@lunora/client 1.0.0-alpha.137 → 1.0.0-alpha.139

package/dist/packem_shared/{lunora-client.d-BiwicHKh.d.ts → lunora-client.d-DlMXZMfR.d.ts}

@@ -252,7 +252,11 @@ interface OutboxMutation {
   /** Stable per-client id; pairs with {@link OutboxMutation.mutationId} as `idempotencyKey`. */
   clientId: string;
   functionPath: string;
-  /** `${clientId}:${mutationId}` — sent as `x-lunora-mutation-id` so a replay is server-idempotent. */
+  /**
+   * `${clientId}:${mutationId}`, or the caller's own `mutationId` when it passed
+   * one (an `importRows` chunk) — sent as `x-lunora-mutation-id` so a replay is
+   * server-idempotent.
+   */
   idempotencyKey: string;
   /** Issuing identity fingerprint (`null` = signed out); drives the sink's identity guard. */
   identity: string | null;
@@ -866,6 +870,16 @@ interface ServerWhisperMessage {
   topic: string;
   type: "whisper";
 }
+/**
+ * The user the shard authenticated this socket as, sent in reply to every
+ * `connect` frame. `subject` is the resolved user id, or `null` when the socket
+ * is anonymous. A cookie-session client reads it to learn who it is — a
+ * sign-out or another user's sign-in changes nothing else it can see.
+ */
+interface ServerIdentityMessage {
+  subject: null | string;
+  type: "identity";
+}
 /**
  * One row-level change in a shape's replication stream — the wire form of the
  * DO's `__cdc_log` `CdcChange`. `insert`/`update` carry the post-image in
@@ -945,7 +959,7 @@ interface ServerPokeEndMessage {
   pokeId: string;
   type: "pokeEnd";
 }
-type ServerMessage = ServerAckMessage | ServerChunkMessage | ServerCompleteMessage | ServerDataMessage | ServerErrorMessage | ServerPokeEndMessage | ServerPokePartMessage | ServerPokeStartMessage | ServerResumeMessage | ServerSettledMessage | ServerWhisperMessage;
+type ServerMessage = ServerAckMessage | ServerChunkMessage | ServerCompleteMessage | ServerDataMessage | ServerErrorMessage | ServerIdentityMessage | ServerPokeEndMessage | ServerPokePartMessage | ServerPokeStartMessage | ServerResumeMessage | ServerSettledMessage | ServerWhisperMessage;
 /**
  * The authenticated user as exposed client-side, mirroring better-auth's
  * `user` row (the `user` field of the `get-session` response). Kept minimal
@@ -1255,6 +1269,12 @@ type SubscriptionErrorCallback = (error: SubscriptionError) => void;
  * in-flight (so the overlay survives unrelated deltas until confirmed).
  */
 interface OptimisticLayer {
+  /**
+   * Where this write's RPC resolved in the process-wide acknowledgement order
+   * (see `acknowledgementMark`); `undefined` until confirmed. A polled snapshot
+   * carries no cursor, so this is what lets it drop the layer instead.
+   */
+  acknowledgedAt?: number;
   /** The committed CDC cursor (from the mutation response); `undefined` until confirmed. */
   commitCursor?: number;
   readonly id: symbol;
@@ -1473,8 +1493,9 @@ type WSState = "idle" | "connecting" | "open" | "closed";
  * is (re)connecting and none is open; `connected` = at least one socket is open;
  * `polling` = no socket would open, so live queries are being refreshed over HTTP
  * instead (see {@link file://./polling-fallback.ts} — live but slower, and shapes
- * / streams / whispers are dark); `offline` = sockets exist but all are down
- * (between reconnect attempts).
+ * / streams / whispers are dark; mutations go over HTTP as they do while
+ * connected); `offline` = sockets exist but all are down (between reconnect
+ * attempts), and a poll could not reach the origin either.
  *
  * `polling` outranks `connecting`: while the fallback is running a reconnect is
  * still armed in the background, and reporting that attempt would flicker the
@@ -1642,6 +1663,16 @@ interface MutationCallOptions<TCurrent = unknown, TValue = unknown, TArgs = unkn
    * Omit for normal calls.
    */
   replayBaseline?: null | number;
+  /**
+   * The identity stamp a durable write was queued under
+   * ({@link import("./types").OutboxMutation.identity}), handed back by the
+   * sink's replay. Under a cookie session the request then names that user,
+   * and the worker refuses it with `IDENTITY_MISMATCH` when the cookie now
+   * belongs to someone else — the check {@link LunoraClient.replayIdentityVerdict}
+   * cannot make, because the client cannot see the cookie. Omit for normal
+   * calls.
+   */
+  replayIdentity?: null | string;
   shardKey?: string;
 }
 /** Callback a shape subscription invokes with its materialized rowset on every applied poke. */
@@ -1904,6 +1935,25 @@ declare class LunoraClient {
    * the token cannot: is this still the current question?
    */
   private sessionProbeGeneration;
+  /**
+   * Monotonic id of every question this client asks the server about who it
+   * is: each `/get-session` probe, and each cookie-authenticated socket upgrade
+   * (answered by the `identity` frame the shard sends on `connect`). Probes
+   * take their `sessionProbeGeneration` from it, so both kinds of
+   * answer share one order.
+   */
+  private identityQuestions;
+  /**
+   * The `identityQuestions` id of the newest answer adopted so far. A
+   * cookie-session answer older than it describes an older cookie — a socket
+   * upgraded before a probe that has since answered — and may not move the
+   * identity back. See `adoptCookieSubject`.
+   */
+  private identityAnsweredAt;
+  /** Unregisters this client from the page's session-change signal (`shared/session-change.ts`); set in the constructor. */
+  private releaseSessionChangeListener;
+  /** Whether the one-time `IDENTITY_MISMATCH` configuration warning has been logged (see `noteIdentityMismatch`). */
+  private warnedIdentityDisagreement;
   /**
    * Whether anything resolves this client's identity at all.
    *
@@ -1952,6 +2002,8 @@ declare class LunoraClient {
   private readonly statusListeners;
   /** Subscribers notified when the server drops a socket for an expired token (see `onTokenExpired`). */
   private readonly tokenExpiredListeners;
+  /** Subscribers notified when the previous identity's session is retired (see `onIdentityChange`). */
+  private readonly identityChangeListeners;
   /** Token hash the last durable-replay auth refusal fired `onTokenExpired` for — see `shouldRequeueReplayFailure`. */
   private authRefusalNotifiedFor;
   /** Subscribers to offline-queued mutation verdicts (see `onMutationSettled`). */
@@ -2189,6 +2241,27 @@ declare class LunoraClient {
    * the current value.
    */
   onAuthTokenChange(listener: (token: string | null) => void): Unsubscribe;
+  /**
+   * Subscribe to a user switch or sign-out: fired after {@link setAuthToken}
+   * retires the previous identity's session, i.e. every live subscription has
+   * just been blanked to `undefined` and its socket closed. Not fired when a
+   * bearer identity is first established from signed-out (nothing is
+   * retired), nor when a subject is attached to the same credential, nor on
+   * a cookie session's first answer after page load.
+   *
+   * A cookie session fires it on every change the server reports — sign-out,
+   * a sign-in after a known sign-out, a different user — whether the answer
+   * came from {@link getCurrentUser} or from a socket's `identity` frame. Its
+   * sign-out changes nothing the client can observe on its own; in a browser
+   * the client also re-resolves whenever `@lunora/auth-ui` or the
+   * `lunoraSessionSync()` better-auth plugin reports a session change.
+   *
+   * For caches layered on top of the client. A subscriber only hears the
+   * blank for queries it still subscribes to, so a cache that keeps values for
+   * unmounted queries must drop them here, or the next user can read the
+   * previous user's rows from it.
+   */
+  onIdentityChange(listener: () => void): Unsubscribe;
   /**
    * Fetch the currently authenticated user from better-auth's `get-session`
    * endpoint, returning the `user` record or `null` when signed out. Sends
@@ -2213,6 +2286,10 @@ declare class LunoraClient {
    * knows the answer — leaving it to each adapter is what left the sticky-subject
    * contract unreached in every shipped one, so a routine JWT refresh read as a
    * user switch and discarded the user's own queued writes and read cache.
+   *
+   * Under a cookie session (no token held) the answer is adopted whatever it
+   * is, "no session" included, and a change from the identity already known
+   * retires the previous session — see {@link onIdentityChange}.
    */
   getCurrentUser(): Promise<User | null>;
   /**
@@ -2533,16 +2610,24 @@ declare class LunoraClient {
    * {@link LunoraClient.importRows} documents the same caveat for its counts.
    */
   mutation<F extends FunctionReference>(function_: F, args: ArgsOf<F>, options?: MutationCallOptions<unknown, unknown, ArgsOf<F>>): Promise<ReturnOf<F>>;
+  /**
+   * Whether a {@link mutation} on `shardKey` would be queued (offline queue or
+   * durable outbox) rather than fail when the network is down. `false` before
+   * the shard's first connect (unless `queueBeforeFirstConnect` is set) and on
+   * a client with no WebSocket. A caller that wants to hold a write until the
+   * network returns must do so itself when this is `false`.
+   */
+  canQueueOffline(shardKey?: string): boolean;
   action<F extends FunctionReference>(function_: F, args: ArgsOf<F>, options?: ActionCallOptions): Promise<ReturnOf<F>>;
   /**
    * Bulk-import `rows` through a mutation that accepts a batch, chunked so a large
    * dataset lands in a bounded number of round-trips.
    *
-   * **Offline caveat:** each chunk is sent with {@link LunoraClient.mutation}, which
-   * resolves once the write is durably queued rather than once the server has applied
-   * it. So an import run while offline resolves `{ chunks, imported }` with nothing
-   * committed yet — the counts describe what was *handed over*, and the outbox
-   * replays them on reconnect. Don't report "migration complete" on this alone.
+   * **Queued chunks:** `imported` counts only rows the server committed. A chunk a
+   * durable outbox took instead (offline, or behind older queued writes) is counted
+   * in `queued`; the outbox replays it later under the same key. The built-in
+   * offline queue holds the call until each chunk commits, so its rows land in
+   * `imported`. Report "migration complete" only when `queued` is `0`.
    *
    * This is the one-shot migration / seed path: "I have 20k rows client-side and a
    * server mutation that inserts many at once". Doing it by hand goes wrong in two
@@ -2550,7 +2635,8 @@ declare class LunoraClient {
    * wait per row (a 200-row import becomes 200 sequential hops), while a single
    * giant call blows the DO's batch limit. So: chunk, send sequentially, and give
    * each chunk a stable idempotency key derived from `importId` + its index, so a
-   * resumed or retried import doesn't double-insert the chunks that already landed.
+   * resumed or retried import doesn't double-insert the chunks that already landed
+   * (for an anonymous caller only while the `clientId` is the same; see `importId`).
    *
    * The server mutation is yours (Lunora can't guess the table or the row shape);
    * back it with `ctx.db.insertMany(...)`, or `insertManyUnsafe(...)` for data you
@@ -2581,15 +2667,18 @@ declare class LunoraClient {
      * SILENTLY DROPS those rows. Keep `chunkSize` (and the row order) identical
      * across resumes of the same `importId`. Omit `importId` only for a
      * throwaway import where double-insertion is acceptable.
+     *
+     * CAVEAT — anonymous callers: the server scopes the key to the signed-in
+     * user, or to the client's `clientId` when nobody is signed in. A
+     * `LunoraClient` mints a fresh `clientId` on every construction, so an
+     * anonymous import resumed after a reload is not deduped and inserts the
+     * landed chunks again. Pass a persisted `clientId` to the constructor to
+     * resume anonymously, or run the import signed in.
      */
     importId?: string;
     /**
-     * Called after each chunk is accepted — for a progress bar.
-     *
-     * "Accepted" is not always "committed": while offline (or mid-reconnect) a
-     * `mutation` resolves as soon as the write is durably **queued**, so a fully
-     * offline import reports completion with nothing yet applied server-side.
-     * Gate a migration's "done" state on connectivity, not just on this.
+     * Called after each chunk is accepted — for a progress bar. `done` counts
+     * committed and queued rows alike; the result separates them.
      */
     onProgress?: (progress: {
       done: number;
@@ -2602,6 +2691,7 @@ declare class LunoraClient {
   }): Promise<{
     chunks: number;
     imported: number;
+    queued: number;
   }>;
   /**
    * Read the cross-shard request distribution for a `.shardBy(...)` table —
@@ -3372,6 +3462,14 @@ declare class LunoraClient {
    * stamp elsewhere in this file) — moved verbatim, not reflowed.
    */
   private createTabCoordinator;
+  /** The body of {@link batch}, optionally abortable (the polling fallback's timeout). */
+  private sendBatch;
+  /**
+   * The body of {@link mutation}, also saying whether the write committed. `committed` is
+   * `false` only when a durable outbox took the write, which resolves at once
+   * with no server result.
+   */
+  private runMutation;
   /**
    * Persist a mutation that can't go out on the wire right now (offline, or
    * mid-reconnect after a prior connect). The optimistic update has already
@@ -3574,8 +3672,24 @@ declare class LunoraClient {
    * than being swallowed: the whole point of the fallback is that the app keeps
    * working, and a query that is now failing (a permission change, a bad arg)
    * has to be visible.
+   *
+   * Resolves `false` when the request never reached the origin (`fetch` itself
+   * rejected), which is how the fallback tells a device with no network from a
+   * network that only refuses the upgrade. Any answer, an error envelope
+   * included, resolves `true`.
+   *
+   * Optimistic layers need the same care without a cursor. The snapshot is taken
+   * after the request is sent, so every write whose RPC had resolved before that
+   * moment is already in it. Those layers are dropped against the acknowledgement
+   * mark sampled before the send. A write acknowledged after the send may be
+   * missing from the snapshot, so its layer stays.
    */
   private pollSubscriptions;
+  /**
+   * Whether a request reaches the origin at all: an empty batch, whose answer
+   * (even a refusal) is the proof. `false` only when `fetch` itself rejects.
+   */
+  private probeOrigin;
   /** Recompute the aggregate status and notify listeners if it changed. */
   private emitConnectionStatus;
   /**
@@ -3619,7 +3733,7 @@ declare class LunoraClient {
    */
   private sendOrQueueUnsubscribe;
   /**
-   * The `(wsState, hasSocket, wasEverConnected)` triple `mutation()`'s
+   * The `(wsState, hasSocket, wasEverConnected, polling)` state `mutation()`'s
    * offline-queue gate reads. On the leader/single-tab path this is exactly
    * the real `ShardConnection`'s state (byte-identical to the pre-cross-tab
    * behavior). A follower has no `ShardConnection` of its own (see
@@ -3629,6 +3743,11 @@ declare class LunoraClient {
    * `"connecting"` (the mid-reconnect queue branch), anything else is
    * `"idle"`. `hasSocket` is always `false` for a follower — it never has
    * one.
+   *
+   * `polling` is `true` while the HTTP polling fallback is reaching the origin
+   * (the leader's mirrored `"polling"` on a follower). Writes then go straight
+   * over HTTP, as they do while connected, instead of queueing for a socket
+   * that may never open.
    */
   private connectionGateState;
   private getOrCreateConnection;
@@ -3664,7 +3783,8 @@ declare class LunoraClient {
    * once per socket open, so the server's `onConnect` hooks fire symmetrically
    * with `onDisconnect` (which the DO dispatches unconditionally at close for
    * every lifecycle-aware socket). The DO no-ops cheaply when no `onConnect`
-   * hooks are registered, so the single frame costs nothing in the common case.
+   * hooks are registered, and answers with the socket's `identity` frame
+   * (see `handleIdentityFrame`).
    *
    * The shard's registered context (or the client-wide default) rides along
    * when one is set — the DO records it on the attachment for replay to
@@ -3806,6 +3926,10 @@ declare class LunoraClient {
   private resnapshotSubscription;
   /** Materialize a shape's keyed view to an array and invoke its callbacks. */
   private emitShapeRows;
+  /**
+   * Apply one `data` frame. `snapshotMark` is set only for a frame synthesized
+   * by a poll, which carries no cursor: see {@link pollSubscriptions}.
+   */
   private handleDataMessage;
   /**
    * Handle a `resume` frame (Pillar 1b): the server proved nothing the
@@ -4002,19 +4126,78 @@ declare class LunoraClient {
    * Key the offline-queue identity on the resolved user id rather than the
    * token bytes, so the NEXT token refresh keeps the same identity.
    *
-   * Only a resolved user labels anything. A 401, a network failure or an
-   * empty session resolves `null` for reasons that say nothing about who is
-   * signed in, and a token that rotated mid-flight belongs to a session this
-   * answer predates — both leave the established label alone rather than
-   * clearing it (which would look like an identity change and drop the queue).
+   * Under a bearer token only a resolved user labels anything. A 401 or an
+   * empty session resolves `null` for reasons that say nothing about who holds
+   * the token, so the established label is left alone rather than cleared
+   * (which would look like an identity change and drop the queue). A token
+   * that rotated mid-flight belongs to a session this answer predates and is
+   * ignored for the same reason.
+   *
+   * Under a cookie session (no token) the answer is the identity, `null`
+   * included: nothing on the client changes when the user signs out, so "the
+   * server found no session" is the only sign-out this client will ever see.
+   * See {@link adoptCookieSubject}.
    *
-   * A superseded probe is the same case, and the one the token check cannot
-   * see: on a cookie app both `requestToken`s are `null`, so a slow answer
-   * from an OLDER probe passed that check and overwrote the subject a newer
-   * one had already established. `requestGeneration` is the question's id —
-   * it must still be the current one at the moment of the write.
+   * A superseded probe is ignored too, and the token check cannot see it: on a
+   * cookie app both `requestToken`s are `null`, so a slow answer from an OLDER
+   * probe passed that check and overwrote the subject a newer one had already
+   * established. `requestGeneration` is the question's id — it must still be
+   * the current one at the moment of the write.
    */
   private adoptResolvedSubject;
+  /**
+   * Adopt the user a cookie session resolved to — `null` for nobody — as this
+   * client's identity, from either source the server answers through: a
+   * `/get-session` probe, or a socket's `identity` frame.
+   *
+   * Three states, told apart by `authSubject`: `undefined` is not known yet
+   * (every page load until the first answer), `null` is known to be nobody,
+   * and a string is that user. {@link setAuthToken} retires the previous
+   * session on every change between two KNOWN states — `A → nobody`,
+   * `nobody → B`, `A → B` — and on none out of `undefined`, so the first
+   * answer after a page load never evicts what the page is already showing
+   * for the session it was loaded under.
+   *
+   * `question` orders the answers: one older than the answer in force
+   * describes an older cookie and is dropped. Returns whether it was adopted.
+   */
+  private adoptCookieSubject;
+  /**
+   * A cookie socket's `identity` frame: the user the shard authenticated this
+   * socket as, sent in reply to every `connect`.
+   *
+   * Adopted like a probe's answer when it is the newest one
+   * ({@link adoptCookieSubject}). An OLDER one that disagrees with the
+   * identity in force means this socket was upgraded on a cookie that has
+   * since changed hands, and is still delivering that user's rows: the
+   * session it belongs to is retired, which replaces the socket.
+   *
+   * Ignored for a socket that authenticated with a token rather than the
+   * cookie (see `ShardConnection.identityQuestion`) — its answer is about that
+   * token, not about the cookie session this client's identity tracks.
+   */
+  private handleIdentityFrame;
+  /**
+   * The subject half of {@link setAuthToken}.
+   *
+   * Sticky: only an explicit value (incl. `null` = signed out) changes the
+   * subject; omitting it keeps the established one. Two exceptions, both about
+   * a subject that must not outlive the credential it described:
+   *
+   * - Clearing the token clears a user subject — see `setAuthToken`'s
+   * docblock. A `null` one stays: a cookie session known to be nobody's is
+   * still nobody's.
+   * - A token arriving on a session known to be nobody's drops the `null`,
+   * so the identity falls back to the token itself rather than staying
+   * "nobody" while a credential is held.
+   */
+  private applySubject;
+  /**
+   * A cookie session the server has answered "nobody" for — see
+   * {@link adoptCookieSubject}. Distinct from a subject not known YET
+   * (`undefined`).
+   */
+  private isKnownNobody;
   /**
    * True while an established subject labels a credential it was never checked
    * against — see the `subjectToken` field. Every replay verdict is
@@ -4301,6 +4484,30 @@ declare class LunoraClient {
    * answer.
    */
   private shouldRequeueReplayFailure;
+  /**
+   * The `expectSubject` a replayed write carries: the user its identity stamp
+   * names, so the worker refuses it when the request resolves to anyone else.
+   *
+   * The replay gate compares the stamp with what this client believes, and
+   * under a cookie session that belief can be stale — a sign-out and another
+   * user's sign-in change no token, and the socket's `open` flush runs before
+   * its `identity` frame lands. Only the server sees the cookie the write is
+   * about to ride, so it is the server that has to check.
+   *
+   * Sent on every replay made without a bearer token, whatever resolved the
+   * stamp — a socket's `identity` frame labels the session in apps that never
+   * call `getCurrentUser()` too. An app without auth stamps `null` and its
+   * requests resolve to nobody, so the header always passes there. A bearer
+   * request states its credential explicitly and the gate already matched it;
+   * a token-hash or missing stamp names no user.
+   */
+  private replayExpectation;
+  /**
+   * Whether `failure` is the worker's `IDENTITY_MISMATCH` refusal, and if so,
+   * ask who is signed in now: the answer is what re-runs the replay gate
+   * ({@link setAuthToken}), and nothing else would on a cookie session.
+   */
+  private noteIdentityMismatch;
   /** Settle a write the server reached a coded verdict on: replaying would re-trigger the same failure (a poison-message loop), so drop it. */
   private settleReplayTerminal;
   /**

package/dist/packem_shared/{preload.d-DE--vVCE.d.ts → preload.d-BNFe_NYM.d.ts}

@@ -1,4 +1,4 @@
-import { L as LunoraClient, P as Preloaded } from "./lunora-client.d-BiwicHKh.js";
+import { L as LunoraClient, P as Preloaded } from "./lunora-client.d-DlMXZMfR.js";
 import { F as FunctionReference, A as ArgsOf, R as ReturnOf } from "./function-reference.d-Br_hsKje.js";
 /**
  * Run a query once on the server (during SSR) and capture its result in a

package/dist/packem_shared/{preload.d-91KD5ae3.d.mts → preload.d-C3Nbhx4m.d.mts}

@@ -1,4 +1,4 @@
-import { L as LunoraClient, P as Preloaded } from "./lunora-client.d-Cqp1YHAJ.mjs";
+import { L as LunoraClient, P as Preloaded } from "./lunora-client.d-CxU0UvII.mjs";
 import { F as FunctionReference, A as ArgsOf, R as ReturnOf } from "./function-reference.d-Br_hsKje.mjs";
 /**
  * Run a query once on the server (during SSR) and capture its result in a

package/dist/packem_shared/wire-codec-BeIi1K-T.mjs

@@ -0,0 +1 @@
+const w=e=>{let t="";for(let o=0;o<e.length;o+=32768)t+=String.fromCharCode(...e.subarray(o,o+32768));return btoa(t)},p=e=>{const t=atob(e),i=new Uint8Array(t.length);for(let o=0;o<t.length;o+=1)i[o]=t.codePointAt(o)??0;return i},b="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_",h=e=>{let t="",i=0;const o=e.length-2;for(;i<o;i+=3){const r=e[i]<<16|e[i+1]<<8|e[i+2];t+=b.charAt(r>>18&63)+b.charAt(r>>12&63)+b.charAt(r>>6&63)+b.charAt(r&63)}const a=e.length-i;if(a===1){const r=e[i]<<16;t+=b.charAt(r>>18&63)+b.charAt(r>>12&63)}else if(a===2){const r=e[i]<<16|e[i+1]<<8;t+=b.charAt(r>>18&63)+b.charAt(r>>12&63)+b.charAt(r>>6&63)}return t},c="$lunora.wire$";const g="__proto__",A={BigInt64Array,BigUint64Array,Float32Array,Float64Array,Int8Array,Int16Array,Int32Array,Uint8Array,Uint8ClampedArray,Uint16Array,Uint32Array},l={Error,EvalError,RangeError,ReferenceError,SyntaxError,TypeError,URIError},E=e=>{if(e===null||typeof e!="object")return!1;const t=Object.getPrototypeOf(e);return t===null||t===Object.prototype},d=(e,t=0)=>{if(t>64)throw new RangeError("wire-codec: value nesting exceeds the 64-level limit");if(e===void 0)return[c,"undefined"];if(e===null)return null;const i=typeof e;if(i==="bigint")return[c,"bigint",e.toString()];if(i==="number"){const r=e;return Number.isNaN(r)?[c,"nan"]:r===1/0?[c,"inf"]:r===-1/0?[c,"-inf"]:r}if(i!=="object")return e;if(e instanceof Date)return[c,"date",d(e.getTime(),t+1)];if(e instanceof Error){const r=e,n={};for(const s of Object.keys(r)){if(r[s]===void 0)continue;const y=d(r[s],t+1);s===g?Object.defineProperty(n,s,{configurable:!0,enumerable:!0,value:y,writable:!0}):n[s]=y}const f=[c,"error",String(r.name),String(r.message),n];return r.cause!==void 0&&f.push(d(r.cause,t+1)),f}if(e instanceof URL)return[c,"url",e.href];if(e instanceof Map)return[c,"map",[...e.entries()].map(([r,n])=>[d(r,t+1),d(n,t+1)])];if(e instanceof Set)return[c,"set",[...e].map(r=>d(r,t+1))];if(e instanceof ArrayBuffer)return[c,"bytes",w(new Uint8Array(e)),"ArrayBuffer"];if(ArrayBuffer.isView(e)){const r=e,n=r.constructor.name,f=new Uint8Array(r.buffer,r.byteOffset,r.byteLength);return n==="Uint8Array"?[c,"bytes",w(f)]:[c,"bytes",w(f),n]}if(Array.isArray(e)){const r=e.map(n=>d(n,t+1));return r.length>0&&r[0]===c?[c,"arr",r]:r}if(!E(e)){const r=e.constructor?.name??"value";throw new TypeError(`wire-codec: cannot encode a ${r} over the Lunora wire — only plain objects, arrays, and the supported built-ins (Date, Error, URL, Map, Set, ArrayBuffer/typed arrays, bigint) round-trip`)}const o=e,a={};for(const r of Object.keys(o)){const n=o[r];if(n===void 0)continue;const f=d(n,t+1);r===g?Object.defineProperty(a,r,{configurable:!0,enumerable:!0,value:f,writable:!0}):a[r]=f}return a},u=(e,t=0)=>{if(t>64)throw new RangeError("wire-codec: value nesting exceeds the 64-level limit");if(e===null||typeof e!="object")return e;if(Array.isArray(e)){if(e[0]===c)switch(e[1]){case"-inf":return-1/0;case"arr":return e[2].map(r=>u(r,t+1));case"bigint":{const r=e[2];if(typeof r!="string"||r.length>1024||!/^-?\d+$/.test(r))throw new RangeError("wire-codec: invalid or over-long bigint (max 1024 digits)");return BigInt(r)}case"date":{const r=u(e[2],t+1);if(typeof r!="number")throw new TypeError("wire-codec: malformed date — epoch must be a number");return new Date(r)}case"map":{const r=e[2];return new Map(r.map(n=>{if(!Array.isArray(n)||n.length!==2)throw new TypeError("wire-codec: malformed map entry — expected a [key, value] pair");return[u(n[0],t+1),u(n[1],t+1)]}))}case"set":return new Set(e[2].map(r=>u(r,t+1)));case"url":{const r=e[2];if(typeof r!="string")throw new TypeError("wire-codec: malformed url — href must be a string");return new URL(r)}case"error":{const r=e[2],n=e[3];if(typeof r!="string"||typeof n!="string")throw new TypeError("wire-codec: malformed error — name and message must be strings");const f=(Object.hasOwn(l,r)?l[r]:void 0)??Error,s=new f(n);s.name!==r&&Object.defineProperty(s,"name",{configurable:!0,value:r,writable:!0});const y=u(e[4],t+1);if(y===null||typeof y!="object"||Array.isArray(y))throw new TypeError("wire-codec: malformed error — props must be an object");for(const m of Object.keys(y))m===g?Object.defineProperty(s,m,{configurable:!0,enumerable:!0,value:y[m],writable:!0}):s[m]=y[m];return e.length>5&&Object.defineProperty(s,"cause",{configurable:!0,value:u(e[5],t+1),writable:!0}),s}case"bytes":{const r=e[2];if(typeof r!="string")throw new TypeError("wire-codec: malformed bytes — payload must be a base64 string");const n=p(r);if(w(n)!==r)throw new TypeError("wire-codec: malformed bytes — payload must be canonical padded base64");const f=e[3]??"Uint8Array";if(f==="ArrayBuffer")return n.buffer.byteLength===n.byteLength?n.buffer:n.slice().buffer;const s=Object.hasOwn(A,f)?A[f]:void 0;return s?new s(n.slice().buffer):n}case"inf":return 1/0;case"nan":return Number.NaN;case"undefined":return;default:return e.map(r=>u(r,t+1))}return e.map(a=>u(a,t+1))}const i=e,o={};for(const a of Object.keys(i)){const r=u(i[a],t+1);a===g?Object.defineProperty(o,a,{configurable:!0,enumerable:!0,value:r,writable:!0}):o[a]=r}return o},T=(e,t,i)=>{try{return d(i)}catch(o){throw new TypeError(`${e}: cannot encode args for '${t}' — ${o instanceof Error?o.message:String(o)}`,o instanceof Error?{cause:o}:void 0)}};export{T as a,u as d,d as e,E as i,h as t};

package/dist/packem_shared/{wire-key-HsUDTlQ7.mjs → wire-key-DCPYV4t8.mjs}

@@ -1 +1 @@
-import{e as a}from"./wire-codec-Sw1rAu-Z.mjs";const b=/["\\\u0000-\u001F\uD800-\uDFFF]/,y=t=>b.test(t)?JSON.stringify(t):`"${t}"`,i=t=>{if(t===void 0)return"null";if(typeof t=="bigint")throw new TypeError("stableStringify: cannot use a bigint in a stable JSON cache key — pass it as a string, or use stableWireKey");if(typeof t=="number"){if(Number.isNaN(t))return"nan";if(t===1/0)return"inf";if(t===-1/0)return"-inf";if(Object.is(t,-0))return"-0"}if(typeof t=="string")return y(t);if(t===null||typeof t!="object")return JSON.stringify(t);if(Array.isArray(t)){let r="[";for(let e=0;e<t.length;e++)e>0&&(r+=","),r+=i(t[e]);return r+"]"}const o=Object.getPrototypeOf(t);if(o!==null&&o!==Object.prototype){const r=t.constructor?.name??"value";throw new TypeError(`stableStringify: cannot use a ${r} in a stable JSON cache key — only plain objects, arrays, and JSON primitives are supported (wire-typed values key via stableWireKey)`)}const s=t,c=Object.keys(s).sort();let n="{",f=!0;for(const r of c){const e=s[r];e!==void 0&&(f?f=!1:n+=",",n+=y(r),n+=":",n+=i(e))}return n+"}"},u=t=>i(a(t));export{u as s};
+import{e as a}from"./wire-codec-BeIi1K-T.mjs";const b=/["\\\u0000-\u001F\uD800-\uDFFF]/,y=t=>b.test(t)?JSON.stringify(t):`"${t}"`,i=t=>{if(t===void 0)return"null";if(typeof t=="bigint")throw new TypeError("stableStringify: cannot use a bigint in a stable JSON cache key — pass it as a string, or use stableWireKey");if(typeof t=="number"){if(Number.isNaN(t))return"nan";if(t===1/0)return"inf";if(t===-1/0)return"-inf";if(Object.is(t,-0))return"-0"}if(typeof t=="string")return y(t);if(t===null||typeof t!="object")return JSON.stringify(t);if(Array.isArray(t)){let r="[";for(let e=0;e<t.length;e++)e>0&&(r+=","),r+=i(t[e]);return r+"]"}const o=Object.getPrototypeOf(t);if(o!==null&&o!==Object.prototype){const r=t.constructor?.name??"value";throw new TypeError(`stableStringify: cannot use a ${r} in a stable JSON cache key — only plain objects, arrays, and JSON primitives are supported (wire-typed values key via stableWireKey)`)}const s=t,c=Object.keys(s).sort();let n="{",f=!0;for(const r of c){const e=s[r];e!==void 0&&(f?f=!1:n+=",",n+=y(r),n+=":",n+=i(e))}return n+"}"},u=t=>i(a(t));export{u as s};

package/dist/query/index.d.mts

@@ -1,4 +1,4 @@
-import { S as SubscriptionError, L as LunoraClient, a as Unsubscribe } from "../packem_shared/lunora-client.d-Cqp1YHAJ.mjs";
+import { S as SubscriptionError, L as LunoraClient, a as Unsubscribe } from "../packem_shared/lunora-client.d-CxU0UvII.mjs";
 export type {
 /**
  * `@lunora/client/query` — the framework-neutral live-query state machine shared
@@ -10,7 +10,7 @@ export type {
  * framework — each adapter supplies thin sinks that write into its own ref /
  * store / signal / cache.
  */
-b as SubscriptionErrorCallback } from "../packem_shared/lunora-client.d-Cqp1YHAJ.mjs";
+b as SubscriptionErrorCallback } from "../packem_shared/lunora-client.d-CxU0UvII.mjs";
 import { F as FunctionReference, A as ArgsOf, R as ReturnOf } from "../packem_shared/function-reference.d-Br_hsKje.mjs";
 import '@lunora/errors';
 import '@lunora/runtime';

package/dist/query/index.d.ts

@@ -1,4 +1,4 @@
-import { S as SubscriptionError, L as LunoraClient, a as Unsubscribe } from "../packem_shared/lunora-client.d-BiwicHKh.js";
+import { S as SubscriptionError, L as LunoraClient, a as Unsubscribe } from "../packem_shared/lunora-client.d-DlMXZMfR.js";
 export type {
 /**
  * `@lunora/client/query` — the framework-neutral live-query state machine shared
@@ -10,7 +10,7 @@ export type {
  * framework — each adapter supplies thin sinks that write into its own ref /
  * store / signal / cache.
  */
-b as SubscriptionErrorCallback } from "../packem_shared/lunora-client.d-BiwicHKh.js";
+b as SubscriptionErrorCallback } from "../packem_shared/lunora-client.d-DlMXZMfR.js";
 import { F as FunctionReference, A as ArgsOf, R as ReturnOf } from "../packem_shared/function-reference.d-Br_hsKje.js";
 import '@lunora/errors';
 import '@lunora/runtime';

package/dist/service.mjs

@@ -1 +1 @@
-import{LunoraError as i}from"@lunora/errors";import{a as p,d}from"./packem_shared/wire-codec-Sw1rAu-Z.mjs";import{e as w}from"./packem_shared/replay-DYdPvn3o.mjs";const v="/_lunora/rpc",N="https://lunora.internal",$=e=>{const t=new Error(e.message??"request failed");return t.code=e.code,e.data!==void 0&&(t.data=d(e.data)),e.hint!==void 0&&(t.hint=e.hint),e.docsUrl!==void 0&&(t.docsUrl=e.docsUrl),t},c=async(e,t,n,s,u)=>{const o=n.__lunoraRef,f=JSON.stringify({args:p("@lunora/client/service",o,s??{}),functionPath:o,...u?.shardKey===void 0?{}:{shardKey:u.shardKey}}),a=await e.fetch(new Request(`${N}${v}`,{body:f,headers:{"content-type":"application/json"},method:"POST"}));let r;try{r=await a.json()}catch{throw new i("INTERNAL",`@lunora/client/service: ${t} "${o}" got a non-JSON response (status ${a.status.toString()}). Check the service binding points at the Lunora Worker that declares this function.`,{status:a.status})}if(r===null||typeof r!="object")throw new i("INTERNAL",`@lunora/client/service: ${t} "${o}" returned a JSON body that is not an object (status ${a.status.toString()}). Check the service binding points at the Lunora Worker that declares this function.`,{status:a.status});const l=r,h=w(l);if(h!==void 0)throw $(h);if(!a.ok)throw new i("INTERNAL",`@lunora/client/service: ${t} "${o}" failed with status ${a.status.toString()} and no error envelope.`,{status:a.status});return d(l.result)},E=e=>({action:async(t,n,s)=>await c(e,"action",t,n,s),mutation:async(t,n,s)=>await c(e,"mutation",t,n,s),query:async(t,n,s)=>await c(e,"query",t,n,s)});export{v as RPC_PATH,E as createServiceClient};
+import{LunoraError as i}from"@lunora/errors";import{a as p,d}from"./packem_shared/wire-codec-BeIi1K-T.mjs";import{e as w}from"./packem_shared/replay-DYdPvn3o.mjs";const v="/_lunora/rpc",N="https://lunora.internal",$=e=>{const t=new Error(e.message??"request failed");return t.code=e.code,e.data!==void 0&&(t.data=d(e.data)),e.hint!==void 0&&(t.hint=e.hint),e.docsUrl!==void 0&&(t.docsUrl=e.docsUrl),t},c=async(e,t,n,s,u)=>{const o=n.__lunoraRef,f=JSON.stringify({args:p("@lunora/client/service",o,s??{}),functionPath:o,...u?.shardKey===void 0?{}:{shardKey:u.shardKey}}),a=await e.fetch(new Request(`${N}${v}`,{body:f,headers:{"content-type":"application/json"},method:"POST"}));let r;try{r=await a.json()}catch{throw new i("INTERNAL",`@lunora/client/service: ${t} "${o}" got a non-JSON response (status ${a.status.toString()}). Check the service binding points at the Lunora Worker that declares this function.`,{status:a.status})}if(r===null||typeof r!="object")throw new i("INTERNAL",`@lunora/client/service: ${t} "${o}" returned a JSON body that is not an object (status ${a.status.toString()}). Check the service binding points at the Lunora Worker that declares this function.`,{status:a.status});const l=r,h=w(l);if(h!==void 0)throw $(h);if(!a.ok)throw new i("INTERNAL",`@lunora/client/service: ${t} "${o}" failed with status ${a.status.toString()} and no error envelope.`,{status:a.status});return d(l.result)},E=e=>({action:async(t,n,s)=>await c(e,"action",t,n,s),mutation:async(t,n,s)=>await c(e,"mutation",t,n,s),query:async(t,n,s)=>await c(e,"query",t,n,s)});export{v as RPC_PATH,E as createServiceClient};

package/dist/ssr/index.d.mts

@@ -1,4 +1,4 @@
-import { P as Preloaded, L as LunoraClient } from "../packem_shared/lunora-client.d-Cqp1YHAJ.mjs";
+import { P as Preloaded, L as LunoraClient } from "../packem_shared/lunora-client.d-CxU0UvII.mjs";
 export type { A as ArgsOf, F as FunctionReference, R as ReturnOf } from "../packem_shared/function-reference.d-Br_hsKje.mjs";
 export {
 /**
@@ -20,7 +20,7 @@ p as preloadQuery,
  * WebSocket or touches a UI framework, so it is safe to import from any SSR
  * loader.
  */
-a as preloadedQueryResult } from "../packem_shared/preload.d-91KD5ae3.mjs";
+a as preloadedQueryResult } from "../packem_shared/preload.d-C3Nbhx4m.mjs";
 import '@lunora/errors';
 import '@lunora/runtime';
 /**

package/dist/ssr/index.d.ts

@@ -1,4 +1,4 @@
-import { P as Preloaded, L as LunoraClient } from "../packem_shared/lunora-client.d-BiwicHKh.js";
+import { P as Preloaded, L as LunoraClient } from "../packem_shared/lunora-client.d-DlMXZMfR.js";
 export type { A as ArgsOf, F as FunctionReference, R as ReturnOf } from "../packem_shared/function-reference.d-Br_hsKje.js";
 export {
 /**
@@ -20,7 +20,7 @@ p as preloadQuery,
  * WebSocket or touches a UI framework, so it is safe to import from any SSR
  * loader.
  */
-a as preloadedQueryResult } from "../packem_shared/preload.d-DE--vVCE.js";
+a as preloadedQueryResult } from "../packem_shared/preload.d-BNFe_NYM.js";
 import '@lunora/errors';
 import '@lunora/runtime';
 /**

package/dist/ssr/index.mjs

@@ -1 +1 @@
-import{getServerSession as o}from"../packem_shared/getServerSession-BaOoo1p6.mjs";import{deserializePreloaded as l,serializePreloaded as t}from"../packem_shared/deserializePreloaded-C6NTQdFa.mjs";import{createServerClient as i}from"../packem_shared/createServerClient-CzDIXbC4.mjs";import{preloadQuery as s,preloadedQueryResult as f}from"../packem_shared/preloadQuery-uFy24PCR.mjs";export{i as createServerClient,l as deserializePreloaded,o as getServerSession,s as preloadQuery,f as preloadedQueryResult,t as serializePreloaded};
+import{getServerSession as o}from"../packem_shared/getServerSession-BaOoo1p6.mjs";import{deserializePreloaded as l,serializePreloaded as t}from"../packem_shared/deserializePreloaded-Bffy70Wm.mjs";import{createServerClient as i}from"../packem_shared/createServerClient-DqNe__QI.mjs";import{preloadQuery as s,preloadedQueryResult as f}from"../packem_shared/preloadQuery-uFy24PCR.mjs";export{i as createServerClient,l as deserializePreloaded,o as getServerSession,s as preloadQuery,f as preloadedQueryResult,t as serializePreloaded};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/client",
-  "version": "1.0.0-alpha.137",
+  "version": "1.0.0-alpha.139",
   "description": "Lunora browser SDK: WebSocket transport, optimistic updates, and an offline mutation queue",
   "keywords": [
     "cloudflare",
@@ -70,7 +70,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.41",
+    "@lunora/errors": "1.0.0-alpha.43",
     "@visulima/storage-client": "1.0.3"
   },
   "peerDependencies": {