapError,
+  isRevocationError,
+  isTerminalOpError,
+  mintOpId,
   resolveDid,
   resolveDidWebUrl,
   resolveHandle,
+  shareSubKey,
+  useAuth,
   useBasic,
-  useQuery
+  useBasicClient,
+  useDb,
+  useQuery,
+  useShare,
+  useShares,
+  useSyncStatus
 };
 //# sourceMappingURL=index.mjs.map