@omg-dev/sdk 0.4.24

package/dist/index.mjs

@@ -0,0 +1,1611 @@
+import { a as installTrace, c as requestMotionPermission, d as getAuthContext, f as notifyAuthRequired, h as subscribeAuthRequired, i as getTrace, l as useFeedbackGesture, m as subscribeAuthChange, n as captureScreenshot, o as attachGestureListeners, p as setAuthContext, r as clearTrace, s as motionPermissionState, t as VibesFeedback, u as useUpload } from "./VibesFeedback-BF2Vf6FK.mjs";
+import { t as OmgBadge } from "./OmgBadge-LAcimQp0.mjs";
+import { createContext, useCallback, useContext, useEffect, useId, useMemo, useRef, useState, useSyncExternalStore } from "react";
+import { fetchEventSource } from "@microsoft/fetch-event-source";
+import { createAuthClient } from "better-auth/react";
+import { passkeyClient } from "@better-auth/passkey/client";
+import { emailOTPClient, magicLinkClient } from "better-auth/client/plugins";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+//#region src/auth/client.ts
+const DEFAULT_AUTH_URL = "https://auth.omg.dev";
+const AUTH_BRIDGE_PREFIX = "/__vibes/auth";
+/**
+* Derive the appId from the current host. The slug is the first DNS label.
+* Canonical deployed apps live at `<slug>.apps.omg.dev`; cross-site app hosts
+* (no shared `.omg.dev` cookie) live at `<slug>.omgs.app`. Returns null when
+* the host doesn't match (local dev, custom domains).
+*/
+function deriveAppId(host) {
+	const h = host ?? (typeof window !== "undefined" ? window.location.host : "");
+	if (host === void 0) {
+		const injected = readInjectedAppId();
+		if (injected) return injected;
+	}
+	const m = /^([a-z0-9-]+)\.apps\.omg\.dev$/.exec(h) ?? /^([a-z0-9-]+)\.omgs\.app$/.exec(h);
+	return m ? m[1] : null;
+}
+/**
+* A cross-site app host is one served outside the shared `.omg.dev` cookie
+* scope, so the slug JWT must be minted same-origin (the Worker reads the
+* first-party `omg_access` cookie and exchanges it). Today that's `*.omgs.app`.
+* Custom domains are out of scope here — they fall through to the default
+* `${authUrl}/token` for now.
+*/
+function isCrossSiteAppHost(host) {
+	return host.endsWith(".omgs.app");
+}
+function deriveTokenUrl(authUrl = DEFAULT_AUTH_URL) {
+	const injected = readInjectedTokenUrl();
+	if (injected) return injected;
+	if (typeof window !== "undefined" && isCrossSiteAppHost(window.location.host)) return new URL("/__omg/auth/token", window.location.origin).toString();
+	return `${authUrl}/token`;
+}
+function readInjectedAppId() {
+	if (typeof window === "undefined") return null;
+	const value = window.__VIBES_APP_ID;
+	return typeof value === "string" && /^[a-z0-9-]+$/.test(value) ? value : null;
+}
+function readInjectedTokenUrl() {
+	if (typeof window === "undefined") return null;
+	const value = window.__VIBES_AUTH_TOKEN_URL;
+	if (typeof value !== "string" || !value.trim()) return null;
+	try {
+		return new URL(value, window.location.origin).toString();
+	} catch {
+		return null;
+	}
+}
+/**
+* Same-origin session-read endpoint, injected by the vite-plugin in preview
+* (`{sandboxId}-5173.preview.omg.dev`). Present only there; null for deployed
+* apps and local dev.
+*/
+function readInjectedSessionUrl() {
+	if (typeof window === "undefined") return null;
+	const value = window.__VIBES_AUTH_SESSION_URL;
+	if (typeof value !== "string" || !value.trim()) return null;
+	try {
+		return new URL(value, window.location.origin).toString();
+	} catch {
+		return null;
+	}
+}
+function createVibesAuth(config) {
+	const authUrl = config.authUrl ?? DEFAULT_AUTH_URL;
+	const bridgeBase = typeof window !== "undefined" && isCrossSiteAppHost(window.location.host) ? `${window.location.origin}${AUTH_BRIDGE_PREFIX}` : null;
+	const baseURL = bridgeBase ?? authUrl;
+	const tokenUrl = config.tokenUrl ?? (bridgeBase ? `${bridgeBase}/token` : deriveTokenUrl(authUrl));
+	const sessionUrl = readInjectedSessionUrl();
+	const customFetchImpl = (input, init) => {
+		const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+		if (sessionUrl && url.includes("/api/auth/get-session")) {
+			const qs = url.includes("?") ? url.slice(url.indexOf("?")) : "";
+			return fetch(sessionUrl + qs, {
+				...init,
+				credentials: "include"
+			});
+		}
+		return fetch(input, init);
+	};
+	const authClient = createAuthClient({
+		baseURL,
+		...sessionUrl ? { fetchOptions: { customFetchImpl } } : {},
+		plugins: [
+			magicLinkClient(),
+			emailOTPClient(),
+			passkeyClient()
+		]
+	});
+	let cachedToken = null;
+	let tokenExp = 0;
+	async function getToken() {
+		if (cachedToken && Date.now() < tokenExp - 6e4) return cachedToken;
+		try {
+			const res = await fetch(tokenUrl, {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				credentials: "include",
+				body: JSON.stringify({ appId: config.appId })
+			});
+			if (!res.ok) {
+				cachedToken = null;
+				tokenExp = 0;
+				return null;
+			}
+			const data = await res.json();
+			cachedToken = data.token;
+			if (data.expiresAt) tokenExp = new Date(data.expiresAt).getTime();
+			else try {
+				tokenExp = (JSON.parse(atob(data.token.split(".")[1].replace(/-/g, "+").replace(/_/g, "/"))).exp ?? 0) * 1e3;
+			} catch {
+				tokenExp = Date.now() + 36e5;
+			}
+			return cachedToken;
+		} catch {
+			return null;
+		}
+	}
+	function clearToken() {
+		cachedToken = null;
+		tokenExp = 0;
+	}
+	return {
+		authClient,
+		appId: config.appId,
+		authUrl,
+		tokenUrl,
+		getToken,
+		clearToken
+	};
+}
+//#endregion
+//#region src/auth/mail-apps.ts
+const PROVIDERS = [
+	{
+		pattern: /^(gmail|googlemail)\./,
+		app: {
+			provider: "gmail",
+			label: "Open Gmail",
+			url: "https://mail.google.com/mail/u/0/"
+		}
+	},
+	{
+		pattern: /^(outlook|hotmail|live|msn)\./,
+		app: {
+			provider: "outlook",
+			label: "Open Outlook",
+			url: "https://outlook.live.com/mail/"
+		}
+	},
+	{
+		pattern: /^(yahoo|ymail|rocketmail)\./,
+		app: {
+			provider: "yahoo",
+			label: "Open Yahoo",
+			url: "https://mail.yahoo.com/"
+		}
+	},
+	{
+		pattern: /^(icloud|me|mac)\./,
+		app: {
+			provider: "icloud",
+			label: "Open iCloud Mail",
+			url: "https://www.icloud.com/mail/"
+		}
+	},
+	{
+		pattern: /^(proton|protonmail|pm)\./,
+		app: {
+			provider: "proton",
+			label: "Open Proton",
+			url: "https://mail.proton.me/"
+		}
+	}
+];
+/**
+* Returns the webmail app for the address's provider, or null for custom
+* domains (no reliable way to know where their mail is hosted).
+*/
+function mailAppForEmail(email) {
+	const domain = email.split("@")[1]?.toLowerCase().trim() ?? "";
+	if (!domain) return null;
+	for (const { pattern, app } of PROVIDERS) if (pattern.test(domain)) return app;
+	return null;
+}
+//#endregion
+//#region src/auth/login.tsx
+function Spinner({ className = "" }) {
+	return /* @__PURE__ */ jsxs("svg", {
+		className: `animate-spin ${className}`,
+		viewBox: "0 0 24 24",
+		fill: "none",
+		"aria-hidden": "true",
+		children: [/* @__PURE__ */ jsx("circle", {
+			className: "opacity-25",
+			cx: "12",
+			cy: "12",
+			r: "10",
+			stroke: "currentColor",
+			strokeWidth: "4"
+		}), /* @__PURE__ */ jsx("path", {
+			className: "opacity-75",
+			fill: "currentColor",
+			d: "M4 12a8 8 0 0 1 8-8v4a4 4 0 0 0-4 4H4z"
+		})]
+	});
+}
+const CODE_LENGTH = 6;
+function VibesLogin({ title = "Sign in", subtitle = "Sign in to continue." }) {
+	const { sendSignInCode, verifySignInCode, signInWithPasskey } = useAuth();
+	const [email, setEmail] = useState("");
+	const [stage, setStage] = useState("email");
+	const [code, setCode] = useState("");
+	const [error, setError] = useState(null);
+	const [pending, setPending] = useState(null);
+	const busy = pending !== null;
+	const verifyingRef = useRef(false);
+	const mailApp = mailAppForEmail(email);
+	async function onSendCode(e) {
+		e.preventDefault();
+		if (!email.trim() || busy) return;
+		setPending("send");
+		setError(null);
+		try {
+			await sendSignInCode(email.trim());
+			setCode("");
+			setStage("code");
+		} catch (err) {
+			setError(err instanceof Error ? err.message : "Failed to send code");
+		} finally {
+			setPending(null);
+		}
+	}
+	async function verify(next) {
+		if (verifyingRef.current) return;
+		verifyingRef.current = true;
+		setPending("verify");
+		setError(null);
+		try {
+			await verifySignInCode(email.trim(), next);
+		} catch (err) {
+			setError(err instanceof Error ? err.message : "Invalid code");
+			setCode("");
+		} finally {
+			verifyingRef.current = false;
+			setPending(null);
+		}
+	}
+	function onCodeChange(raw) {
+		const digits = raw.replace(/\D/g, "").slice(0, CODE_LENGTH);
+		setCode(digits);
+		if (digits.length === CODE_LENGTH && !busy) verify(digits);
+	}
+	async function onResend() {
+		if (busy) return;
+		setPending("send");
+		setError(null);
+		try {
+			await sendSignInCode(email.trim());
+			setCode("");
+		} catch (err) {
+			setError(err instanceof Error ? err.message : "Failed to send code");
+		} finally {
+			setPending(null);
+		}
+	}
+	async function onPasskey() {
+		if (busy) return;
+		setPending("passkey");
+		setError(null);
+		try {
+			await signInWithPasskey();
+		} catch (err) {
+			setError(err instanceof Error ? err.message : "Passkey sign-in failed");
+		} finally {
+			setPending(null);
+		}
+	}
+	return /* @__PURE__ */ jsx("div", {
+		className: "flex min-h-[60vh] w-full items-center justify-center p-6",
+		children: /* @__PURE__ */ jsxs("div", {
+			className: "w-full max-w-sm space-y-6 rounded-2xl border bg-card p-6 text-card-foreground shadow-sm",
+			children: [
+				/* @__PURE__ */ jsxs("div", {
+					className: "space-y-1.5",
+					children: [/* @__PURE__ */ jsx("h2", {
+						className: "text-lg font-semibold tracking-tight",
+						children: title
+					}), stage === "code" ? /* @__PURE__ */ jsxs("p", {
+						className: "text-sm text-muted-foreground",
+						children: [
+							"Enter the code sent to",
+							" ",
+							/* @__PURE__ */ jsx("span", {
+								className: "font-medium text-foreground",
+								children: email.trim()
+							}),
+							"."
+						]
+					}) : subtitle ? /* @__PURE__ */ jsx("p", {
+						className: "text-sm text-muted-foreground",
+						children: subtitle
+					}) : null]
+				}),
+				stage === "code" ? /* @__PURE__ */ jsxs("div", {
+					className: "space-y-3",
+					children: [
+						/* @__PURE__ */ jsxs("form", {
+							onSubmit: (e) => {
+								e.preventDefault();
+								if (code.length === CODE_LENGTH && !busy) verify(code);
+							},
+							className: "space-y-3",
+							children: [/* @__PURE__ */ jsx("input", {
+								type: "text",
+								inputMode: "numeric",
+								autoComplete: "one-time-code",
+								pattern: "[0-9]*",
+								maxLength: CODE_LENGTH,
+								placeholder: "000000",
+								value: code,
+								onChange: (e) => onCodeChange(e.target.value),
+								disabled: busy,
+								autoFocus: true,
+								"aria-label": "Sign-in code",
+								className: "flex h-12 w-full rounded-md border bg-background px-3 py-2 text-center font-mono text-xl tracking-[0.5em] shadow-sm placeholder:text-muted-foreground/40 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50"
+							}), /* @__PURE__ */ jsx("button", {
+								type: "submit",
+								disabled: busy || code.length !== CODE_LENGTH,
+								className: "inline-flex h-10 w-full items-center justify-center gap-2 rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50",
+								children: pending === "verify" ? /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(Spinner, { className: "h-4 w-4" }), "Signing in…"] }) : "Sign in"
+							})]
+						}),
+						mailApp ? /* @__PURE__ */ jsx("a", {
+							href: mailApp.url,
+							target: "_blank",
+							rel: "noreferrer",
+							className: "inline-flex h-10 w-full items-center justify-center gap-2 rounded-md border bg-background px-4 py-2 text-sm font-medium shadow-sm transition-colors hover:bg-accent hover:text-accent-foreground",
+							children: mailApp.label
+						}) : null,
+						/* @__PURE__ */ jsxs("div", {
+							className: "flex items-center justify-between text-xs text-muted-foreground",
+							children: [/* @__PURE__ */ jsx("button", {
+								type: "button",
+								onClick: onResend,
+								disabled: busy,
+								className: "transition-colors hover:text-foreground disabled:opacity-50",
+								children: pending === "send" ? "Sending…" : "Resend code"
+							}), /* @__PURE__ */ jsx("button", {
+								type: "button",
+								onClick: () => {
+									setStage("email");
+									setCode("");
+									setError(null);
+								},
+								disabled: busy,
+								className: "transition-colors hover:text-foreground disabled:opacity-50",
+								children: "Change email"
+							})]
+						})
+					]
+				}) : /* @__PURE__ */ jsxs("form", {
+					onSubmit: onSendCode,
+					className: "space-y-3",
+					children: [/* @__PURE__ */ jsx("input", {
+						type: "email",
+						required: true,
+						placeholder: "you@example.com",
+						value: email,
+						onChange: (e) => setEmail(e.target.value),
+						disabled: busy,
+						className: "flex h-10 w-full rounded-md border bg-background px-3 py-2 text-sm shadow-sm placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50"
+					}), /* @__PURE__ */ jsx("button", {
+						type: "submit",
+						disabled: busy,
+						className: "inline-flex h-10 w-full items-center justify-center gap-2 rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50",
+						children: pending === "send" ? /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(Spinner, { className: "h-4 w-4" }), "Sending…"] }) : "Send code"
+					})]
+				}),
+				stage === "email" ? /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsxs("div", {
+					className: "flex items-center gap-3 text-xs text-muted-foreground",
+					children: [
+						/* @__PURE__ */ jsx("div", { className: "h-px flex-1 bg-border" }),
+						"or",
+						/* @__PURE__ */ jsx("div", { className: "h-px flex-1 bg-border" })
+					]
+				}), /* @__PURE__ */ jsx("button", {
+					type: "button",
+					onClick: onPasskey,
+					disabled: busy,
+					className: "inline-flex h-10 w-full items-center justify-center gap-2 rounded-md border bg-background px-4 py-2 text-sm font-medium shadow-sm transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50",
+					children: pending === "passkey" ? /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx(Spinner, { className: "h-4 w-4" }), "Signing in…"] }) : "Sign in with passkey"
+				})] }) : null,
+				error ? /* @__PURE__ */ jsx("div", {
+					className: "text-sm text-destructive",
+					children: error
+				}) : null
+			]
+		})
+	});
+}
+//#endregion
+//#region src/auth/auto-prompt.tsx
+function VibesAuthAutoPrompt() {
+	const user = useUser();
+	const [open, setOpen] = useState(false);
+	useEffect(() => subscribeAuthRequired(() => setOpen(true)), []);
+	useEffect(() => {
+		if (user) setOpen(false);
+	}, [user]);
+	if (!open || user) return null;
+	return /* @__PURE__ */ jsx("div", {
+		role: "dialog",
+		"aria-modal": "true",
+		onClick: (e) => {
+			if (e.target === e.currentTarget) setOpen(false);
+		},
+		style: {
+			position: "fixed",
+			inset: 0,
+			zIndex: 2147483e3,
+			display: "flex",
+			alignItems: "center",
+			justifyContent: "center",
+			background: "rgba(0,0,0,0.5)",
+			backdropFilter: "blur(2px)"
+		},
+		children: /* @__PURE__ */ jsx(VibesLogin, { subtitle: "Sign in to continue." })
+	});
+}
+//#endregion
+//#region src/auth/react.tsx
+const VibesAuthContext = createContext(null);
+function VibesAuthProvider({ client: providedClient, appId, authUrl, autoPrompt = true, children }) {
+	const client = useMemo(() => {
+		if (providedClient) return providedClient;
+		return createVibesAuth({
+			appId: appId ?? deriveAppId() ?? "local",
+			authUrl
+		});
+	}, [
+		providedClient,
+		appId,
+		authUrl
+	]);
+	const { data: session, isPending } = client.authClient.useSession();
+	const [token, setToken] = useState(null);
+	const [authReady, setAuthReady] = useState(false);
+	useEffect(() => {
+		if (isPending) return;
+		if (!session?.user) {
+			setToken(null);
+			client.clearToken();
+			setAuthReady(true);
+			return;
+		}
+		let cancelled = false;
+		client.getToken().then((t) => {
+			if (cancelled) return;
+			setToken(t);
+			setAuthReady(true);
+		});
+		return () => {
+			cancelled = true;
+		};
+	}, [
+		isPending,
+		session?.user?.id,
+		client
+	]);
+	useEffect(() => {
+		setAuthContext({
+			user: session?.user ? {
+				id: session.user.id,
+				email: session.user.email,
+				name: session.user.name ?? void 0
+			} : null,
+			token,
+			authReady
+		});
+	}, [
+		session?.user?.id,
+		session?.user?.email,
+		session?.user?.name,
+		token,
+		authReady
+	]);
+	const signOut = useCallback(async () => {
+		await client.authClient.signOut();
+		client.clearToken();
+		setToken(null);
+	}, [client]);
+	const refreshToken = useCallback(async () => {
+		const t = await client.getToken();
+		setToken(t);
+		return t;
+	}, [client]);
+	const user = session?.user ? {
+		id: session.user.id,
+		email: session.user.email,
+		name: session.user.name ?? void 0
+	} : null;
+	const value = useMemo(() => ({
+		user,
+		loading: isPending,
+		token,
+		signOut,
+		refreshToken,
+		client
+	}), [
+		user?.id,
+		isPending,
+		token,
+		signOut,
+		refreshToken,
+		client
+	]);
+	return /* @__PURE__ */ jsxs(VibesAuthContext.Provider, {
+		value,
+		children: [children, autoPrompt ? /* @__PURE__ */ jsx(VibesAuthAutoPrompt, {}) : null]
+	});
+}
+function useVibesAuth() {
+	const ctx = useContext(VibesAuthContext);
+	if (!ctx) throw new Error("useVibesAuth must be used within <VibesAuthProvider>");
+	return ctx;
+}
+/**
+* Hook that returns just the JWT token, refreshing it if needed.
+* Useful for passing to fetch calls.
+*/
+function useVibesToken() {
+	const { token } = useVibesAuth();
+	return token;
+}
+function useUser() {
+	return useVibesAuth().user;
+}
+function useAuth() {
+	const { user, loading, token, signOut, client } = useVibesAuth();
+	return {
+		user,
+		loading,
+		token,
+		signOut,
+		signInWithMagicLink: useCallback(async (email, callbackURL) => {
+			const cb = callbackURL ?? (typeof window !== "undefined" ? window.location.href : void 0);
+			await fetch(`${client.authUrl}/api/auth/sign-in/magic-link`, {
+				method: "POST",
+				credentials: "include",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					email,
+					callbackURL: cb
+				})
+			});
+		}, [client]),
+		sendSignInCode: useCallback(async (email) => {
+			const c = client.authClient;
+			if (typeof c.emailOtp?.sendVerificationOtp !== "function") throw new Error("Email OTP plugin not loaded");
+			const res = await c.emailOtp.sendVerificationOtp({
+				email,
+				type: "sign-in"
+			});
+			if (res.error) throw new Error(res.error.message ?? "Failed to send code");
+		}, [client]),
+		verifySignInCode: useCallback(async (email, code) => {
+			const c = client.authClient;
+			if (typeof c.signIn?.emailOtp !== "function") throw new Error("Email OTP plugin not loaded");
+			const res = await c.signIn.emailOtp({
+				email,
+				otp: code
+			});
+			if (res.error) {
+				const code_ = res.error.code;
+				if (code_ === "OTP_EXPIRED") throw new Error("That code expired — request a new one.");
+				if (code_ === "TOO_MANY_ATTEMPTS") throw new Error("Too many attempts — request a new code.");
+				throw new Error(res.error.message ?? "Invalid code");
+			}
+		}, [client]),
+		signInWithPasskey: useCallback(async () => {
+			const c = client.authClient;
+			if (typeof c.signIn?.passkey === "function") await c.signIn.passkey();
+			else throw new Error("Passkey plugin not loaded");
+		}, [client])
+	};
+}
+//#endregion
+//#region src/auth/fetch.ts
+/**
+* Creates a fetch wrapper that automatically attaches the JWT Bearer token.
+* If no token is available (user not signed in), falls through without auth header.
+*/
+function vibesFetch(client) {
+	return async function(input, init) {
+		const token = await client.getToken();
+		const headers = new Headers(init?.headers);
+		if (token) headers.set("Authorization", `Bearer ${token}`);
+		return fetch(input, {
+			...init,
+			headers
+		});
+	};
+}
+//#endregion
+//#region src/auth/guard.tsx
+function VibesAuthGuard({ children, fallback, loadingFallback }) {
+	const { loading } = useVibesAuth();
+	const user = useUser();
+	if (loading) return /* @__PURE__ */ jsx(Fragment, { children: loadingFallback ?? null });
+	if (!user) return /* @__PURE__ */ jsx(Fragment, { children: fallback ?? /* @__PURE__ */ jsx(VibesLogin, {}) });
+	return /* @__PURE__ */ jsx(Fragment, { children });
+}
+//#endregion
+//#region src/storage/VibesUpload.tsx
+function defaultKeyFor(file) {
+	const safe = file.name.replace(/[^a-zA-Z0-9._-]/g, "-");
+	return `uploads/${typeof crypto !== "undefined" && "randomUUID" in crypto ? crypto.randomUUID() : Math.random().toString(36).slice(2)}-${safe}`;
+}
+/**
+* Drop-zone + file picker. Calls onUploaded with the stored key + signed
+* download URL on success. Renders nothing during prerender (SSR) — the
+* hook depends on browser-only APIs (XHR, FormData).
+*/
+function VibesUpload(props) {
+	const { upload, uploading, progress, error } = useUpload();
+	const [dragOver, setDragOver] = useState(false);
+	const inputRef = useRef(null);
+	const inputId = useId();
+	const handleFiles = useCallback(async (files) => {
+		const list = Array.from(files);
+		for (const file of list) {
+			const opts = {
+				key: (props.keyFor ?? defaultKeyFor)(file),
+				contentType: file.type || "application/octet-stream",
+				scope: props.scope ?? "user",
+				presignUrl: props.presignUrl
+			};
+			try {
+				const result = await upload(file, opts);
+				props.onUploaded?.(result, file);
+			} catch (err) {
+				props.onError?.(err);
+			}
+		}
+	}, [props, upload]);
+	const onChange = useCallback((e) => {
+		if (e.target.files && e.target.files.length > 0) {
+			handleFiles(e.target.files);
+			e.target.value = "";
+		}
+	}, [handleFiles]);
+	const onDrop = useCallback((e) => {
+		e.preventDefault();
+		setDragOver(false);
+		if (e.dataTransfer.files && e.dataTransfer.files.length > 0) handleFiles(e.dataTransfer.files);
+	}, [handleFiles]);
+	const onDragOver = useCallback((e) => {
+		e.preventDefault();
+		if (!dragOver) setDragOver(true);
+	}, [dragOver]);
+	const onDragLeave = useCallback(() => setDragOver(false), []);
+	return /* @__PURE__ */ jsxs("label", {
+		htmlFor: inputId,
+		style: {
+			border: `1px dashed ${dragOver ? "#2563eb" : "rgba(0,0,0,0.18)"}`,
+			background: dragOver ? "rgba(37, 99, 235, 0.05)" : "transparent",
+			borderRadius: 10,
+			padding: "16px 18px",
+			display: "flex",
+			flexDirection: "column",
+			gap: 6,
+			alignItems: "center",
+			justifyContent: "center",
+			cursor: props.disabled ? "not-allowed" : "pointer",
+			opacity: props.disabled ? .5 : 1,
+			fontSize: 14,
+			color: "rgba(0,0,0,0.7)",
+			minHeight: 88,
+			userSelect: "none",
+			transition: "border-color 80ms ease, background 80ms ease",
+			...props.style
+		},
+		className: props.className,
+		onDrop,
+		onDragOver,
+		onDragLeave,
+		"data-uploading": uploading || void 0,
+		children: [/* @__PURE__ */ jsx("input", {
+			ref: inputRef,
+			id: inputId,
+			type: "file",
+			accept: props.accept,
+			onChange,
+			disabled: props.disabled || uploading,
+			style: { display: "none" }
+		}), uploading ? /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx("span", { children: "Uploading…" }), /* @__PURE__ */ jsxs("span", {
+			style: {
+				fontSize: 12,
+				opacity: .6
+			},
+			children: [Math.round(progress * 100), "%"]
+		})] }) : error ? /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx("span", {
+			style: { color: "#dc2626" },
+			children: "Upload failed"
+		}), /* @__PURE__ */ jsx("span", {
+			style: {
+				fontSize: 12,
+				opacity: .7
+			},
+			children: error
+		})] }) : /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx("span", { children: props.label ?? "Drop file or click to upload" }), /* @__PURE__ */ jsxs("span", {
+			style: {
+				fontSize: 12,
+				opacity: .55
+			},
+			children: [props.accept ?? "any file", " · up to 25MB"]
+		})] })]
+	});
+}
+//#endregion
+//#region src/notifications/index.tsx
+function authHeaders$1(extra) {
+	const h = new Headers(extra);
+	const { token } = getAuthContext();
+	if (token) h.set("Authorization", `Bearer ${token}`);
+	return h;
+}
+async function notificationFetch(input, init) {
+	const res = await fetch(input, {
+		...init,
+		headers: authHeaders$1(init?.headers)
+	});
+	if (res.status === 401) {
+		if (getAuthContext().authReady) notifyAuthRequired();
+		throw new Error("Authentication required");
+	}
+	if (!res.ok) {
+		let msg = `request failed (${res.status})`;
+		try {
+			const body = await res.clone().json();
+			if (body && typeof body.error === "string") msg = body.error;
+		} catch {}
+		throw new Error(msg);
+	}
+	return res;
+}
+function base64UrlToUint8Array(value) {
+	const base64 = `${value}${"=".repeat((4 - value.length % 4) % 4)}`.replace(/-/g, "+").replace(/_/g, "/");
+	const raw = atob(base64);
+	const out = new Uint8Array(raw.length);
+	for (let i = 0; i < raw.length; i++) out[i] = raw.charCodeAt(i);
+	return out;
+}
+function notificationSupport() {
+	if (typeof window === "undefined" || typeof navigator === "undefined") return {
+		supported: false,
+		permission: "default"
+	};
+	const supported = "Notification" in window && "serviceWorker" in navigator && "PushManager" in window;
+	return {
+		supported,
+		permission: supported ? Notification.permission : "default"
+	};
+}
+function useNotificationPermission() {
+	const initial = notificationSupport();
+	const [permission, setPermission] = useState(initial.permission);
+	const [busy, setBusy] = useState(false);
+	const supported = initial.supported;
+	return {
+		supported,
+		permission,
+		busy,
+		enablePush: useCallback(async () => {
+			if (!supported) return false;
+			setBusy(true);
+			try {
+				const config = await (await notificationFetch("/api/_notifications/config")).json();
+				if (!config.vapidPublicKey) return false;
+				const nextPermission = Notification.permission === "default" ? await Notification.requestPermission() : Notification.permission;
+				setPermission(nextPermission);
+				if (nextPermission !== "granted") return false;
+				const registration = await navigator.serviceWorker.register("/__vibes_push/sw.js", { scope: "/__vibes_push/" });
+				const subscription = await registration.pushManager.getSubscription() ?? await registration.pushManager.subscribe({
+					userVisibleOnly: true,
+					applicationServerKey: base64UrlToUint8Array(config.vapidPublicKey)
+				});
+				await notificationFetch("/api/_notifications/subscribe", {
+					method: "POST",
+					headers: { "content-type": "application/json" },
+					body: JSON.stringify({ subscription: subscription.toJSON() })
+				});
+				return true;
+			} finally {
+				setBusy(false);
+			}
+		}, [supported])
+	};
+}
+function useNotifications(options) {
+	const where = useMemo(() => {
+		if (!options?.unreadOnly) return void 0;
+		return {
+			op: "eq",
+			column: "status",
+			value: "unread"
+		};
+	}, [options?.unreadOnly]);
+	const query = useQuery({
+		collection: "vibesNotifications",
+		api: options?.unreadOnly ? "/api/_notifications/list?unread=1" : "/api/_notifications/list",
+		where
+	});
+	const notifications = useMemo(() => [...query.data].sort((a, b) => b.createdAt - a.createdAt), [query.data]);
+	const unreadCount = useMemo(() => notifications.reduce((n, item) => n + (item.status === "unread" ? 1 : 0), 0), [notifications]);
+	const markRead = useCallback(async (ids) => {
+		if (ids.length === 0) return;
+		await notificationFetch("/api/_notifications/read", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ ids })
+		});
+		query.refresh();
+	}, [query]);
+	const markAllRead = useCallback(async () => {
+		await notificationFetch("/api/_notifications/read", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ all: true })
+		});
+		query.refresh();
+	}, [query]);
+	return {
+		...query,
+		notifications,
+		unreadCount,
+		markRead,
+		markAllRead
+	};
+}
+async function createNotification(input) {
+	return (await notificationFetch("/api/_notifications/create", {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(input)
+	})).json();
+}
+//#endregion
+//#region src/sandbox.ts
+const runtimeClaims = {
+	llmInvoke: "llm.invoke",
+	mediaInvoke: "media.invoke",
+	browserUse: "browser.use",
+	sandboxCreate: "sandbox.create",
+	sandboxDelegate: "sandbox.delegate"
+};
+function defaultSandboxRouterBase() {
+	const envBase = typeof process !== "undefined" ? process.env?.VIBES_SANDBOX_ROUTER_URL || process.env?.VIBES_AGENT_URL : void 0;
+	if (envBase) return envBase.replace(/\/$/, "");
+	if (typeof window !== "undefined") throw new Error("sandbox SDK calls must run in a server function inside a Vibes sandbox");
+	return "http://localhost:8080/_sandbox";
+}
+async function postSandboxRouter(path, body, opts = {}) {
+	const res = await (opts.fetch ?? fetch)(`${(opts.routerBase ?? defaultSandboxRouterBase()).replace(/\/$/, "")}${path}`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(body ?? {})
+	});
+	if (!res.ok) {
+		let message = `sandbox router ${res.status}`;
+		try {
+			const parsed = await res.clone().json();
+			if (parsed && typeof parsed.error === "string") message = parsed.error;
+		} catch {
+			const text = await res.text().catch(() => "");
+			if (text) message = text;
+		}
+		throw new Error(message);
+	}
+	return res.json();
+}
+function createSandbox(options = {}, routerOptions) {
+	return postSandboxRouter("/create", options, routerOptions);
+}
+function forkSandbox(options, routerOptions) {
+	if (!options?.snapshotId) throw new Error("forkSandbox requires snapshotId");
+	return postSandboxRouter("/fork", options, routerOptions);
+}
+//#endregion
+//#region src/index.ts
+function authHeaders(extra) {
+	const h = new Headers(extra);
+	const { token } = getAuthContext();
+	if (token) h.set("Authorization", `Bearer ${token}`);
+	return h;
+}
+/**
+* Thrown when a request comes back with the server's auth-required signal
+* (HTTP 401). Callers that don't catch it still won't get garbage data — the
+* old paths swallowed 401 bodies and returned them as if they were rows.
+*/
+var VibesAuthRequiredError = class extends Error {
+	constructor(message = "Authentication required") {
+		super(message);
+		this.name = "VibesAuthRequiredError";
+	}
+};
+async function apiFetch(input, init) {
+	const res = await fetch(input, {
+		...init,
+		headers: authHeaders(init?.headers)
+	});
+	if (res.status === 401) {
+		if (getAuthContext().authReady) notifyAuthRequired();
+		let message = "Authentication required";
+		try {
+			const body = await res.clone().json();
+			if (body && typeof body.error === "string") message = body.error;
+		} catch {}
+		throw new VibesAuthRequiredError(message);
+	}
+	return res;
+}
+function useQuery(opts) {
+	const optsRef = useRef(opts);
+	optsRef.current = opts;
+	const url = defaultSubscribeUrl();
+	const collectionKey = opts.collection;
+	const store = useMemo(() => getCollectionQueryStore(url, opts.collection, opts.where), [
+		url,
+		collectionKey,
+		canonicalPredicateString(opts.where)
+	]);
+	const snapshot = useSyncExternalStore((listener) => store.subscribe(listener), () => store.getSnapshot(), () => store.getSnapshot());
+	useEffect(() => {
+		const api = optsRef.current.api;
+		if (snapshot.status === "unavailable" && api) store.ensureLegacyFallback(api);
+	}, [snapshot.status, store]);
+	const refresh = useCallback(() => {
+		const api = optsRef.current.api;
+		if (!api) return;
+		store.refreshFromApi(api);
+	}, [store]);
+	const create = useCallback(async (item) => {
+		const api = optsRef.current.api;
+		if (!api) throw new Error("useQuery: `api` is required to call create()");
+		return (await apiFetch(api, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(item)
+		})).json();
+	}, []);
+	const update = useCallback(async (id, patch) => {
+		const api = optsRef.current.api;
+		if (!api) throw new Error("useQuery: `api` is required to call update()");
+		return (await apiFetch(`${api}/${id}`, {
+			method: "PATCH",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(patch)
+		})).json();
+	}, []);
+	const remove = useCallback(async (id) => {
+		const api = optsRef.current.api;
+		if (!api) throw new Error("useQuery: `api` is required to call remove()");
+		await apiFetch(`${api}/${id}`, { method: "DELETE" });
+	}, []);
+	return {
+		data: snapshot.data,
+		loading: snapshot.loading,
+		error: snapshot.error,
+		status: snapshot.status,
+		create,
+		update,
+		remove,
+		refresh
+	};
+}
+/**
+* @deprecated Use {@link useQuery} instead — it's the WS-first default and adds
+* server-side `where` predicate scoping. This wrapper forwards to `useQuery`
+* (full collection, no predicate) and remains only for back-compat.
+*/
+function useCollection(opts) {
+	return useQuery({
+		collection: opts.collection,
+		api: opts.api
+	});
+}
+/**
+* Best-effort client-side evaluation of a SubscribePredicate, used only by the
+* legacy SSE+REST fallback to scope the REST result the way the WS snapshot
+* would. The WS path is authoritative; this mirrors the common cases (SQL
+* three-valued-logic edge cases around NULL are not reproduced exactly).
+*/
+function matchesPredicate(row, p) {
+	switch (p.op) {
+		case "and": return p.clauses.every((c) => matchesPredicate(row, c));
+		case "or": return p.clauses.some((c) => matchesPredicate(row, c));
+		case "not": return !matchesPredicate(row, p.clause);
+		case "eq": return row[p.column] === p.value;
+		case "ne": return row[p.column] !== p.value;
+		case "gt": return row[p.column] > p.value;
+		case "gte": return row[p.column] >= p.value;
+		case "lt": return row[p.column] < p.value;
+		case "lte": return row[p.column] <= p.value;
+		case "in": return p.values.includes(row[p.column]);
+		case "like": {
+			const v = row[p.column];
+			if (typeof v !== "string") return false;
+			return new RegExp("^" + p.pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/%/g, ".*").replace(/_/g, ".") + "$", "i").test(v);
+		}
+		case "isNull": return row[p.column] == null;
+		case "isNotNull": return row[p.column] != null;
+		default: return true;
+	}
+}
+/**
+* Legacy SSE + REST refetch loop. Used only as fallback when the WS
+* subscription path (subscribeCollection) gives up — typically on an old
+* deploy that doesn't serve /__vibes_sub. Same shape as the pre-Phase-1
+* useCollection internals so behavior on older backends is unchanged.
+*
+* Returns an AbortController whose abort() tears the SSE stream down.
+*/
+function startLegacySseRefetch(optsRef, refresh, setError) {
+	const evtUrl = `${typeof window !== "undefined" ? window.location.origin : ""}/__vibes_events`;
+	const RECONNECT_BASE_MS = 1e3;
+	const RECONNECT_CAP_MS = 6e4;
+	const RECONNECT_GIVE_UP = 6;
+	const REFRESH_THROTTLE_MS = 2e3;
+	const ctl = new AbortController();
+	let consecutiveErrors = 0;
+	let lastRefresh = 0;
+	function throttledRefresh() {
+		const now = Date.now();
+		if (now - lastRefresh < REFRESH_THROTTLE_MS) return;
+		lastRefresh = now;
+		refresh();
+	}
+	class FatalError extends Error {}
+	let isFirstOpen = true;
+	refresh();
+	fetchEventSource(evtUrl, {
+		signal: ctl.signal,
+		async onopen(res) {
+			if (res.ok && res.headers.get("content-type")?.includes("text/event-stream")) {
+				consecutiveErrors = 0;
+				if (!isFirstOpen) throttledRefresh();
+				isFirstOpen = false;
+				return;
+			}
+			if (res.status === 401 || res.status === 403 || res.status === 400) {
+				if (res.status === 401 && getAuthContext().authReady) notifyAuthRequired();
+				throw new FatalError(`fatal ${res.status}`);
+			}
+			throw new Error(`unexpected ${res.status}`);
+		},
+		onmessage(ev) {
+			if (!ev.data) return;
+			try {
+				const event = JSON.parse(ev.data);
+				if (event.type === "invalidate" && event.collection === optsRef.current.collection) throttledRefresh();
+			} catch {}
+		},
+		onclose() {
+			throw new Error("connection closed");
+		},
+		onerror(err) {
+			if (err instanceof FatalError) throw err;
+			consecutiveErrors++;
+			if (consecutiveErrors >= RECONNECT_GIVE_UP) {
+				setError("realtime stream unavailable — falling back to manual refresh");
+				throw new FatalError("give up after consecutive errors");
+			}
+			return Math.min(RECONNECT_CAP_MS, RECONNECT_BASE_MS * Math.pow(2, consecutiveErrors - 1));
+		}
+	}).catch(() => {});
+	return ctl;
+}
+function defaultSubscribeUrl() {
+	if (typeof window === "undefined") return "";
+	return `${window.location.protocol === "https:" ? "wss:" : "ws:"}//${window.location.host}/__vibes_sub`;
+}
+function makeSubId() {
+	return typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID() : `s${Date.now()}-${Math.random().toString(36).slice(2)}`;
+}
+function protocolsForAuth(token) {
+	return token ? [`vibes-bearer.${token}`] : void 0;
+}
+const RECONNECT_BASE_MS = 1e3;
+const RECONNECT_CAP_MS = 6e4;
+const RECONNECT_GIVE_UP = 6;
+function canonicalJson(value) {
+	return JSON.stringify(canonicalizeValue(value));
+}
+function canonicalizeValue(value) {
+	if (value === null) return null;
+	if (Array.isArray(value)) return value.map(canonicalizeValue);
+	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return value;
+	if (typeof value !== "object") return null;
+	const out = {};
+	for (const key of Object.keys(value).sort()) out[key] = canonicalizeValue(value[key]);
+	return out;
+}
+function normalizePredicate(predicate) {
+	if (!predicate) return void 0;
+	switch (predicate.op) {
+		case "and":
+		case "or": {
+			const clauses = predicate.clauses.map((clause) => normalizePredicate(clause)).sort((a, b) => canonicalJson(a).localeCompare(canonicalJson(b)));
+			return {
+				op: predicate.op,
+				clauses
+			};
+		}
+		case "not": return {
+			op: "not",
+			clause: normalizePredicate(predicate.clause)
+		};
+		case "in": return {
+			...predicate,
+			values: [...predicate.values].sort((a, b) => canonicalJson(a).localeCompare(canonicalJson(b)))
+		};
+		default: return { ...predicate };
+	}
+}
+function canonicalPredicateString(predicate) {
+	return canonicalJson(normalizePredicate(predicate) ?? null);
+}
+function rowOrderValue(row) {
+	const createdAt = row.createdAt ?? row.created_at;
+	if (typeof createdAt === "string" || typeof createdAt === "number") return createdAt;
+	const updatedAt = row.updatedAt ?? row.updated_at;
+	if (typeof updatedAt === "string" || typeof updatedAt === "number") return updatedAt;
+	return null;
+}
+function compareRows(a, b) {
+	const av = rowOrderValue(a);
+	const bv = rowOrderValue(b);
+	if (av !== null && bv !== null && av !== bv) return av > bv ? -1 : 1;
+	if (av !== null && bv === null) return -1;
+	if (av === null && bv !== null) return 1;
+	return b.id.localeCompare(a.id);
+}
+function orderedRows(rows) {
+	return Array.from(rows).sort((a, b) => compareRows(a, b));
+}
+var SharedCollectionSocket = class {
+	constructor(url, token) {
+		this.url = url;
+		this.token = token;
+		this.ws = null;
+		this.connecting = false;
+		this.closedByManager = false;
+		this.consecutiveErrors = 0;
+		this.reconnectTimer = null;
+		this.flushQueued = false;
+		this.subs = /* @__PURE__ */ new Map();
+		this.pendingSubIds = /* @__PURE__ */ new Set();
+	}
+	add(sub) {
+		this.subs.set(sub.subId, sub);
+		this.pendingSubIds.add(sub.subId);
+		if (this.isOpen()) this.queueFlush();
+		else this.connect();
+	}
+	remove(subId) {
+		const existed = this.subs.delete(subId);
+		this.pendingSubIds.delete(subId);
+		if (existed && this.isOpen()) this.sendFrame({
+			op: "unsub",
+			subId
+		});
+		if (this.subs.size === 0) this.shutdown();
+	}
+	isIdle() {
+		return this.subs.size === 0;
+	}
+	shutdown() {
+		if (this.reconnectTimer) {
+			clearTimeout(this.reconnectTimer);
+			this.reconnectTimer = null;
+		}
+		this.pendingSubIds.clear();
+		this.closedByManager = true;
+		try {
+			this.ws?.close();
+		} catch {}
+		this.ws = null;
+		this.connecting = false;
+		this.consecutiveErrors = 0;
+	}
+	connect() {
+		if (this.connecting || this.isOpen() || this.subs.size === 0) return;
+		this.connecting = true;
+		this.closedByManager = false;
+		const protocols = protocolsForAuth(this.token);
+		try {
+			this.ws = protocols ? new WebSocket(this.url, protocols) : new WebSocket(this.url);
+		} catch (err) {
+			this.connecting = false;
+			this.broadcastError("ws_construct_failed", err.message);
+			this.scheduleReconnect();
+			return;
+		}
+		this.ws.addEventListener("open", () => {
+			this.connecting = false;
+			this.consecutiveErrors = 0;
+			this.broadcastStatus("live");
+			for (const subId of this.subs.keys()) this.pendingSubIds.add(subId);
+			this.queueFlush();
+		});
+		this.ws.addEventListener("message", (ev) => {
+			this.handleMessage(ev.data);
+		});
+		this.ws.addEventListener("close", () => {
+			this.ws = null;
+			this.connecting = false;
+			if (this.closedByManager || this.subs.size === 0) return;
+			this.broadcastStatus("reconnecting");
+			this.scheduleReconnect();
+		});
+		this.ws.addEventListener("error", () => {});
+	}
+	queueFlush() {
+		if (this.flushQueued) return;
+		this.flushQueued = true;
+		queueMicrotask(() => {
+			this.flushQueued = false;
+			this.flushPendingSubs();
+		});
+	}
+	flushPendingSubs() {
+		if (!this.isOpen()) return;
+		const ids = Array.from(this.pendingSubIds);
+		this.pendingSubIds.clear();
+		for (const subId of ids) {
+			const sub = this.subs.get(subId);
+			if (!sub) continue;
+			const frame = {
+				op: "sub",
+				subId,
+				collection: sub.collection
+			};
+			if (sub.where !== void 0) frame.where = sub.where;
+			if (sub.lastSeq !== null) frame.resumeFromSeq = sub.lastSeq;
+			this.sendFrame(frame);
+		}
+	}
+	handleMessage(data) {
+		let frame;
+		try {
+			frame = JSON.parse(data);
+		} catch {
+			this.broadcastError("bad_frame", "non-JSON frame from server");
+			return;
+		}
+		if (!frame.subId) {
+			if (frame.type === "error") this.broadcastError(frame.code ?? "unknown", frame.message ?? "");
+			return;
+		}
+		const sub = this.subs.get(frame.subId);
+		if (!sub) return;
+		if (frame.type === "snapshot") {
+			sub.state.clear();
+			for (const row of frame.rows ?? []) if (row && typeof row.id === "string") sub.state.set(row.id, row);
+			if (typeof frame.seq === "number") sub.lastSeq = frame.seq;
+			if (typeof frame.seq === "number") sub.onSeq?.(frame.seq);
+			this.publish(sub);
+			return;
+		}
+		if (frame.type === "delta") {
+			if (frame.op === "insert" || frame.op === "update") {
+				const row = frame.row;
+				if (!row || typeof row.id !== "string") {
+					sub.onError?.("bad_delta", "delta missing row.id");
+					return;
+				}
+				sub.state.set(row.id, row);
+				if (typeof frame.seq === "number") sub.lastSeq = frame.seq;
+				if (typeof frame.seq === "number") sub.onSeq?.(frame.seq);
+				this.publish(sub);
+				return;
+			}
+			if (frame.op === "delete") {
+				if (typeof frame.id !== "string") {
+					sub.onError?.("bad_delta", "delete delta missing id");
+					return;
+				}
+				sub.state.delete(frame.id);
+				if (typeof frame.seq === "number") sub.lastSeq = frame.seq;
+				if (typeof frame.seq === "number") sub.onSeq?.(frame.seq);
+				this.publish(sub);
+				return;
+			}
+			sub.onError?.("bad_delta", `unknown delta op: ${String(frame.op)}`);
+			return;
+		}
+		if (frame.type === "resumed") {
+			if (typeof frame.toSeq === "number") sub.lastSeq = frame.toSeq;
+			if (typeof frame.toSeq === "number") sub.onSeq?.(frame.toSeq);
+			return;
+		}
+		if (frame.type === "error") sub.onError?.(frame.code ?? "unknown", frame.message ?? "");
+	}
+	publish(sub) {
+		try {
+			sub.onSnapshot(orderedRows(sub.state.values()));
+		} catch {}
+	}
+	scheduleReconnect() {
+		if (this.subs.size === 0 || this.reconnectTimer) return;
+		this.consecutiveErrors++;
+		if (this.consecutiveErrors >= RECONNECT_GIVE_UP) {
+			this.broadcastError("give_up", `gave up after ${this.consecutiveErrors} reconnect attempts`);
+			return;
+		}
+		const delay = Math.min(RECONNECT_CAP_MS, RECONNECT_BASE_MS * Math.pow(2, this.consecutiveErrors - 1));
+		this.reconnectTimer = setTimeout(() => {
+			this.reconnectTimer = null;
+			this.connect();
+		}, delay);
+	}
+	broadcastError(code, message) {
+		for (const sub of this.subs.values()) sub.onError?.(code, message);
+	}
+	broadcastStatus(status) {
+		for (const sub of this.subs.values()) sub.onStatus?.(status);
+	}
+	sendFrame(frame) {
+		try {
+			this.ws?.send(JSON.stringify(frame));
+		} catch (err) {
+			this.broadcastError("ws_send_failed", err.message);
+		}
+	}
+	isOpen() {
+		return this.ws?.readyState === 1;
+	}
+};
+const sharedCollectionSockets = /* @__PURE__ */ new Map();
+function sharedSocketKey(url, token) {
+	return `${url}\n${token ?? ""}`;
+}
+function getSharedCollectionSocket(url, token) {
+	const key = sharedSocketKey(url, token);
+	let socket = sharedCollectionSockets.get(key);
+	if (!socket) {
+		socket = new SharedCollectionSocket(url, token);
+		sharedCollectionSockets.set(key, socket);
+	}
+	return socket;
+}
+function openSocketSubscription(opts) {
+	const url = opts.url ?? defaultSubscribeUrl();
+	const token = getAuthContext().token;
+	const key = sharedSocketKey(url, token);
+	const socket = getSharedCollectionSocket(url, token);
+	const sub = {
+		subId: makeSubId(),
+		collection: opts.collection,
+		where: opts.where,
+		state: /* @__PURE__ */ new Map(),
+		lastSeq: opts.resumeFromSeq ?? null,
+		onSnapshot: opts.onSnapshot,
+		onError: opts.onError,
+		onSeq: opts.onSeq,
+		onStatus: opts.onStatus
+	};
+	socket.add(sub);
+	return { unsubscribe() {
+		socket.remove(sub.subId);
+		if (socket.isIdle()) sharedCollectionSockets.delete(key);
+	} };
+}
+function makeInitialQuerySnapshot() {
+	return {
+		data: [],
+		loading: true,
+		error: null,
+		status: "loading"
+	};
+}
+var CollectionQueryStore = class {
+	constructor(key, url, collection, where, onIdle) {
+		this.key = key;
+		this.url = url;
+		this.collection = collection;
+		this.where = where;
+		this.onIdle = onIdle;
+		this.listeners = /* @__PURE__ */ new Set();
+		this.rowSubscribers = /* @__PURE__ */ new Set();
+		this.socketHandle = null;
+		this.fallbackHandle = null;
+		this.authUnsub = null;
+		this.authToken = getAuthContext().token;
+		this.authReady = getAuthContext().authReady;
+		this.lastSeq = null;
+		this.pendingAuthRequired = null;
+		this.notifyQueued = false;
+		this.rowsDirty = false;
+		this.snapshot = makeInitialQuerySnapshot();
+	}
+	subscribe(listener) {
+		this.listeners.add(listener);
+		this.start();
+		return () => {
+			this.listeners.delete(listener);
+			this.stopIfIdle();
+		};
+	}
+	subscribeRows(subscriber) {
+		this.rowSubscribers.add(subscriber);
+		this.start();
+		if (!this.snapshot.loading) queueMicrotask(() => {
+			if (this.rowSubscribers.has(subscriber)) subscriber.onSnapshot(this.snapshot.data);
+		});
+		return () => {
+			this.rowSubscribers.delete(subscriber);
+			this.stopIfIdle();
+		};
+	}
+	destroy() {
+		this.stop();
+		this.listeners.clear();
+		this.rowSubscribers.clear();
+		this.lastSeq = null;
+		this.notifyQueued = false;
+		this.rowsDirty = false;
+		this.snapshot = makeInitialQuerySnapshot();
+	}
+	getSnapshot() {
+		return this.snapshot;
+	}
+	ensureLegacyFallback(api) {
+		if (this.fallbackHandle) return;
+		this.fallbackHandle = startLegacySseRefetch({ current: { collection: this.collection } }, () => this.refreshFromApi(api, "stale"), (message) => this.setError("unavailable", message));
+	}
+	async refreshFromApi(api, status = this.socketHandle ? "live" : "stale") {
+		try {
+			const body = await (await apiFetch(api)).json();
+			let rows = Array.isArray(body) ? body : [];
+			if (this.where) rows = rows.filter((row) => matchesPredicate(row, this.where));
+			this.setRows(orderedRows(rows), status);
+		} catch (err) {
+			this.setError("error", err instanceof Error ? err.message : String(err));
+		}
+	}
+	start() {
+		if (!this.authUnsub) this.authUnsub = subscribeAuthChange((snap) => this.handleAuthChange(snap.token, snap.authReady));
+		if (!this.socketHandle) this.openSocket();
+	}
+	stopIfIdle() {
+		if (this.listeners.size > 0 || this.rowSubscribers.size > 0) return;
+		this.stop();
+		this.onIdle(this.key);
+	}
+	stop() {
+		this.socketHandle?.unsubscribe();
+		this.socketHandle = null;
+		this.fallbackHandle?.abort();
+		this.fallbackHandle = null;
+		this.authUnsub?.();
+		this.authUnsub = null;
+		this.pendingAuthRequired = null;
+	}
+	openSocket() {
+		this.authToken = getAuthContext().token;
+		this.authReady = getAuthContext().authReady;
+		this.socketHandle = openSocketSubscription({
+			url: this.url,
+			collection: this.collection,
+			where: this.where,
+			resumeFromSeq: this.lastSeq,
+			onSeq: (seq) => {
+				this.lastSeq = seq;
+			},
+			onStatus: (status) => {
+				if (status === "reconnecting") this.setStatus("reconnecting", null);
+			},
+			onSnapshot: (rows) => this.setRows(rows, "live"),
+			onError: (code, message) => this.handleSocketError(code, message)
+		});
+	}
+	handleAuthChange(token, authReady) {
+		const tokenChanged = token !== this.authToken;
+		const readyChanged = authReady !== this.authReady;
+		this.authToken = token;
+		this.authReady = authReady;
+		if (tokenChanged) {
+			this.socketHandle?.unsubscribe();
+			this.socketHandle = null;
+			this.fallbackHandle?.abort();
+			this.fallbackHandle = null;
+			this.lastSeq = null;
+			this.pendingAuthRequired = null;
+			this.setRows([], "loading", true);
+			this.openSocket();
+			return;
+		}
+		if (readyChanged && authReady && this.pendingAuthRequired) {
+			const message = this.pendingAuthRequired;
+			this.pendingAuthRequired = null;
+			notifyAuthRequired();
+			this.setStatus("auth_required", `auth_required: ${message}`, true);
+		}
+	}
+	handleSocketError(code, message) {
+		this.broadcastRowError(code, message);
+		if (code === "auth_required") {
+			if (!getAuthContext().authReady) {
+				this.pendingAuthRequired = message;
+				this.setStatus("loading", null);
+				return;
+			}
+			notifyAuthRequired();
+			this.setStatus("auth_required", `${code}: ${message}`, true);
+			return;
+		}
+		if (code === "give_up") {
+			this.setStatus("unavailable", "realtime stream unavailable", true);
+			return;
+		}
+		this.setStatus("error", `${code}: ${message}`, true);
+	}
+	setRows(rows, status, forceLoading = false) {
+		this.snapshot = {
+			data: rows,
+			loading: forceLoading || status === "loading",
+			error: null,
+			status
+		};
+		this.rowsDirty = true;
+		this.queueNotify();
+	}
+	setStatus(status, error, doneLoading = false) {
+		this.snapshot = {
+			...this.snapshot,
+			loading: status === "loading" ? true : doneLoading ? false : this.snapshot.loading,
+			error,
+			status
+		};
+		this.queueNotify();
+	}
+	setError(status, error) {
+		this.snapshot = {
+			...this.snapshot,
+			loading: false,
+			error,
+			status
+		};
+		this.queueNotify();
+	}
+	queueNotify() {
+		if (this.notifyQueued) return;
+		this.notifyQueued = true;
+		queueMicrotask(() => {
+			this.notifyQueued = false;
+			const rowsDirty = this.rowsDirty;
+			this.rowsDirty = false;
+			for (const listener of this.listeners) listener();
+			if (rowsDirty) for (const subscriber of this.rowSubscribers) try {
+				subscriber.onSnapshot(this.snapshot.data);
+			} catch {}
+		});
+	}
+	broadcastRowError(code, message) {
+		for (const subscriber of this.rowSubscribers) subscriber.onError?.(code, message);
+	}
+};
+const collectionQueryStores = /* @__PURE__ */ new Map();
+function collectionQueryKey(url, collection, where) {
+	return `${url}\n${collection}\n${canonicalPredicateString(where)}`;
+}
+function getCollectionQueryStore(url, collection, where) {
+	const normalizedWhere = normalizePredicate(where);
+	const key = collectionQueryKey(url, collection, normalizedWhere);
+	let store = collectionQueryStores.get(key);
+	if (!store) {
+		store = new CollectionQueryStore(key, url, collection, normalizedWhere, (idleKey) => collectionQueryStores.delete(idleKey));
+		collectionQueryStores.set(key, store);
+	}
+	return store;
+}
+function subscribeCollection(opts) {
+	return { unsubscribe: getCollectionQueryStore(opts.url ?? defaultSubscribeUrl(), opts.collection, opts.where).subscribeRows({
+		onSnapshot: opts.onSnapshot,
+		onError: opts.onError
+	}) };
+}
+function _resetSharedCollectionSocketsForTests() {
+	for (const store of collectionQueryStores.values()) store.destroy();
+	collectionQueryStores.clear();
+	for (const socket of sharedCollectionSockets.values()) socket.shutdown();
+	sharedCollectionSockets.clear();
+}
+function _canonicalPredicateForTests(predicate) {
+	return canonicalPredicateString(predicate);
+}
+//#endregion
+export { OmgBadge, VibesAuthAutoPrompt, VibesAuthGuard, VibesAuthProvider, VibesAuthRequiredError, VibesFeedback, VibesLogin, VibesUpload, _canonicalPredicateForTests, _resetSharedCollectionSocketsForTests, attachGestureListeners, captureScreenshot, clearTrace, createNotification, createSandbox, createVibesAuth, deriveAppId, deriveTokenUrl, forkSandbox, getAuthContext, getTrace, installTrace, mailAppForEmail, motionPermissionState, notificationSupport, notifyAuthRequired, requestMotionPermission, runtimeClaims, subscribeAuthRequired, subscribeCollection, useAuth, useCollection, useFeedbackGesture, useNotificationPermission, useNotifications, useQuery, useUpload, useUser, useVibesAuth, useVibesToken, vibesFetch };