@raisindb/client 0.2.4 → 0.2.6

package/dist/index.js

@@ -1,10 +1,11 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -17,19 +18,15 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
 
 // src/index.ts
-var index_exports = {};
-__export(index_exports, {
+var src_exports = {};
+__export(src_exports, {
   AllNodeEventTypes: () => AllNodeEventTypes,
   Archetypes: () => Archetypes,
   AuthManager: () => AuthManager,
@@ -49,6 +46,7 @@ __export(index_exports, {
   DEFAULT_RETRY_BASE_DELAY: () => DEFAULT_RETRY_BASE_DELAY,
   DEFAULT_RETRY_MAX_DELAY: () => DEFAULT_RETRY_MAX_DELAY,
   DEFAULT_RETRY_OPTIONS: () => DEFAULT_RETRY_OPTIONS,
+  DEFAULT_SEND_MESSAGE_INACTIVITY_TIMEOUT_MS: () => DEFAULT_SEND_MESSAGE_INACTIVITY_TIMEOUT_MS,
   Database: () => Database,
   ElementTypes: () => ElementTypes,
   EventHandler: () => EventHandler,
@@ -56,11 +54,16 @@ __export(index_exports, {
   FlowClient: () => FlowClient,
   FlowsApi: () => FlowsApi,
   FunctionsApi: () => FunctionsApi,
+  HttpArchetypes: () => HttpArchetypes,
   HttpDatabase: () => HttpDatabase,
+  HttpElementTypes: () => HttpElementTypes,
   HttpFunctionsApi: () => HttpFunctionsApi,
+  HttpNodeTypes: () => HttpNodeTypes,
   HttpWorkspaceClient: () => HttpWorkspaceClient,
+  InboxApi: () => InboxApi,
   LocalStorageTokenStorage: () => LocalStorageTokenStorage,
   LogLevel: () => LogLevel,
+  McpClient: () => McpClient,
   MemoryTokenStorage: () => MemoryTokenStorage,
   NodeBuilder: () => NodeBuilder,
   NodeEventType: () => NodeEventType,
@@ -69,6 +72,7 @@ __export(index_exports, {
   NodeOperations: () => NodeOperations,
   NodeTypes: () => NodeTypes,
   RAISIN_CONTEXT_KEY: () => RAISIN_CONTEXT_KEY,
+  RETRY_STRATEGIES: () => RETRY_STRATEGIES,
   RaisinAbortError: () => RaisinAbortError,
   RaisinAuthError: () => RaisinAuthError,
   RaisinClient: () => RaisinClient,
@@ -83,6 +87,7 @@ __export(index_exports, {
   ResponseStatus: () => ResponseStatus,
   RetryBuilder: () => RetryBuilder,
   SSEClient: () => SSEClient,
+  SchedulerApi: () => SchedulerApi,
   SqlQuery: () => SqlQuery,
   Tags: () => Tags,
   Transaction: () => Transaction,
@@ -104,6 +109,7 @@ __export(index_exports, {
   createFlowAdapter: () => createFlowAdapter,
   createLoader: () => createLoader,
   createRaisinReact: () => createRaisinReact,
+  createRaisinVue: () => createRaisinVue,
   createRequestScopedClient: () => createRequestScopedClient,
   createSSRClient: () => createSSRClient,
   createSqlAdapter: () => createSqlAdapter,
@@ -116,13 +122,18 @@ __export(index_exports, {
   getErrorMessage: () => getErrorMessage,
   getLogLevel: () => getLogLevel,
   getLoggerConfig: () => getLoggerConfig,
+  getRefDisplayName: () => getRefDisplayName,
+  getRefPath: () => getRefPath,
   isEventMessage: () => isEventMessage,
+  isFlowDefinitionContainer: () => isFlowDefinitionContainer,
+  isFlowDefinitionStep: () => isFlowDefinitionStep,
   isHttpClient: () => isHttpClient,
   isResponseEnvelope: () => isResponseEnvelope,
   isRetryableError: () => isRetryableError,
   isTerminalEvent: () => isTerminalEvent,
   isWebSocketClient: () => isWebSocketClient,
   logger: () => logger,
+  normalizeHomePath: () => normalizeHomePath,
   projectPlansFromMessages: () => projectPlansFromMessages,
   rowsToObjects: () => rowsToObjects,
   setLogLevel: () => setLogLevel,
@@ -132,7 +143,7 @@ __export(index_exports, {
   useFlow: () => useFlow,
   withRetry: () => withRetry
 });
-module.exports = __toCommonJS(index_exports);
+module.exports = __toCommonJS(src_exports);
 
 // src/client.ts
 var import_events4 = require("events");
@@ -326,7 +337,8 @@ var Connection = class extends import_events.EventEmitter {
       autoReconnect: options.autoReconnect ?? true,
       heartbeatInterval: options.heartbeatInterval ?? 3e4,
       heartbeatTimeout: options.heartbeatTimeout ?? 5e3,
-      protocols: options.protocols
+      protocols: options.protocols,
+      headers: options.headers
     };
     this.reconnectManager = new ReconnectManager(options.reconnectOptions);
     this.WebSocketImpl = getWebSocketImpl();
@@ -342,10 +354,10 @@ var Connection = class extends import_events.EventEmitter {
     this.setState("connecting" /* Connecting */);
     return new Promise((resolve, reject) => {
       try {
-        this.ws = new this.WebSocketImpl(
-          this.url,
-          this.options.protocols
-        );
+        const isBrowserWebSocket = typeof WebSocket !== "undefined" && this.WebSocketImpl === WebSocket;
+        this.ws = isBrowserWebSocket || !this.options.headers ? new this.WebSocketImpl(this.url, this.options.protocols) : new this.WebSocketImpl(this.url, this.options.protocols, {
+          headers: this.options.headers
+        });
         this.ws.binaryType = "arraybuffer";
         this.ws.onopen = () => {
           this.setState("connected" /* Connected */);
@@ -434,6 +446,16 @@ var Connection = class extends import_events.EventEmitter {
   isConnected() {
     return this.state === "connected" /* Connected */;
   }
+  /**
+   * Whether auto-reconnect is enabled for this connection.
+   *
+   * Used by the client to decide whether requests issued while the
+   * connection is down can be queued (the connection will come back) or
+   * should fail immediately.
+   */
+  isAutoReconnectEnabled() {
+    return this.options.autoReconnect;
+  }
   /**
    * Reconnect to the server
    */
@@ -831,6 +853,7 @@ var RequestType = /* @__PURE__ */ ((RequestType2) => {
   RequestType2["NodeReorder"] = "node_reorder";
   RequestType2["NodeMoveChildBefore"] = "node_move_child_before";
   RequestType2["NodeMoveChildAfter"] = "node_move_child_after";
+  RequestType2["NodeApplyChildOrder"] = "node_apply_child_order";
   RequestType2["PropertyGet"] = "property_get";
   RequestType2["PropertyUpdate"] = "property_update";
   RequestType2["RelationAdd"] = "relation_add";
@@ -850,6 +873,8 @@ var RequestType = /* @__PURE__ */ ((RequestType2) => {
   RequestType2["BranchUpdateHead"] = "branch_update_head";
   RequestType2["BranchMerge"] = "branch_merge";
   RequestType2["BranchCompare"] = "branch_compare";
+  RequestType2["BranchDiff"] = "branch_diff";
+  RequestType2["BranchCopyNodes"] = "branch_copy_nodes";
   RequestType2["TagCreate"] = "tag_create";
   RequestType2["TagGet"] = "tag_get";
   RequestType2["TagList"] = "tag_list";
@@ -870,6 +895,7 @@ var RequestType = /* @__PURE__ */ ((RequestType2) => {
   RequestType2["ArchetypeDelete"] = "archetype_delete";
   RequestType2["ArchetypePublish"] = "archetype_publish";
   RequestType2["ArchetypeUnpublish"] = "archetype_unpublish";
+  RequestType2["ArchetypeGetResolved"] = "archetype_get_resolved";
   RequestType2["ElementTypeCreate"] = "element_type_create";
   RequestType2["ElementTypeGet"] = "element_type_get";
   RequestType2["ElementTypeList"] = "element_type_list";
@@ -877,6 +903,7 @@ var RequestType = /* @__PURE__ */ ((RequestType2) => {
   RequestType2["ElementTypeDelete"] = "element_type_delete";
   RequestType2["ElementTypePublish"] = "element_type_publish";
   RequestType2["ElementTypeUnpublish"] = "element_type_unpublish";
+  RequestType2["ElementTypeGetResolved"] = "element_type_get_resolved";
   RequestType2["FullTextSearch"] = "full_text_search";
   RequestType2["VectorSearch"] = "vector_search";
   RequestType2["Subscribe"] = "subscribe";
@@ -901,6 +928,10 @@ var RequestType = /* @__PURE__ */ ((RequestType2) => {
   RequestType2["FlowUnsubscribeEvents"] = "flow_unsubscribe_events";
   RequestType2["FunctionInvoke"] = "function_invoke";
   RequestType2["FunctionInvokeSync"] = "function_invoke_sync";
+  RequestType2["ScheduledInvocationCreate"] = "scheduled_invocation_create";
+  RequestType2["ScheduledInvocationCancel"] = "scheduled_invocation_cancel";
+  RequestType2["ScheduledInvocationList"] = "scheduled_invocation_list";
+  RequestType2["ScheduledInvocationGet"] = "scheduled_invocation_get";
   return RequestType2;
 })(RequestType || {});
 var ResponseStatus = /* @__PURE__ */ ((ResponseStatus2) => {
@@ -1010,6 +1041,14 @@ var EventHandler = class {
    * If a subscription with identical filters already exists, the callback
    * is added to the existing subscription instead of creating a new one.
    *
+   * Path filter semantics (matched server-side):
+   * - A plain path matches **only that exact node** — there is no implicit
+   *   prefix matching.
+   * - `*` matches exactly one path segment (e.g. `/inbox/*` matches
+   *   `/inbox/a` but not `/inbox/a/b`).
+   * - `**` matches recursively (e.g. `/inbox/**` matches all descendants
+   *   of `/inbox`, but not `/inbox` itself).
+   *
    * @param filters - Event filters
    * @param callback - Callback function for events
    * @returns Subscription object
@@ -1200,14 +1239,29 @@ var EventHandler = class {
    * Restore subscriptions after reconnect
    *
    * Re-subscribes to the server with the original filters for all active
-   * subscription entries.
+   * subscription entries. Failed entries are kept (with their callbacks)
+   * and marked pending so a retry call can re-attempt them without
+   * duplicating already-restored subscriptions.
+   *
+   * @param options.retry - When true, only re-attempts entries that failed
+   *   in a previous call (instead of re-subscribing everything)
+   * @throws Error if any subscription could not be restored
    */
-  async restoreSubscriptions() {
-    const entriesToRestore = Array.from(this.filterSubscriptions.entries());
-    this.subscriptions.clear();
-    this.filterSubscriptions.clear();
+  async restoreSubscriptions(options) {
+    if (!options?.retry) {
+      for (const entry of this.filterSubscriptions.values()) {
+        this.subscriptions.delete(entry.serverId);
+        entry.restorePending = true;
+      }
+    }
+    const entriesToRestore = Array.from(this.filterSubscriptions.entries()).filter(([, entry]) => entry.restorePending);
+    let failureCount = 0;
+    let lastError;
     for (const [hash, entry] of entriesToRestore) {
-      if (entry.callbacks.size === 0) continue;
+      if (entry.callbacks.size === 0) {
+        entry.restorePending = false;
+        continue;
+      }
       try {
         const payload = { filters: entry.filters };
         const response = await this.sendRequest(
@@ -1215,22 +1269,24 @@ var EventHandler = class {
           "subscribe" /* Subscribe */
         );
         const newServerId = response.subscription_id;
-        this.filterSubscriptions.set(hash, {
-          serverId: newServerId,
-          filters: entry.filters,
-          callbacks: entry.callbacks
-        });
+        entry.serverId = newServerId;
+        entry.restorePending = false;
         this.subscriptions.set(newServerId, hash);
         for (const callback of entry.callbacks) {
           this.callbackToHash.set(callback, hash);
         }
       } catch (error) {
         logger.error("Failed to restore subscription:", error);
-        for (const callback of entry.callbacks) {
-          this.callbackToHash.delete(callback);
-        }
+        failureCount++;
+        lastError = error;
       }
     }
+    if (failureCount > 0) {
+      const message = lastError instanceof Error ? lastError.message : String(lastError);
+      throw new Error(
+        `Failed to restore ${failureCount} subscription(s) after reconnect: ${message}`
+      );
+    }
   }
 };
 var EventSubscriptions = class {
@@ -1265,7 +1321,15 @@ var EventSubscriptions = class {
   /**
    * Subscribe to events for a specific path
    *
-   * @param path - Path pattern (supports wildcards like "/folder/*")
+   * Path pattern semantics (matched server-side):
+   * - A plain path matches **only that exact node** — there is no implicit
+   *   prefix matching, so `/folder` does NOT match `/folder/child`.
+   * - `*` matches exactly one path segment: `/folder/*` matches
+   *   `/folder/child` but not `/folder/child/grandchild`.
+   * - `**` matches recursively: `/folder/**` matches every descendant of
+   *   `/folder` (but not `/folder` itself).
+   *
+   * @param path - Path pattern (e.g. "/folder", "/folder/*", "/folder/**")
    * @param callback - Callback function for events
    * @param options - Optional subscription options
    * @param options.includeNode - Include full node data in event payload (default: false)
@@ -1312,6 +1376,40 @@ var NodeOperations = class {
     const result = await this.sendRequest(payload);
     return result;
   }
+  /**
+   * Create a node, auto-creating any missing ancestor folders.
+   *
+   * @param options - Node creation options (with optional `parentNodeType`)
+   * @returns Created node
+   */
+  async createDeep(options) {
+    const payload = {
+      node_type: options.type,
+      path: options.path,
+      properties: options.properties ?? {},
+      content: options.content,
+      parent_node_type: options.parentNodeType
+    };
+    const result = await this.sendRequest(payload, "node_create_deep");
+    return result;
+  }
+  /**
+   * Upsert a node by path (create-or-update), auto-creating any missing ancestor folders.
+   *
+   * @param options - Node creation options (with optional `parentNodeType`)
+   * @returns Upserted node
+   */
+  async upsertDeep(options) {
+    const payload = {
+      node_type: options.type,
+      path: options.path,
+      properties: options.properties ?? {},
+      content: options.content,
+      parent_node_type: options.parentNodeType
+    };
+    const result = await this.sendRequest(payload, "node_upsert_deep");
+    return result;
+  }
   /**
    * Update an existing node
    *
@@ -1361,6 +1459,75 @@ var NodeOperations = class {
       throw error;
     }
   }
+  /**
+   * List a node's revision history (git-style "file history"), newest first.
+   *
+   * Each entry carries the `revision` (usable with `atRevision()` reads to
+   * fetch the full snapshot), plus when/who and whether the node was deleted
+   * at that revision. Always available regardless of the NodeType `auditable`
+   * flag — it reflects the structural MVCC version history.
+   *
+   * @param id - Node ID
+   * @param options - Optional `{ limit }` to cap the number of revisions
+   * @returns Array of revision entries (newest first)
+   *
+   * @example
+   * ```typescript
+   * const history = await ws.nodes().history(nodeId, { limit: 50 });
+   * for (const rev of history) {
+   *   const snapshot = await ws.atRevision(rev.revision).nodes().get(nodeId);
+   * }
+   * ```
+   */
+  async history(id, options) {
+    const payload = {
+      node_id: id,
+      limit: options?.limit
+    };
+    const result = await this.sendRequest(payload, "node_history");
+    return result ?? [];
+  }
+  /**
+   * List a node's revision history by path (newest first).
+   *
+   * @param path - Node path
+   * @param options - Optional `{ limit }` to cap the number of revisions
+   * @returns Array of revision entries (newest first)
+   */
+  async historyByPath(path, options) {
+    const payload = {
+      path,
+      limit: options?.limit
+    };
+    const result = await this.sendRequest(payload, "node_history");
+    return result ?? [];
+  }
+  /**
+   * Query a node's audit-log entries by ID.
+   *
+   * Audit logs are only produced for NodeTypes marked `auditable`. This is
+   * distinct from {@link history}, which is the always-on structural revision
+   * history available for every node.
+   *
+   * @param id - Node ID
+   * @returns Array of audit-log entries
+   */
+  async auditLog(id) {
+    const payload = { node_id: id };
+    const result = await this.sendRequest(payload, "audit_query");
+    return result ?? [];
+  }
+  /**
+   * Query a node's audit-log entries by path.
+   *
+   * @param path - Node path
+   * @returns Array of audit-log entries
+   */
+  async auditLogByPath(path) {
+    const payload = { path };
+    const result = await this.sendRequest(payload, "audit_query");
+    return result ?? [];
+  }
   /**
    * Query nodes
    *
@@ -1455,17 +1622,40 @@ var NodeOperations = class {
   // Tree Operations
   // ========================================================================
   /**
-   * List children of a parent node
+   * List children of a parent node, in editorial (drag-and-drop) order.
    *
    * @param parentPath - Path of the parent node
    * @returns Array of child nodes
    */
   async listChildren(parentPath) {
+    const { items } = await this.listChildrenPage(parentPath);
+    return items;
+  }
+  /**
+   * List one page of a parent's children, in editorial order.
+   *
+   * Pagination is keyset-based: pass the previous response's `nextCursor` back as
+   * `cursor` to get the following page. `nextCursor` is `null` on the last page.
+   * Treat the cursor as opaque — do not parse or construct it.
+   *
+   * @param parentPath - Path of the parent node
+   * @param options - `cursor` from a previous page, and page `limit`
+   */
+  async listChildrenPage(parentPath, options = {}) {
     const payload = {
       parent_path: parentPath
     };
+    if (options.cursor !== void 0) payload.cursor = options.cursor;
+    if (options.limit !== void 0) payload.limit = options.limit;
     const result = await this.sendRequest(payload, "node_list_children");
-    return result;
+    if (Array.isArray(result)) {
+      return { items: result, nextCursor: null };
+    }
+    const page = result;
+    return {
+      items: page.nodes ?? [],
+      nextCursor: page.next_cursor == null ? null : JSON.stringify(page.next_cursor)
+    };
   }
   /**
    * Get a node tree starting from a root node
@@ -1528,7 +1718,7 @@ var NodeOperations = class {
    */
   async rename(nodePath, newName) {
     const payload = {
-      node_path: nodePath,
+      old_path: nodePath,
       new_name: newName
     };
     const result = await this.sendRequest(payload, "node_rename");
@@ -1544,9 +1734,8 @@ var NodeOperations = class {
    */
   async copy(fromPath, toParentPath, newName) {
     const payload = {
-      from_path: fromPath,
-      to_parent_path: toParentPath,
-      deep: false
+      source_path: fromPath,
+      target_parent: toParentPath
     };
     if (newName !== void 0) {
       payload.new_name = newName;
@@ -1564,9 +1753,8 @@ var NodeOperations = class {
    */
   async copyTree(fromPath, toParentPath, newName) {
     const payload = {
-      from_path: fromPath,
-      to_parent_path: toParentPath,
-      deep: true
+      source_path: fromPath,
+      target_parent: toParentPath
     };
     if (newName !== void 0) {
       payload.new_name = newName;
@@ -1575,53 +1763,72 @@ var NodeOperations = class {
     return result;
   }
   /**
-   * Reorder a node by setting a new order key
+   * Move a child to a specific position among its siblings.
    *
-   * @param nodePath - Node path
-   * @param orderKey - New order key (base62-encoded fractional index)
-   * @returns Reordered node
+   * Positions are 0-based; a position past the end appends. The server owns the
+   * fractional order key — you name a position, it mints the key.
+   *
+   * @param parentPath - Parent node path
+   * @param childName - Name of the child to move (not a full path)
+   * @param position - Target 0-based position among the parent's children
+   * @returns The reordered node, carrying its newly assigned `order_key`
    */
-  async reorder(nodePath, orderKey) {
+  async reorder(parentPath, childName, position) {
     const payload = {
-      node_path: nodePath,
-      order_key: orderKey
+      parent_path: parentPath,
+      child_name: childName,
+      position
     };
     const result = await this.sendRequest(payload, "node_reorder");
     return result;
   }
   /**
-   * Move a child node before a reference sibling
+   * Move a child so it sits immediately before one of its siblings.
    *
    * @param parentPath - Parent node path
-   * @param childPath - Child node path to move
-   * @param referencePath - Reference sibling path to position before
-   * @returns Moved node
+   * @param childName - Name of the child to move (not a full path)
+   * @param beforeChildName - Name of the sibling to sit before
    */
-  async moveChildBefore(parentPath, childPath, referencePath) {
+  async moveChildBefore(parentPath, childName, beforeChildName) {
     const payload = {
       parent_path: parentPath,
-      child_path: childPath,
-      reference_path: referencePath
+      child_name: childName,
+      before_child_name: beforeChildName
     };
-    const result = await this.sendRequest(payload, "node_move_child_before");
-    return result;
+    await this.sendRequest(payload, "node_move_child_before");
   }
   /**
-   * Move a child node after a reference sibling
+   * Move a child so it sits immediately after one of its siblings.
    *
    * @param parentPath - Parent node path
-   * @param childPath - Child node path to move
-   * @param referencePath - Reference sibling path to position after
-   * @returns Moved node
+   * @param childName - Name of the child to move (not a full path)
+   * @param afterChildName - Name of the sibling to sit after
    */
-  async moveChildAfter(parentPath, childPath, referencePath) {
+  async moveChildAfter(parentPath, childName, afterChildName) {
     const payload = {
       parent_path: parentPath,
-      child_path: childPath,
-      reference_path: referencePath
+      child_name: childName,
+      after_child_name: afterChildName
     };
-    const result = await this.sendRequest(payload, "node_move_child_after");
-    return result;
+    await this.sendRequest(payload, "node_move_child_after");
+  }
+  /**
+   * Replay a parent's child order from another branch onto the current branch.
+   *
+   * Carries node sibling-order across branches — useful for selective publish
+   * flows, where copying node content (e.g. via SQL) does not move the ordering
+   * index. Only children that exist under the parent on both branches are
+   * reordered. The target branch is the connection's current branch.
+   *
+   * @param parentPath - Parent node path
+   * @param sourceBranch - Branch to copy the child order FROM
+   */
+  async applyChildOrder(parentPath, sourceBranch) {
+    const payload = {
+      parent_path: parentPath,
+      source_branch: sourceBranch
+    };
+    await this.sendRequest(payload, "node_apply_child_order");
   }
   // ========================================================================
   // Relationship Operations
@@ -1897,7 +2104,17 @@ var NodeFileSource = class {
       return;
     }
     if (!this._fsPromises) {
-      this._fsPromises = await import("fs/promises");
+      if (!isNodeEnvironment()) {
+        throw new Error(
+          "NodeFileSource requires Node.js (fs/promises is not available in browsers). In the browser, use a File or Blob object instead."
+        );
+      }
+      const specifier = "fs/promises";
+      this._fsPromises = await import(
+        /* @vite-ignore */
+        /* webpackIgnore: true */
+        specifier
+      );
     }
     const stats = await this._fsPromises.stat(this._filePath);
     this._size = stats.size;
@@ -2698,6 +2915,17 @@ var Archetypes = class {
       "archetype_unpublish" /* ArchetypeUnpublish */
     );
   }
+  /**
+   * Get resolved Archetype with full inheritance applied
+   */
+  async getResolved(name) {
+    return this.sendRequest(
+      {
+        name
+      },
+      "archetype_get_resolved" /* ArchetypeGetResolved */
+    );
+  }
 };
 
 // src/element-types.ts
@@ -2785,6 +3013,17 @@ var ElementTypes = class {
       "element_type_unpublish" /* ElementTypeUnpublish */
     );
   }
+  /**
+   * Get resolved ElementType with full inheritance applied
+   */
+  async getResolved(name) {
+    return this.sendRequest(
+      {
+        name
+      },
+      "element_type_get_resolved" /* ElementTypeGetResolved */
+    );
+  }
 };
 
 // src/branches.ts
@@ -2886,6 +3125,102 @@ var Branches = class {
       "branch_compare" /* BranchCompare */
     );
   }
+  /**
+   * Per-node diff of `branch` relative to `baseBranch` (added/modified/deleted).
+   *
+   * Cheaper than reading both branch listings: cost scales with the number of
+   * changed nodes since the branches diverged, not the total content.
+   */
+  async diff(branch, baseBranch) {
+    return this.sendRequest(
+      {
+        branch,
+        base_branch: baseBranch
+      },
+      "branch_diff" /* BranchDiff */
+    );
+  }
+  /**
+   * Copy a node set from `sourceBranch` onto `targetBranch` (branch
+   * promotion): node ids are preserved, so repeated copies update the same
+   * target nodes; all changes land in ONE atomic commit on the target branch.
+   *
+   * Each root's parent path must already exist on the target branch. With
+   * `deleteMissing`, target nodes under the roots that are absent from the
+   * copied source set are pruned (one-way sync).
+   */
+  async copyNodes(sourceBranch, targetBranch, opts) {
+    return this.sendRequest(
+      {
+        source_branch: sourceBranch,
+        target_branch: targetBranch,
+        workspace: opts.workspace,
+        roots: opts.roots,
+        recursive: opts.recursive ?? true,
+        delete_missing: opts.deleteMissing ?? false
+      },
+      "branch_copy_nodes" /* BranchCopyNodes */
+    );
+  }
+};
+
+// src/scheduler.ts
+var SchedulerApi = class {
+  constructor(_context, sendRequest) {
+    this.sendRequest = sendRequest;
+  }
+  /**
+   * Schedule a one-shot invocation of a function or flow at a fixed time.
+   */
+  async schedule(options) {
+    const runAt = options.runAt instanceof Date ? options.runAt.toISOString() : options.runAt;
+    return this.sendRequest(
+      {
+        target_kind: options.targetKind,
+        target_path: options.targetPath,
+        input: options.input ?? {},
+        run_at: runAt,
+        external_key: options.externalKey,
+        branch: options.branch,
+        workspace: options.workspace,
+        max_retries: options.maxRetries
+      },
+      "scheduled_invocation_create" /* ScheduledInvocationCreate */
+    );
+  }
+  /**
+   * Cancel a pending invocation before it fires, by job id or external key.
+   */
+  async cancel(ref) {
+    const payload = typeof ref === "string" ? { job_id: ref } : { job_id: ref.jobId, external_key: ref.externalKey };
+    return this.sendRequest(
+      payload,
+      "scheduled_invocation_cancel" /* ScheduledInvocationCancel */
+    );
+  }
+  /**
+   * List this repository's scheduled invocations.
+   */
+  async list(filter) {
+    const result = await this.sendRequest(
+      {
+        external_key: filter?.externalKey,
+        status: filter?.status
+      },
+      "scheduled_invocation_list" /* ScheduledInvocationList */
+    );
+    return result?.invocations ?? [];
+  }
+  /**
+   * Fetch a single scheduled invocation, by job id or external key.
+   */
+  async get(ref) {
+    const payload = typeof ref === "string" ? { job_id: ref } : { job_id: ref.jobId, external_key: ref.externalKey };
+    return this.sendRequest(
+      payload,
+      "scheduled_invocation_get" /* ScheduledInvocationGet */
+    );
+  }
 };
 
 // src/tags.ts
@@ -3241,6 +3576,7 @@ var SSEClient = class {
     this._lastEventId = options.lastEventId;
     this.autoReconnect = options.reconnect?.enabled ?? true;
     this.externalSignal = options.signal;
+    this.inactivityTimeoutMs = options.inactivityTimeoutMs;
     this.eventTypeSet = options.eventTypes?.length ? new Set(options.eventTypes) : null;
     this.reconnectManager = new ReconnectManager({
       initialDelay: options.reconnect?.initialDelay ?? 1e3,
@@ -3384,6 +3720,23 @@ var SSEClient = class {
         if (err.name === "AbortError" || err instanceof RaisinAbortError) {
           return;
         }
+        if (err instanceof RaisinTimeoutError && err.code === "SSE_INACTIVITY_TIMEOUT") {
+          logger.warn("SSE inactivity timeout:", err.message);
+          if (!this.autoReconnect) {
+            this.setState("disconnected");
+            onError?.(err);
+            throw err;
+          }
+          this.setState("reconnecting");
+          const scheduled2 = await this.waitForReconnect();
+          if (!scheduled2) {
+            logger.warn("SSE max reconnection attempts reached");
+            this.setState("disconnected");
+            onError?.(err);
+            throw err;
+          }
+          continue;
+        }
         logger.error("SSE connection error:", err.message);
         onError?.(err);
         if (!this.autoReconnect) {
@@ -3432,7 +3785,9 @@ var SSEClient = class {
       fetchOptions.headers["Content-Type"] = "application/json";
       fetchOptions.body = JSON.stringify(this.options.body);
     }
-    const response = await this.fetchImpl(this.url, fetchOptions);
+    const response = await this.withInactivityTimeout(
+      this.fetchImpl(this.url, fetchOptions)
+    );
     if (!response.ok) {
       const text = await response.text().catch(() => "");
       const msg = `SSE connection failed: ${response.status} ${response.statusText}${text ? ` - ${text}` : ""}`;
@@ -3455,7 +3810,7 @@ var SSEClient = class {
     let buffer = "";
     try {
       while (true) {
-        const { done, value } = await reader.read();
+        const { done, value } = await this.withInactivityTimeout(reader.read());
         if (done) break;
         buffer += decoder.decode(value, { stream: true });
         const blocks = buffer.split("\n\n");
@@ -3486,9 +3841,48 @@ var SSEClient = class {
         }
       }
     } finally {
-      reader.releaseLock();
+      try {
+        reader.releaseLock();
+      } catch {
+      }
     }
   }
+  /**
+   * Race a stream operation against the inactivity timeout.
+   *
+   * If no bytes (or response) arrive within `inactivityTimeoutMs`, the
+   * internal connection is aborted and the operation rejects with a
+   * `RaisinTimeoutError` (code `SSE_INACTIVITY_TIMEOUT`). The timer is
+   * effectively reset on every chunk because each `reader.read()` is
+   * wrapped individually.
+   */
+  withInactivityTimeout(promise) {
+    const timeoutMs = this.inactivityTimeoutMs;
+    if (!timeoutMs || timeoutMs <= 0) return promise;
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        promise.catch(() => void 0);
+        this.abortController?.abort();
+        reject(
+          new RaisinTimeoutError(
+            `SSE stream inactive for ${timeoutMs}ms`,
+            "SSE_INACTIVITY_TIMEOUT",
+            timeoutMs
+          )
+        );
+      }, timeoutMs);
+      promise.then(
+        (value) => {
+          clearTimeout(timer);
+          resolve(value);
+        },
+        (error) => {
+          clearTimeout(timer);
+          reject(error);
+        }
+      );
+    });
+  }
   /**
    * Wait for the reconnect manager to schedule a reconnection attempt.
    * Returns true if reconnection was scheduled, false if max attempts reached.
@@ -3513,7 +3907,24 @@ function isRecoveredDoneEvent(event) {
   return typeof done.content !== "string" || done.content.trim().length === 0;
 }
 
+// src/utils/home-path.ts
+var ACCESS_CONTROL_PREFIX = "/raisin:access_control";
+function normalizeHomePath(home) {
+  if (home === null || home === void 0) return null;
+  let path = home.trim();
+  if (path.length === 0) return null;
+  if (path === ACCESS_CONTROL_PREFIX) return "/";
+  if (path.startsWith(`${ACCESS_CONTROL_PREFIX}/`)) {
+    path = path.slice(ACCESS_CONTROL_PREFIX.length);
+  }
+  while (path.length > 1 && path.endsWith("/")) {
+    path = path.slice(0, -1);
+  }
+  return path;
+}
+
 // src/conversations.ts
+var DEFAULT_SEND_MESSAGE_INACTIVITY_TIMEOUT_MS = 12e4;
 var ConversationManager = class {
   constructor(baseUrl, repository, authManager, options = {}, executeSql) {
     this.baseUrl = baseUrl.replace(/\/$/, "");
@@ -3535,10 +3946,11 @@ var ConversationManager = class {
     );
     if (!result?.rows?.[0]) throw new Error("User not authenticated");
     const row = result.rows[0];
-    this.cachedUserHome = row.home;
-    this.cachedUserId = row.user_id || this.cachedUserHome;
-    if (!this.cachedUserHome) throw new Error("User home path not found");
-    return { userId: this.cachedUserId, userHome: this.cachedUserHome };
+    const userHome = normalizeHomePath(row.home);
+    if (!userHome) throw new Error("User home path not found");
+    this.cachedUserHome = userHome;
+    this.cachedUserId = row.user_id || userHome;
+    return { userId: this.cachedUserId, userHome };
   }
   // ==========================================================================
   // Conversation listing
@@ -3733,13 +4145,15 @@ var ConversationManager = class {
       fetch: this.fetchImpl,
       signal: options?.signal,
       method: "POST",
-      body: { channel: streamTarget.channel, path: streamTarget.path }
+      body: { channel: streamTarget.channel, path: streamTarget.path },
+      inactivityTimeoutMs: options?.inactivityTimeoutMs ?? DEFAULT_SEND_MESSAGE_INACTIVITY_TIMEOUT_MS
     });
     const iterator = sse[Symbol.asyncIterator]();
     let pendingFirst = iterator.next();
     try {
       await sse.waitUntilConnected();
     } catch {
+      pendingFirst?.catch(() => void 0);
       pendingFirst = null;
       sse.close();
       logger.debug("SSE connection failed, falling back to create-only");
@@ -3776,6 +4190,15 @@ var ConversationManager = class {
             return;
           }
         }
+      } catch (error) {
+        if (error instanceof RaisinTimeoutError && error.code === "SSE_INACTIVITY_TIMEOUT") {
+          logger.warn(
+            `[ConversationManager] SSE stream inactive for ${error.timeoutMs}ms, ending turn with synthetic waiting event`
+          );
+          yield { type: "waiting", timestamp: (/* @__PURE__ */ new Date()).toISOString() };
+          return;
+        }
+        throw error;
       } finally {
         sse.close();
       }
@@ -4538,31 +4961,29 @@ var FlowClient = class _FlowClient {
    * Respond to a human task within a flow.
    *
    * When a flow is waiting on a human_task step (approval, input, review),
-   * use this method to submit the response and resume the flow.
+   * use this method to submit the response. Completion is validated
+   * (caller must be the task's assignee or an admin) and resumes the flow.
    *
-   * @param instanceId - Flow instance ID
-   * @param taskId - The human task node ID
-   * @param response - The human's response data
+   * Note: prefer `InboxApi` for full inbox functionality (listing tasks,
+   * task details); this is a convenience passthrough to the same endpoint.
+   *
+   * @param instanceId - Flow instance ID (unused; kept for API stability)
+   * @param taskId - The inbox task node ID (or path)
+   * @param response - The response data
    *
    * @example
    * ```typescript
    * // Approve a task
-   * await flows.respondToHumanTask('instance-123', 'step-5', {
+   * await flows.respondToHumanTask('instance-123', 'task-abc', {
    *   action: 'approve',
    *   comment: 'Looks good!',
    * });
-   *
-   * // Provide input for an input task
-   * await flows.respondToHumanTask('instance-123', 'step-3', {
-   *   name: 'John Doe',
-   *   email: 'john@example.com',
-   * });
    * ```
    */
-  async respondToHumanTask(instanceId, taskId, response, options) {
+  async respondToHumanTask(_instanceId, taskId, response, options) {
     await this.request({
       method: "POST",
-      path: `/api/flows/${this.repository}/instances/${instanceId}/tasks/${taskId}/respond`,
+      path: `/api/inbox/${this.repository}/tasks/${encodeURIComponent(taskId)}/complete`,
       body: { response },
       signal: options?.signal
     });
@@ -4701,43 +5122,171 @@ var FlowClient = class _FlowClient {
   }
 };
 
-// src/database.ts
-var Database = class _Database {
-  constructor(repository, context, sendRequest, eventHandler, branch, revision, getUploadManager, getSignAssetUrl, httpOptions) {
+// src/inbox.ts
+var InboxApi = class {
+  constructor(baseUrl, repository, authManager, options = {}) {
+    this.baseUrl = baseUrl.replace(/\/$/, "");
     this.repository = repository;
-    this.branch = branch;
-    this.revision = revision;
-    this._context = {
-      ...context,
-      repository,
-      branch: branch || context.branch,
-      revision: revision || context.revision
-    };
-    this.sendRequest = (payload, requestType, contextOverride, requestOptions) => sendRequest(
-      payload,
-      requestType || "node_create",
-      contextOverride || this._context,
-      requestOptions
-    );
-    this.eventHandler = eventHandler;
-    this.getUploadManager = getUploadManager;
-    this.getSignAssetUrl = getSignAssetUrl;
-    this.httpOptions = httpOptions;
+    this.authManager = authManager;
+    this.fetchImpl = options.fetch ?? fetch;
+    this.requestTimeout = options.requestTimeout ?? 3e4;
   }
   /**
-   * Get the repository name
+   * List the caller's inbox tasks.
+   *
+   * Tasks are sorted pending-first, then by priority (highest first) and
+   * due time (earliest first).
    */
-  getRepository() {
-    return this.repository;
+  async listTasks(options = {}) {
+    const params = new URLSearchParams();
+    if (options.status) params.set("status", options.status);
+    if (options.assignee) params.set("assignee", options.assignee);
+    const query = params.size > 0 ? `?${params.toString()}` : "";
+    return this.request({
+      method: "GET",
+      path: `/api/inbox/${this.repository}${query}`,
+      signal: options.signal
+    });
   }
   /**
-   * Create a new Database instance scoped to a specific branch.
+   * Get a single inbox task by ID (or path).
+   */
+  async getTask(taskId, options) {
+    return this.request({
+      method: "GET",
+      path: `/api/inbox/${this.repository}/tasks/${encodeURIComponent(taskId)}`,
+      signal: options?.signal
+    });
+  }
+  /**
+   * Complete an inbox task.
    *
-   * @param branch - Branch name
-   * @returns New Database instance with branch context
+   * The caller must be the task's assignee (or an admin). Completion marks
+   * the task done, records who decided, and resumes the owning flow.
+   *
+   * @param taskId - Task node ID (or path)
+   * @param response - The response payload:
+   *   - approval tasks: `{ action: '<option value>', comment?: string }`
+   *   - input tasks: the input value(s) matching the task's input_schema
+   *   - review/action tasks: any acknowledgement payload
+   *
+   * @example
+   * ```typescript
+   * await inbox.completeTask('task-123', { action: 'approve' });
+   * ```
    */
-  onBranch(branch) {
-    return new _Database(
+  async completeTask(taskId, response, options) {
+    return this.request({
+      method: "POST",
+      path: `/api/inbox/${this.repository}/tasks/${encodeURIComponent(taskId)}/complete`,
+      body: { response },
+      signal: options?.signal
+    });
+  }
+  // ==========================================================================
+  // Internal HTTP request helper
+  // ==========================================================================
+  async request(options) {
+    const url = `${this.baseUrl}${options.path}`;
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    const token = this.authManager.getAccessToken();
+    if (token) {
+      headers["Authorization"] = `Bearer ${token}`;
+    }
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), this.requestTimeout);
+    if (options.signal) {
+      if (options.signal.aborted) {
+        clearTimeout(timeoutId);
+        throw new RaisinAbortError();
+      }
+      options.signal.addEventListener("abort", () => controller.abort(), {
+        once: true
+      });
+    }
+    try {
+      const response = await this.fetchImpl(url, {
+        method: options.method,
+        headers,
+        body: options.body ? JSON.stringify(options.body) : void 0,
+        signal: controller.signal
+      });
+      clearTimeout(timeoutId);
+      if (!response.ok) {
+        const errorText = await response.text();
+        let errorMessage;
+        try {
+          const errorJson = JSON.parse(errorText);
+          errorMessage = errorJson.message || errorJson.error || errorText;
+        } catch {
+          errorMessage = errorText || `HTTP ${response.status}: ${response.statusText}`;
+        }
+        throw classifyHttpError(response.status, errorMessage);
+      }
+      const contentType = response.headers.get("content-type");
+      if (contentType?.includes("application/json")) {
+        return await response.json();
+      }
+      return void 0;
+    } catch (error) {
+      clearTimeout(timeoutId);
+      if (error instanceof RaisinAbortError || error instanceof RaisinTimeoutError) {
+        throw error;
+      }
+      if (error instanceof Error && error.name === "AbortError") {
+        if (options.signal?.aborted) {
+          throw new RaisinAbortError();
+        }
+        throw new RaisinTimeoutError(
+          `Request timeout after ${this.requestTimeout}ms`,
+          "REQUEST_TIMEOUT",
+          this.requestTimeout
+        );
+      }
+      throw error;
+    }
+  }
+};
+
+// src/database.ts
+var Database = class _Database {
+  constructor(repository, context, sendRequest, eventHandler, branch, revision, getUploadManager, getSignAssetUrl, httpOptions) {
+    this.repository = repository;
+    this.branch = branch;
+    this.revision = revision;
+    this._context = {
+      ...context,
+      repository,
+      branch: branch || context.branch,
+      revision: revision || context.revision
+    };
+    this.sendRequest = (payload, requestType, contextOverride, requestOptions) => sendRequest(
+      payload,
+      requestType || "node_create",
+      contextOverride || this._context,
+      requestOptions
+    );
+    this.eventHandler = eventHandler;
+    this.getUploadManager = getUploadManager;
+    this.getSignAssetUrl = getSignAssetUrl;
+    this.httpOptions = httpOptions;
+  }
+  /**
+   * Get the repository name
+   */
+  getRepository() {
+    return this.repository;
+  }
+  /**
+   * Create a new Database instance scoped to a specific branch.
+   *
+   * @param branch - Branch name
+   * @returns New Database instance with branch context
+   */
+  onBranch(branch) {
+    return new _Database(
       this.repository,
       this._context,
       this.sendRequest,
@@ -4890,6 +5439,13 @@ var Database = class _Database {
   tags() {
     return new Tags(this._context, this.sendRequest);
   }
+  /**
+   * Get SchedulerApi for one-shot scheduled invocations (time-based
+   * function/flow runs).
+   */
+  scheduler() {
+    return new SchedulerApi(this._context, this.sendRequest);
+  }
   /**
    * Get FlowsApi for running flows via WebSocket
    */
@@ -4977,8 +5533,44 @@ var Database = class _Database {
     }
     return this._flowClient;
   }
+  /**
+   * Get a pre-configured InboxApi for human-in-the-loop tasks.
+   *
+   * Requires the Database to have been created via `RaisinClient.database()`
+   * (which automatically provides HTTP context).
+   *
+   * @example
+   * ```typescript
+   * const db = client.database('my-repo');
+   * const { tasks } = await db.inbox.listTasks({ status: 'pending' });
+   * await db.inbox.completeTask(tasks[0].id, { action: 'approve' });
+   * ```
+   */
+  get inbox() {
+    if (!this._inboxApi) {
+      if (!this.httpOptions?.httpBaseUrl || !this.httpOptions?.authManager) {
+        throw new Error(
+          "db.inbox requires HTTP context. Use client.database() to get a Database with inbox support."
+        );
+      }
+      this._inboxApi = new InboxApi(
+        this.httpOptions.httpBaseUrl,
+        this.repository,
+        this.httpOptions.authManager
+      );
+    }
+    return this._inboxApi;
+  }
   /**
    * Get EventHandler for subscribing to real-time events
+   *
+   * Path filter semantics for subscriptions (matched server-side):
+   * - A plain path matches **only that exact node** — there is no implicit
+   *   prefix matching.
+   * - `*` matches exactly one path segment (`/inbox/*` matches `/inbox/a`,
+   *   not `/inbox/a/b`).
+   * - `**` matches recursively (`/inbox/**` matches all descendants of
+   *   `/inbox`, but not `/inbox` itself).
    */
   events() {
     return this.eventHandler;
@@ -6257,10 +6849,194 @@ var UploadManager = class {
   }
 };
 
+// src/http-schema.ts
+var HttpSchemaBase = class {
+  constructor(repository, branch, client) {
+    this.repository = repository;
+    this.branch = branch;
+    this.client = client;
+  }
+  /** Base management URL for this schema kind. */
+  base() {
+    return `/api/management/${this.repository}/${this.branch}/${this.kind}`;
+  }
+  /** List all schemas (or only published ones). */
+  async list(publishedOnly = false) {
+    const path = publishedOnly ? `${this.base()}/published` : this.base();
+    const result = await this.client.managementRequest("GET", path);
+    return Array.isArray(result) ? result : [];
+  }
+  /** Get a single schema by name. */
+  async get(name) {
+    return this.client.managementRequest("GET", `${this.base()}/${encodeURIComponent(name)}`);
+  }
+  /** Get the schema with full inheritance (`extends`) applied. */
+  async getResolved(name) {
+    return this.client.managementRequest(
+      "GET",
+      `${this.base()}/${encodeURIComponent(name)}/resolved`
+    );
+  }
+  /** Create a schema. `name` is folded into the definition body if absent. */
+  async create(name, definition, commit) {
+    return this.client.managementRequest("POST", this.base(), {
+      [this.defField]: { name, ...definition },
+      commit
+    });
+  }
+  /** Update an existing schema. */
+  async update(name, definition, commit) {
+    return this.client.managementRequest(
+      "PUT",
+      `${this.base()}/${encodeURIComponent(name)}`,
+      { [this.defField]: { name, ...definition }, commit }
+    );
+  }
+  /** Delete a schema. */
+  async delete(name, commit) {
+    return this.client.managementRequest(
+      "DELETE",
+      `${this.base()}/${encodeURIComponent(name)}`,
+      commit
+    );
+  }
+  /** Publish a schema. */
+  async publish(name, commit) {
+    return this.client.managementRequest(
+      "POST",
+      `${this.base()}/${encodeURIComponent(name)}/publish`,
+      commit
+    );
+  }
+  /** Unpublish a schema. */
+  async unpublish(name, commit) {
+    return this.client.managementRequest(
+      "POST",
+      `${this.base()}/${encodeURIComponent(name)}/unpublish`,
+      commit
+    );
+  }
+};
+var HttpNodeTypes = class extends HttpSchemaBase {
+  constructor() {
+    super(...arguments);
+    this.kind = "nodetypes";
+    this.defField = "node_type";
+  }
+  /**
+   * Get the resolved NodeType. Unlike archetypes/element types, NodeType
+   * resolution can be workspace-aware (honors workspace NodeType pins).
+   */
+  async getResolved(name, opts) {
+    const query = opts?.workspace ? `?workspace=${encodeURIComponent(opts.workspace)}` : "";
+    return this.client.managementRequest(
+      "GET",
+      `${this.base()}/${encodeURIComponent(name)}/resolved${query}`
+    );
+  }
+};
+var HttpArchetypes = class extends HttpSchemaBase {
+  constructor() {
+    super(...arguments);
+    this.kind = "archetypes";
+    this.defField = "archetype";
+  }
+};
+var HttpElementTypes = class extends HttpSchemaBase {
+  constructor() {
+    super(...arguments);
+    this.kind = "elementtypes";
+    this.defField = "element_type";
+  }
+};
+
+// src/mcp.ts
+var McpClient = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  /**
+   * List the tools this MCP server advertises to the calling identity.
+   *
+   * Wraps the `tools/list` JSON-RPC method. The visible set is RLS-scoped to
+   * the authenticated caller (or the anonymous role).
+   *
+   * @returns The advertised tool descriptors.
+   */
+  async listTools() {
+    const result = await this.transport.rpc("tools/list");
+    return { tools: result?.tools ?? [] };
+  }
+  /**
+   * Invoke a tool by name.
+   *
+   * Wraps the `tools/call` JSON-RPC method. The underlying `raisin:Function`
+   * runs RLS-scoped to the calling identity. A domain-level tool failure is
+   * reported via {@link McpCallToolResult.isError} (not thrown); transport and
+   * protocol errors are thrown.
+   *
+   * @param name - Tool name from {@link listTools}.
+   * @param args - Arguments object matching the tool's `inputSchema`.
+   * @returns The tool's content blocks and optional structured content.
+   */
+  async callTool(name, args) {
+    const result = await this.transport.rpc("tools/call", {
+      name,
+      arguments: args ?? {}
+    });
+    return result;
+  }
+  /**
+   * Read a resource by its `raisin://` URI.
+   *
+   * Wraps the `resources/read` JSON-RPC method. JSON-only resources return
+   * their properties as a `text` entry; byte-serving resources return base64
+   * in `blob`.
+   *
+   * @param uri - `raisin://{workspace}/{path}` URI to read.
+   * @returns One content entry per URI read.
+   */
+  async readResource(uri) {
+    const result = await this.transport.rpc("resources/read", {
+      uri
+    });
+    return { contents: result?.contents ?? [] };
+  }
+  /**
+   * Subscribe to change notifications for a resource URI (or URI prefix).
+   *
+   * Wraps the `resources/subscribe` JSON-RPC method, which upgrades to an SSE
+   * stream. The returned {@link McpResourceSubscription} is an async iterable of
+   * {@link McpResourceUpdate}; the server's initial subscription ack is consumed
+   * internally and not yielded. Call `close()` to end the stream.
+   *
+   * @param uri - `raisin://` URI (or prefix) to watch.
+   * @returns A live, closeable subscription.
+   */
+  subscribeResource(uri) {
+    const stream = this.transport.subscribe("resources/subscribe", { uri });
+    return {
+      close: () => stream.close(),
+      async *[Symbol.asyncIterator]() {
+        for await (const frame of stream) {
+          if (frame.method === "notifications/resources/updated") {
+            const params = frame.params ?? {};
+            if (typeof params.uri === "string") {
+              yield { uri: params.uri };
+            }
+          }
+        }
+      }
+    };
+  }
+};
+
 // src/http-client.ts
 var RaisinHttpClient = class extends import_events3.EventEmitter {
   constructor(baseUrl, options = {}) {
     super();
+    /** Monotonic JSON-RPC id counter for MCP requests. */
+    this._mcpRequestId = 0;
     this._currentUser = null;
     this._uploadManager = null;
     this.baseUrl = baseUrl.replace(/\/$/, "");
@@ -6306,9 +7082,13 @@ var RaisinHttpClient = class extends import_events3.EventEmitter {
         body: payload,
         skipAuth: true
       });
-      this.authManager.setTokens(response.data);
+      if (response.data.token) {
+        this.authManager.storage.setAccessToken(response.data.token);
+      } else {
+        this.authManager.setTokens(response.data);
+      }
       this._currentUser = {
-        userId: "admin",
+        userId: response.data.user_id ?? "admin",
         anonymous: false
       };
       this.emit("authenticated", response.data);
@@ -6952,6 +7732,107 @@ var RaisinHttpClient = class extends import_events3.EventEmitter {
     });
     return response.data;
   }
+  /**
+   * Send one JSON-RPC request to an MCP server endpoint and return its
+   * unwrapped `result`.
+   *
+   * Calls `POST /mcp/{repo}/{branch}/{slug}` carrying a single JSON-RPC 2.0
+   * message. MCP errors are returned in the JSON-RPC envelope (HTTP `200`), so
+   * this method inspects the body's `error` member and throws on failure.
+   *
+   * @internal Used by {@link McpClient} via the transport built in `mcp()`.
+   */
+  async mcpRpc(repository, branch, slug, method, params) {
+    const id = ++this._mcpRequestId;
+    const response = await this.request({
+      method: "POST",
+      path: `/mcp/${repository}/${branch}/${slug}`,
+      body: {
+        jsonrpc: "2.0",
+        id,
+        method,
+        ...params !== void 0 ? { params } : {}
+      }
+    });
+    const frame = response.data;
+    if (frame?.error) {
+      const err = new Error(frame.error.message || `MCP error ${frame.error.code}`);
+      err.code = frame.error.code;
+      err.data = frame.error.data;
+      throw err;
+    }
+    return frame?.result;
+  }
+  /**
+   * Open the `resources/subscribe` SSE stream for an MCP server endpoint.
+   *
+   * Streams JSON-RPC frames (the subscription ack followed by
+   * `notifications/resources/updated` frames) from
+   * `POST /mcp/{repo}/{branch}/{slug}`.
+   *
+   * @internal Used by {@link McpClient} via the transport built in `mcp()`.
+   */
+  mcpSubscribe(repository, branch, slug, method, params) {
+    const headers = {};
+    if (this.authManager.isAuthenticated()) {
+      const token = this.authManager.getAccessToken();
+      if (token) {
+        headers["Authorization"] = `Bearer ${token}`;
+      }
+    }
+    const sse = new SSEClient(
+      `${this.baseUrl}/mcp/${repository}/${branch}/${slug}`,
+      {
+        method: "POST",
+        body: {
+          jsonrpc: "2.0",
+          id: ++this._mcpRequestId,
+          method,
+          params
+        },
+        headers,
+        fetch: this.fetchImpl,
+        reconnect: { enabled: false }
+      }
+    );
+    return {
+      close: () => sse.close(),
+      async *[Symbol.asyncIterator]() {
+        for await (const event of sse) {
+          yield event.data;
+        }
+      }
+    };
+  }
+  /**
+   * Get an {@link McpClient} for a content-declared MCP server.
+   *
+   * @param slug - The `raisin:McpServer` slug (resolved in the `mcp` workspace).
+   * @param branch - Branch to address; defaults to the client's current branch.
+   */
+  mcp(slug, branch) {
+    const repository = this._context.repository;
+    if (!repository) {
+      throw new Error("mcp() requires a repository; call database(name) first");
+    }
+    const effectiveBranch = branch ?? this.getBranch();
+    const transport = {
+      rpc: (m, p) => this.mcpRpc(repository, effectiveBranch, slug, m, p),
+      subscribe: (m, p) => this.mcpSubscribe(repository, effectiveBranch, slug, m, p)
+    };
+    return new McpClient(transport);
+  }
+  /**
+   * Make a management REST request and return the parsed body.
+   *
+   * @internal Used by the HTTP schema-management helpers
+   * ({@link HttpNodeTypes}/{@link HttpArchetypes}/{@link HttpElementTypes}) to
+   * reuse the client's centralized auth, timeout, and base-URL handling.
+   */
+  async managementRequest(method, path, body) {
+    const response = await this.request({ method, path, body });
+    return response.data;
+  }
   /**
    * Get a simplified database interface for SSR
    * This returns an HTTP-based database client
@@ -7039,6 +7920,36 @@ var HttpDatabase = class _HttpDatabase {
       (repo, name, input) => this.client.invokeFunctionSync(repo, name, input)
     );
   }
+  /**
+   * Get an {@link McpClient} for a content-declared MCP server on this database.
+   *
+   * @param slug - The `raisin:McpServer` slug (resolved in the `mcp` workspace).
+   * @returns A client scoped to `{repo}/{branch}/{slug}`, using this database's
+   *   branch (falling back to the HTTP client's current branch).
+   */
+  mcp(slug) {
+    const transport = {
+      rpc: (m, p) => this.client.mcpRpc(this.repository, this.schemaBranch(), slug, m, p),
+      subscribe: (m, p) => this.client.mcpSubscribe(this.repository, this.schemaBranch(), slug, m, p)
+    };
+    return new McpClient(transport);
+  }
+  /** Effective branch for management calls. */
+  schemaBranch() {
+    return this.branch ?? this.client.getBranch();
+  }
+  /** NodeType management (get/list/getResolved/create/update/delete/publish/unpublish). */
+  nodeTypes() {
+    return new HttpNodeTypes(this.repository, this.schemaBranch(), this.client);
+  }
+  /** Archetype management (get/list/getResolved/create/update/delete/publish/unpublish). */
+  archetypes() {
+    return new HttpArchetypes(this.repository, this.schemaBranch(), this.client);
+  }
+  /** ElementType management (get/list/getResolved/create/update/delete/publish/unpublish). */
+  elementTypes() {
+    return new HttpElementTypes(this.repository, this.schemaBranch(), this.client);
+  }
 };
 var HttpWorkspaceClient = class {
   constructor(repository, workspace, client) {
@@ -7196,10 +8107,13 @@ var HttpWorkspaceClient = class {
 };
 
 // src/client.ts
-var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
+var _refreshingUser;
+var _RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
   constructor(url, options = {}) {
     super();
     this._currentUser = null;
+    /** In-flight role re-resolve, used to coalesce concurrent refreshCurrentUser() calls. */
+    __privateAdd(this, _refreshingUser, null);
     // Auth state change listeners (Firebase/Supabase pattern)
     this._authListeners = /* @__PURE__ */ new Set();
     this._userChangeListeners = /* @__PURE__ */ new Set();
@@ -7210,23 +8124,43 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
     // Reconnection tracking
     this._previousConnectionState = "disconnected" /* Disconnected */;
     this._reconnectedListeners = /* @__PURE__ */ new Set();
+    this._everConnected = false;
+    // Requests queued while the connection is re-establishing.
+    // Flushed after reconnect + re-auth; bounded by MAX_QUEUED_REQUESTS.
+    this._queuedRequests = [];
+    /**
+     * Backoff delays (ms) between subscription-restore retries after reconnect.
+     * @internal - overridable in tests
+     */
+    this._restoreRetryDelaysMs = [1e3, 3e3, 9e3];
     // Upload manager (uses HTTP under the hood)
     this._uploadManager = null;
+    /** In-flight refresh shared by concurrent refreshToken() callers. */
+    this._refreshInFlight = null;
     if (options.logLevel !== void 0) {
       setLogLevel(options.logLevel);
     }
+    const connectionUrl = this.buildConnectionUrl(url, options.repository);
     this.options = {
       requestTimeout: options.requestTimeout ?? 3e4,
-      tenantId: options.tenantId ?? this.extractTenantFromUrl(url),
+      tenantId: options.tenantId ?? this.extractTenantFromUrl(connectionUrl),
       defaultBranch: options.defaultBranch ?? "main"
     };
-    this._httpBaseUrl = options.httpBaseUrl ?? this.deriveHttpUrl(url);
-    this._repository = this.extractRepositoryFromUrl(url);
+    this._httpBaseUrl = options.httpBaseUrl ?? this.deriveHttpUrl(connectionUrl);
+    this._repository = options.repository ?? this.extractRepositoryFromUrl(connectionUrl);
     this._context = {
       tenant_id: this.options.tenantId,
       branch: this.options.defaultBranch
     };
-    this.connection = new Connection(url, options.connection);
+    const explicitTenant = options.tenantId ?? (this.extractTenantFromUrl(url) !== "default" ? this.options.tenantId : void 0);
+    const connectionOptions = {
+      ...options.connection,
+      headers: {
+        ...explicitTenant ? { "x-tenant-id": explicitTenant } : {},
+        ...options.connection?.headers
+      }
+    };
+    this.connection = this.createConnection(connectionUrl, connectionOptions);
     this.requestTracker = new RequestTracker({
       defaultTimeout: this.options.requestTimeout
     });
@@ -7236,6 +8170,14 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
     );
     this.setupConnectionHandlers();
   }
+  /**
+   * Create the underlying WebSocket connection.
+   * Seam for tests to inject a fake connection.
+   * @internal
+   */
+  createConnection(url, options) {
+    return new Connection(url, options);
+  }
   /**
    * Derive HTTP URL from WebSocket URL
    * ws://host:port/path -> http://host:port
@@ -7251,15 +8193,45 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
       return "http://localhost:8081";
     }
   }
+  /**
+   * Build the WebSocket connection URL.
+   *
+   * When a repository option is provided and the URL carries no path
+   * (e.g. `ws://host:8081`), build the tenant-less `/ws/{repository}`
+   * route internally. URLs that already carry a path are used as-is.
+   */
+  buildConnectionUrl(url, repository) {
+    if (!repository) {
+      return url;
+    }
+    try {
+      const wsUrl = url.replace(/^raisin:\/\//, "ws://").replace(/^raisins:\/\//, "wss://");
+      const parsed = new URL(wsUrl);
+      const hasPath = parsed.pathname.split("/").some((p) => p.length > 0);
+      if (hasPath) {
+        return url;
+      }
+      return `${url.replace(/\/+$/, "")}/ws/${repository}`;
+    } catch {
+      return url;
+    }
+  }
   /**
    * Extract repository from URL
-   * URL format: raisin://host:port/tenant/repository or ws://host:port/tenant/repository
+   * URL forms: /ws/{repo} (tenant-less, preferred), /sys/{tenant}/{repo}
+   * (operator/multi-tenant), /{tenant}/{repo} (legacy).
    */
   extractRepositoryFromUrl(url) {
     try {
       const wsUrl = url.replace(/^raisin:\/\//, "ws://").replace(/^raisins:\/\//, "wss://");
       const parsed = new URL(wsUrl);
       const parts = parsed.pathname.split("/").filter((p) => p.length > 0);
+      if (parts[0] === "ws") {
+        return parts.length > 1 ? parts[1] : "";
+      }
+      if (parts[0] === "sys") {
+        return parts.length > 2 ? parts[2] : "";
+      }
       return parts.length > 1 ? parts[1] : "";
     } catch {
       return "";
@@ -7267,14 +8239,24 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
   }
   /**
    * Extract tenant ID from URL
-   * URL format: raisin://host:port/tenant/repository or ws://host:port/tenant/repository
+   * URL forms: /ws/{repo} (tenant-less — no tenant in URL),
+   * /sys/{tenant}/{repo} (canonical), /{tenant}/{repo} (legacy).
+   * When the URL doesn't carry a tenant, fall back to 'default' — the
+   * server's tenant middleware resolves it anyway (production derives the
+   * tenant from the request itself), so an explicit tenantId is optional.
    */
   extractTenantFromUrl(url) {
     try {
       const wsUrl = url.replace(/^raisin:\/\//, "ws://").replace(/^raisins:\/\//, "wss://");
       const parsed = new URL(wsUrl);
       const parts = parsed.pathname.split("/").filter((p) => p.length > 0);
-      return parts.length > 0 ? parts[0] : "default";
+      if (parts[0] === "ws") {
+        return "default";
+      }
+      if (parts[0] === "sys") {
+        return parts.length > 1 ? parts[1] : "default";
+      }
+      return parts.length >= 2 ? parts[0] : "default";
     } catch (error) {
       return "default";
     }
@@ -7288,7 +8270,11 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
     });
     this.connection.on("stateChange", (state) => {
       const wasDisconnected = this._previousConnectionState === "disconnected" /* Disconnected */ || this._previousConnectionState === "reconnecting" /* Reconnecting */;
+      if (state === "connected" /* Connected */) {
+        this._everConnected = true;
+      }
       if (state === "disconnected" /* Disconnected */ || state === "closed" /* Closed */) {
+        this._queuedRequests = [];
         this.requestTracker.cancelAll();
       }
       if (state === "connected" /* Connected */ && wasDisconnected && this._previousConnectionState !== "disconnected" /* Disconnected */) {
@@ -7319,8 +8305,13 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
       if (isConnectedMessage(message)) {
         this.handleConnectedMessage(message);
       } else if (isEventMessage(message)) {
-        logger.debug(`Routing to event handler`);
-        this.eventHandler.handleEvent(message);
+        if (message.event_type === "permissions:changed") {
+          logger.info("[permissions:changed] server signaled a role/permission change; re-resolving");
+          void this.refreshCurrentUser();
+        } else {
+          logger.debug(`Routing to event handler`);
+          this.eventHandler.handleEvent(message);
+        }
       } else if (isResponseEnvelope(message)) {
         logger.debug(`Routing to response handler - request_id: ${message.request_id}, status: ${message.status}`);
         this.handleResponse(message);
@@ -7353,19 +8344,36 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
         };
         logger.debug(`Anonymous user info stored: ${message.user_id}`);
         this._updateReadyState();
+        this._flushQueuedRequests();
         if (hasActiveSubscriptions) {
           this._restoreSubscriptionsAndNotify();
         }
       } else {
         logger.info(`[handleConnectedMessage] Stored token found, auto-authenticating...`);
-        this.autoReauthenticate().then(async () => {
+        this.autoReauthenticate().then(async (authenticated) => {
+          if (authenticated) {
+            this._flushQueuedRequests();
+          } else {
+            this._rejectQueuedRequests(
+              new RaisinAuthError(
+                "Re-authentication failed after reconnect",
+                "AUTH_TOKEN_EXPIRED",
+                401
+              )
+            );
+          }
           if (hasActiveSubscriptions) {
             await this._restoreSubscriptionsAndNotify();
           }
         }).catch((err) => {
           logger.error(`[handleConnectedMessage] Auto-authenticate failed:`, err);
+          this._rejectQueuedRequests(
+            err instanceof Error ? err : new Error("Re-authentication failed after reconnect")
+          );
         });
       }
+    } else {
+      this._flushQueuedRequests();
     }
     this.emit("connected", {
       connectionId: message.connection_id,
@@ -7374,18 +8382,41 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
     });
   }
   /**
-   * Restore subscriptions after reconnection and notify listeners
+   * Restore subscriptions after reconnection and notify listeners.
+   *
+   * Retries with backoff (see `_restoreRetryDelaysMs`); on final failure a
+   * `subscription_restore_failed` event is emitted so applications can
+   * resync their state (e.g. reload lists and re-subscribe manually).
    * @internal
    */
   async _restoreSubscriptionsAndNotify() {
-    try {
-      logger.info("[_restoreSubscriptionsAndNotify] Restoring subscriptions...");
-      await this.eventHandler.restoreSubscriptions();
-      logger.info("[_restoreSubscriptionsAndNotify] Subscriptions restored successfully");
-      this._emitReconnected();
-    } catch (error) {
-      logger.error("[_restoreSubscriptionsAndNotify] Failed to restore subscriptions:", error);
+    const delays = this._restoreRetryDelaysMs;
+    let lastError;
+    for (let attempt = 0; attempt <= delays.length; attempt++) {
+      try {
+        logger.info(
+          `[_restoreSubscriptionsAndNotify] Restoring subscriptions (attempt ${attempt + 1}/${delays.length + 1})...`
+        );
+        await this.eventHandler.restoreSubscriptions({ retry: attempt > 0 });
+        logger.info("[_restoreSubscriptionsAndNotify] Subscriptions restored successfully");
+        this._emitReconnected();
+        return;
+      } catch (error) {
+        lastError = error;
+        logger.error(
+          `[_restoreSubscriptionsAndNotify] Restore attempt ${attempt + 1} failed:`,
+          error
+        );
+        if (attempt < delays.length) {
+          await new Promise((resolve) => setTimeout(resolve, delays[attempt]));
+        }
+      }
     }
+    logger.error("[_restoreSubscriptionsAndNotify] Giving up after retries; events may be stale");
+    this.emit(
+      "subscription_restore_failed",
+      lastError instanceof Error ? lastError : new Error(String(lastError))
+    );
   }
   /**
    * Emit reconnected event to all listeners
@@ -7404,13 +8435,15 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
   }
   /**
    * Auto-reauthenticate with stored JWT on reconnection
+   *
+   * @returns true if the session was re-authenticated, false otherwise
    * @internal
    */
   async autoReauthenticate() {
     const token = this.authManager.storage.getAccessToken();
     if (!token) {
       logger.warn("[autoReauthenticate] No stored token");
-      return;
+      return false;
     }
     const payload = AuthManager.parseToken(token);
     if (payload?.exp && typeof payload.exp === "number") {
@@ -7422,18 +8455,20 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
           this.authManager.clear();
           this._currentUser = null;
           this._emitAuthEvent("SESSION_EXPIRED");
-          return;
+          return false;
         }
         const newToken = this.authManager.storage.getAccessToken();
         if (newToken) {
           await this.authenticate({ type: "jwt", token: newToken });
+          return true;
         }
-        return;
+        return false;
       }
     }
     try {
       await this.authenticate({ type: "jwt", token });
       logger.info("[autoReauthenticate] Successfully re-authenticated");
+      return true;
     } catch (err) {
       logger.error("[autoReauthenticate] Failed to authenticate:", err);
       const refreshed = await this.refreshToken();
@@ -7441,11 +8476,14 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
         const newToken = this.authManager.storage.getAccessToken();
         if (newToken) {
           await this.authenticate({ type: "jwt", token: newToken });
+          return true;
         }
+        return false;
       } else {
         this.authManager.clear();
         this._currentUser = null;
         this._emitAuthEvent("SESSION_EXPIRED");
+        return false;
       }
     }
   }
@@ -7561,18 +8599,18 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
     }
     const url = `${this._httpBaseUrl}/auth/${repository}/login`;
     logger.debug("[loginWithEmail] POST", url);
-    const response = await fetch(url, {
+    const response = await this._fetchWithTimeout(url, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ email, password })
     });
     if (!response.ok) {
       const error = await response.json().catch(() => ({ message: response.statusText }));
-      const authError = {
-        code: error.code || "LOGIN_FAILED",
-        message: error.message || "Login failed"
-      };
-      throw authError;
+      throw new RaisinAuthError(
+        error.message || "Login failed",
+        error.code || "LOGIN_FAILED",
+        response.status
+      );
     }
     const tokens = await response.json();
     logger.info("[loginWithEmail] HTTP login successful, user_id:", tokens.identity.id);
@@ -7601,11 +8639,11 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
     }
     this._currentUser = {
       userId: user.id,
-      roles: [],
+      roles: this._currentUser?.roles ?? [],
       anonymous: false,
       node: userNode ?? void 0
     };
-    const expiresInMs = tokens.expires_at * 1e3 - Date.now() - 5 * 60 * 1e3;
+    const expiresInMs = _RaisinClient.expiresAtToMs(tokens.expires_at) - Date.now() - 5 * 60 * 1e3;
     if (expiresInMs > 0) {
       this.scheduleAutoRefresh(expiresInMs);
     }
@@ -7629,18 +8667,18 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
   async registerWithEmail(email, password, repository, displayName) {
     logger.info("[registerWithEmail] Starting registration...");
     const url = `${this._httpBaseUrl}/auth/${repository}/register`;
-    const response = await fetch(url, {
+    const response = await this._fetchWithTimeout(url, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ email, password, display_name: displayName })
     });
     if (!response.ok) {
       const error = await response.json().catch(() => ({ message: response.statusText }));
-      const authError = {
-        code: error.code || "REGISTRATION_FAILED",
-        message: error.message || "Registration failed"
-      };
-      throw authError;
+      throw new RaisinAuthError(
+        error.message || "Registration failed",
+        error.code || "REGISTRATION_FAILED",
+        response.status
+      );
     }
     const tokens = await response.json();
     logger.info("[registerWithEmail] Registration successful, user_id:", tokens.identity.id);
@@ -7667,11 +8705,11 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
     }
     this._currentUser = {
       userId: user.id,
-      roles: [],
+      roles: this._currentUser?.roles ?? [],
       anonymous: false,
       node: userNode ?? void 0
     };
-    const expiresInMs = tokens.expires_at * 1e3 - Date.now() - 5 * 60 * 1e3;
+    const expiresInMs = _RaisinClient.expiresAtToMs(tokens.expires_at) - Date.now() - 5 * 60 * 1e3;
     if (expiresInMs > 0) {
       this.scheduleAutoRefresh(expiresInMs);
     }
@@ -7763,39 +8801,18 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
     if (payload && payload.exp && typeof payload.exp === "number") {
       if (payload.exp * 1e3 < Date.now()) {
         logger.info("[initSession] Token expired, attempting refresh...");
-        const refreshToken = this.authManager.storage.getRefreshToken();
-        if (refreshToken) {
-          try {
-            const url = this._repository ? `${this._httpBaseUrl}/auth/${this._repository}/refresh` : `${this._httpBaseUrl}/auth/refresh`;
-            const response = await fetch(url, {
-              method: "POST",
-              headers: { "Content-Type": "application/json" },
-              body: JSON.stringify({ refresh_token: refreshToken })
-            });
-            if (response.ok) {
-              const tokens = await response.json();
-              this.authManager.storage.setAccessToken(tokens.access_token);
-              this.authManager.storage.setRefreshToken(tokens.refresh_token);
-              const expiresInMs = tokens.expires_at * 1e3 - Date.now() - 5 * 60 * 1e3;
-              if (expiresInMs > 0) {
-                this.scheduleAutoRefresh(expiresInMs);
-              }
-              logger.info("[initSession] Token refreshed successfully");
-            } else {
-              logger.warn("[initSession] Token refresh failed, clearing session");
-              this.authManager.clear();
-              return null;
-            }
-          } catch (err) {
-            logger.warn("[initSession] Token refresh error:", err);
-            this.authManager.clear();
-            return null;
-          }
-        } else {
+        if (!this.authManager.storage.getRefreshToken()) {
           logger.warn("[initSession] No refresh token, clearing session");
           this.authManager.clear();
           return null;
         }
+        const refreshed = await this.refreshToken();
+        if (!refreshed) {
+          logger.warn("[initSession] Token refresh failed, clearing session");
+          this.authManager.clear();
+          return null;
+        }
+        logger.info("[initSession] Token refreshed successfully");
       }
     }
     try {
@@ -7829,7 +8846,7 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
         }
         this._currentUser = {
           userId: user.id,
-          roles: [],
+          roles: this._currentUser?.roles ?? [],
           anonymous: false,
           node: userNode ?? void 0
         };
@@ -7885,6 +8902,16 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
    * @throws Error if no refresh token is stored or refresh fails
    */
   async refreshToken() {
+    if (this._refreshInFlight) {
+      logger.debug("[refreshToken] Refresh already in flight, awaiting it");
+      return this._refreshInFlight;
+    }
+    this._refreshInFlight = this._refreshToken().finally(() => {
+      this._refreshInFlight = null;
+    });
+    return this._refreshInFlight;
+  }
+  async _refreshToken() {
     const refreshToken = this.authManager.storage.getRefreshToken();
     if (!refreshToken) {
       logger.warn("[refreshToken] No refresh token available");
@@ -7893,7 +8920,7 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
     try {
       logger.info("[refreshToken] Refreshing access token...");
       const url = this._repository ? `${this._httpBaseUrl}/auth/${this._repository}/refresh` : `${this._httpBaseUrl}/auth/refresh`;
-      const response = await fetch(url, {
+      const response = await this._fetchWithTimeout(url, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ refresh_token: refreshToken })
@@ -7901,6 +8928,11 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
       if (!response.ok) {
         const errorText = await response.text();
         logger.error("[refreshToken] Refresh failed:", response.status, errorText);
+        if (/TOKEN_REUSE_DETECTED|TOKEN_FAMILY_MISMATCH/.test(errorText)) {
+          logger.error(
+            "[refreshToken] Session revoked by the server as a suspected token replay. If this happened on a normal page load, two refreshes raced on the same token."
+          );
+        }
         if (response.status === 401 || response.status === 403) {
           this.authManager.clear();
           this._currentUser = null;
@@ -7923,7 +8955,7 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
       if (this.authManager.storage instanceof LocalStorageTokenStorage) {
         this.authManager.storage.setUser(user);
       }
-      const expiresInMs = tokens.expires_at * 1e3 - Date.now() - 5 * 60 * 1e3;
+      const expiresInMs = _RaisinClient.expiresAtToMs(tokens.expires_at) - Date.now() - 5 * 60 * 1e3;
       if (expiresInMs > 0) {
         this.scheduleAutoRefresh(expiresInMs);
       }
@@ -7936,6 +8968,53 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
       return null;
     }
   }
+  /**
+   * Fetch with a timeout derived from `requestTimeout`.
+   *
+   * Aborts the request after `requestTimeout` ms and rejects with a
+   * `RaisinTimeoutError`. If the caller provides its own AbortSignal in
+   * `init.signal`, it is respected: an external abort rejects with the
+   * original AbortError instead of a timeout error.
+   * @internal
+   */
+  async _fetchWithTimeout(url, init = {}) {
+    const timeoutMs = this.options.requestTimeout;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    const externalSignal = init.signal ?? void 0;
+    if (externalSignal) {
+      if (externalSignal.aborted) {
+        controller.abort();
+      } else {
+        externalSignal.addEventListener("abort", () => controller.abort(), { once: true });
+      }
+    }
+    try {
+      return await fetch(url, { ...init, signal: controller.signal });
+    } catch (error) {
+      if (error instanceof Error && error.name === "AbortError" && !externalSignal?.aborted) {
+        throw new RaisinTimeoutError(
+          `Request to ${url} timed out after ${timeoutMs}ms`,
+          "REQUEST_TIMEOUT",
+          timeoutMs
+        );
+      }
+      throw error;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  /**
+   * Normalize a token `expires_at` value to epoch milliseconds.
+   *
+   * Server endpoints are inconsistent: some return seconds, others
+   * milliseconds. Anything above 1e11 can't be a seconds-epoch (year 5138),
+   * so treat it as milliseconds.
+   * @internal
+   */
+  static expiresAtToMs(expiresAt) {
+    return expiresAt > 1e11 ? expiresAt : expiresAt * 1e3;
+  }
   /**
    * Schedule automatic token refresh
    * @internal
@@ -7944,11 +9023,12 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
     if (this._refreshTimer) {
       clearTimeout(this._refreshTimer);
     }
-    logger.debug(`[scheduleAutoRefresh] Scheduling refresh in ${Math.round(delayMs / 1e3 / 60)} minutes`);
+    const clamped = Math.min(Math.max(delayMs, 3e4), 2147483647);
+    logger.debug(`[scheduleAutoRefresh] Scheduling refresh in ${Math.round(clamped / 1e3 / 60)} minutes`);
     this._refreshTimer = setTimeout(async () => {
       logger.info("[autoRefresh] Auto-refreshing token...");
       await this.refreshToken();
-    }, delayMs);
+    }, clamped);
   }
   /**
    * Get a database/repository interface
@@ -7972,10 +9052,26 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
   }
   /**
    * Send a request to the server
+   *
+   * If the connection is temporarily down (connecting/reconnecting, or
+   * disconnected with auto-reconnect enabled), the request is queued and
+   * flushed once the connection is re-established and re-authenticated.
+   * Queued requests are still subject to their own request timeout, and the
+   * queue is bounded (overflow rejects immediately).
    */
   async sendRequestInternal(payload, requestType, contextOverride, requestOptions) {
-    if (!this.connection.isConnected()) {
-      throw new Error("Not connected to server");
+    const connected = this.connection.isConnected();
+    if (!connected) {
+      const state = this.connection.getState();
+      const willReconnect = state === "connecting" /* Connecting */ || state === "reconnecting" /* Reconnecting */ || state === "disconnected" /* Disconnected */ && this._everConnected && this.connection.isAutoReconnectEnabled();
+      if (!willReconnect) {
+        throw new Error("Not connected to server");
+      }
+      if (this._queuedRequests.length >= _RaisinClient.MAX_QUEUED_REQUESTS) {
+        throw new Error(
+          `Request queue is full (${_RaisinClient.MAX_QUEUED_REQUESTS} requests pending while reconnecting)`
+        );
+      }
     }
     const requestId = this.requestTracker.generateRequestId();
     const context = contextOverride || this._context;
@@ -7994,8 +9090,15 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
     try {
       const encoded = encodeMessage(request);
       logger.debug(`Encoded request - ID: ${requestId}, type: ${requestType}, size: ${encoded.length} bytes`);
-      this.connection.send(encoded);
-      logger.debug(`Request sent - ID: ${requestId}`);
+      if (connected) {
+        this.connection.send(encoded);
+        logger.debug(`Request sent - ID: ${requestId}`);
+      } else {
+        this._queuedRequests.push({ requestId, encoded });
+        logger.debug(
+          `Request queued while reconnecting - ID: ${requestId}, queue size: ${this._queuedRequests.length}`
+        );
+      }
     } catch (error) {
       logger.error(`Failed to send request - ID: ${requestId}:`, error);
       this.requestTracker.rejectRequest(
@@ -8006,6 +9109,42 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
     }
     return responsePromise;
   }
+  /**
+   * Flush requests queued while the connection was re-establishing.
+   * Called after the connection is connected and (re-)authenticated.
+   * @internal
+   */
+  _flushQueuedRequests() {
+    if (this._queuedRequests.length === 0) return;
+    const queued = this._queuedRequests;
+    this._queuedRequests = [];
+    logger.info(`[_flushQueuedRequests] Flushing ${queued.length} queued request(s)`);
+    for (const { requestId, encoded } of queued) {
+      if (!this.requestTracker.hasPendingRequest(requestId)) continue;
+      try {
+        this.connection.send(encoded);
+      } catch (error) {
+        this.requestTracker.rejectRequest(
+          requestId,
+          error instanceof Error ? error : new Error("Failed to send queued request")
+        );
+      }
+    }
+  }
+  /**
+   * Reject all requests queued while the connection was re-establishing
+   * (e.g. re-authentication failed after reconnect).
+   * @internal
+   */
+  _rejectQueuedRequests(error) {
+    if (this._queuedRequests.length === 0) return;
+    const queued = this._queuedRequests;
+    this._queuedRequests = [];
+    logger.warn(`[_rejectQueuedRequests] Rejecting ${queued.length} queued request(s): ${error.message}`);
+    for (const { requestId } of queued) {
+      this.requestTracker.rejectRequest(requestId, error);
+    }
+  }
   /**
    * Get the HTTP base URL derived from the WebSocket URL
    */
@@ -8083,6 +9222,44 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
   getCurrentUser() {
     return this._currentUser;
   }
+  /**
+   * Re-resolve the current user's EFFECTIVE roles from the server and refresh
+   * `getCurrentUser()`.
+   *
+   * Roles are deliberately not embedded in the JWT (they are resolved live
+   * server-side), so when an admin changes a user's roles/groups the token does
+   * not change — the client must re-ask. This re-runs the WS JWT auth handshake
+   * (which returns freshly resolved effective roles), updates `_currentUser`, and
+   * emits `USER_UPDATED` so role-gated UI can react without a reload.
+   *
+   * Called automatically when the server pushes `permissions:changed` after an
+   * access-control write, and exposed for on-demand refresh. Safe no-op when not
+   * authenticated.
+   */
+  async refreshCurrentUser() {
+    if (__privateGet(this, _refreshingUser)) return __privateGet(this, _refreshingUser);
+    const token = this.authManager.storage.getAccessToken();
+    if (!token) return;
+    __privateSet(this, _refreshingUser, (async () => {
+      const before = JSON.stringify(this._currentUser?.roles ?? null);
+      const prevNode = this._currentUser?.node;
+      try {
+        await this.authenticate({ type: "jwt", token });
+        if (this._currentUser && prevNode && !this._currentUser.node) {
+          this._currentUser.node = prevNode;
+        }
+        const after = JSON.stringify(this._currentUser?.roles ?? null);
+        if (after !== before) {
+          this._emitAuthEvent("USER_UPDATED");
+        }
+      } catch (err) {
+        logger.warn("[refreshCurrentUser] role re-resolve failed:", err);
+      } finally {
+        __privateSet(this, _refreshingUser, null);
+      }
+    })());
+    return __privateGet(this, _refreshingUser);
+  }
   /**
    * Get current user ID
    *
@@ -8291,7 +9468,10 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
   _emitAuthEvent(event) {
     const session = {
       user: this.getStoredUser(),
-      accessToken: this.authManager.storage.getAccessToken()
+      accessToken: this.authManager.storage.getAccessToken(),
+      // Surface effective roles so role-gated consumers can react to
+      // SIGNED_IN / USER_UPDATED without calling getCurrentUser() themselves.
+      roles: this._currentUser?.roles ?? null
     };
     const change = { event, session };
     for (const callback of this._authListeners) {
@@ -8331,6 +9511,7 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
    */
   async _subscribeToUserHome(repository, userHome) {
     await this._unsubscribeFromUserHome();
+    userHome = normalizeHomePath(userHome) ?? userHome;
     try {
       const db = this.database(repository);
       const pathParts = userHome.split("/").filter((p) => p.length > 0);
@@ -8630,7 +9811,7 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
     const branch = options.branch ?? this._context.branch ?? "main";
     const pathWithProperty = options.propertyPath ? `${options.path}@${options.propertyPath}` : options.path;
     const endpoint = `/api/repository/${options.repository}/${branch}/head/${options.workspace}${pathWithProperty}/raisin:sign`;
-    const response = await fetch(`${this._httpBaseUrl}${endpoint}`, {
+    const response = await this._fetchWithTimeout(`${this._httpBaseUrl}${endpoint}`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -8685,6 +9866,10 @@ var RaisinClient = class _RaisinClient extends import_events4.EventEmitter {
     return _RaisinClient.forSSR(baseUrl, options);
   }
 };
+_refreshingUser = new WeakMap();
+/** Hard cap on requests held while reconnecting; overflow rejects immediately. */
+_RaisinClient.MAX_QUEUED_REQUESTS = 100;
+var RaisinClient = _RaisinClient;
 
 // src/node-builder.ts
 var NodeBuilder = class _NodeBuilder {
@@ -8772,7 +9957,12 @@ var NodeBuilder = class _NodeBuilder {
     return this;
   }
   /**
-   * Set the order key
+   * Set the order key.
+   *
+   * @deprecated The server owns editorial ordering: the order key is assigned by
+   * the ordering index on write, so any value set here is overwritten. To place a
+   * node, create it (it appends to the end of its parent) then call
+   * `nodes.reorder()`, `nodes.moveChildBefore()` or `nodes.moveChildAfter()`.
    */
   orderKey(orderKey) {
     this.node.order_key = orderKey;
@@ -8852,10 +10042,10 @@ var NodeBuilder = class _NodeBuilder {
     if (!this.node.node_type) {
       throw new Error("Node type is required");
     }
+    if (this.node.order_key === void 0) this.node.order_key = "";
     if (!this.node.children) this.node.children = [];
     if (!this.node.relations) this.node.relations = [];
     if (!this.node.properties) this.node.properties = {};
-    if (!this.node.order_key) this.node.order_key = "a";
     if (typeof this.node.version !== "number") this.node.version = 1;
     return this.node;
   }
@@ -8937,8 +10127,8 @@ var NodeHelpers = class {
       node_type: "MockType",
       properties: {},
       children: [],
+      order_key: "",
       relations: [],
-      order_key: "a",
       version: 1,
       ...overrides
     };
@@ -9019,6 +10209,29 @@ function isTerminalEvent(event) {
   return event.type === "flow_completed" || event.type === "flow_failed";
 }
 
+// src/types/flow-definition.ts
+function getRefDisplayName(ref) {
+  const path = ref["raisin:path"] || ref["raisin:ref"];
+  const segments = path.split("/").filter(Boolean);
+  return segments[segments.length - 1] || path;
+}
+function getRefPath(ref) {
+  return ref["raisin:path"] || ref["raisin:ref"];
+}
+var RETRY_STRATEGIES = {
+  none: { max_retries: 0, base_delay_ms: 0, max_delay_ms: 0 },
+  quick: { max_retries: 3, base_delay_ms: 1e3, max_delay_ms: 1e4 },
+  standard: { max_retries: 5, base_delay_ms: 2e3, max_delay_ms: 6e4 },
+  aggressive: { max_retries: 10, base_delay_ms: 5e3, max_delay_ms: 12e4 },
+  llm: { max_retries: 5, base_delay_ms: 1e4, max_delay_ms: 12e4 }
+};
+function isFlowDefinitionStep(node) {
+  return node.node_type === "raisin:FlowStep";
+}
+function isFlowDefinitionContainer(node) {
+  return node.node_type === "raisin:FlowContainer";
+}
+
 // src/utils/plan-projection.ts
 function asRecord(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
@@ -9047,6 +10260,15 @@ function parsePlanTasks(rawTasks) {
     };
   }).filter((task) => task !== null);
 }
+var TERMINAL_TASK_STATUSES = /* @__PURE__ */ new Set(["completed", "cancelled"]);
+var TERMINAL_PLAN_STATUSES = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
+function setPlanStatus(plan, nextStatus) {
+  if (!nextStatus) return;
+  if (TERMINAL_PLAN_STATUSES.has(plan.status) && !TERMINAL_PLAN_STATUSES.has(nextStatus)) {
+    return;
+  }
+  plan.status = nextStatus;
+}
 function upsertTask(plan, nextTask) {
   const existingIndex = plan.tasks.findIndex(
     (task) => nextTask.taskId && task.taskId === nextTask.taskId || !nextTask.taskId && task.title === nextTask.title
@@ -9055,8 +10277,12 @@ function upsertTask(plan, nextTask) {
     plan.tasks.push(nextTask);
     return;
   }
+  const existing = plan.tasks[existingIndex];
+  if (TERMINAL_TASK_STATUSES.has(existing.status) && !TERMINAL_TASK_STATUSES.has(nextTask.status)) {
+    return;
+  }
   plan.tasks[existingIndex] = {
-    ...plan.tasks[existingIndex],
+    ...existing,
     ...nextTask
   };
 }
@@ -9100,7 +10326,7 @@ function projectPlansFromMessages(messages) {
       plan.planPath = planPath ?? plan.planPath;
       plan.planId = planId ?? plan.planId;
       plan.title = asString(data.title) || plan.title;
-      plan.status = asString(data.status) || plan.status;
+      setPlanStatus(plan, asString(data.status));
       plan.requiresApproval = Boolean(data.requires_approval) || plan.status === "pending_approval";
       plan.sourceMessagePath = message.path ?? plan.sourceMessagePath;
       const parsedTasks = parsePlanTasks(data.tasks);
@@ -9116,7 +10342,7 @@ function projectPlansFromMessages(messages) {
       const plan = ensurePlan(plans, key, "Plan", timestamp);
       plan.planPath = planPath ?? plan.planPath;
       plan.planId = planId ?? plan.planId;
-      plan.status = asString(data.plan_status) || plan.status;
+      setPlanStatus(plan, asString(data.plan_status));
       plan.requiresApproval = plan.status === "pending_approval";
       const taskUpdate = {
         taskId: asString(data.task_id),
@@ -9143,6 +10369,12 @@ function projectPlansFromMessages(messages) {
       }
     }
   }
+  for (const plan of plans.values()) {
+    if (!TERMINAL_PLAN_STATUSES.has(plan.status) && plan.tasks.length > 0 && plan.tasks.every((task) => TERMINAL_TASK_STATUSES.has(task.status))) {
+      plan.status = "completed";
+      plan.requiresApproval = false;
+    }
+  }
   return [...plans.values()].sort((a, b) => {
     const aTime = Date.parse(a.updatedAt || "");
     const bTime = Date.parse(b.updatedAt || "");
@@ -9357,10 +10589,12 @@ var ConversationStore = class {
     }
     switch (event.type) {
       case "text_chunk":
+        this.markStreamingActivity();
         this._streamingText += event.text;
         this.notify();
         break;
       case "thought_chunk":
+        this.markStreamingActivity();
         this.notify();
         break;
       case "assistant_message":
@@ -9369,6 +10603,7 @@ var ConversationStore = class {
         this.notify();
         break;
       case "tool_call_started": {
+        this.markStreamingActivity();
         logger.debug("[ConversationStore] Tool started:", event.functionName);
         const info = {
           id: event.toolCallId,
@@ -9381,6 +10616,7 @@ var ConversationStore = class {
         break;
       }
       case "tool_call_completed": {
+        this.markStreamingActivity();
         logger.debug("[ConversationStore] Tool completed:", event.toolCallId);
         const idx = this._activeToolCalls.findIndex((tc) => tc.id === event.toolCallId);
         if (idx >= 0) {
@@ -9455,6 +10691,7 @@ var ConversationStore = class {
         logger.error("[ConversationStore] Turn failed", event.error);
         this._error = event.error;
         this._isStreaming = false;
+        this._isWaiting = false;
         this._streamingText = "";
         this._activeToolCalls = [];
         this.clearStreamingTimer();
@@ -9492,6 +10729,26 @@ var ConversationStore = class {
       }
     }
   }
+  /**
+   * Agent activity observed while the store thought the turn was over.
+   *
+   * This happens when execution continues WITHOUT a user message — plan
+   * approval in approve_then_auto / step_by_step (approvePlan() returns an
+   * enqueue receipt and the agent starts executing), or agent-initiated
+   * follow-ups. The events arrive over the persistent live subscription
+   * (no history replay), so activity is always "now": re-enter streaming
+   * state so UIs show progress and the end-of-turn handling (done/waiting
+   * → deferred reload) runs again for this continuation.
+   */
+  markStreamingActivity() {
+    if (this._isStreaming) return;
+    logger.debug("[ConversationStore] Agent activity while idle \u2014 re-entering streaming state");
+    this._isStreaming = true;
+    this._isWaiting = false;
+    this._streamingText = "";
+    this.resetStreamingTimer();
+    this.startWatchdog();
+  }
   /**
    * If accumulated streaming text hasn't been captured in an assistant_message,
    * synthesize one.
@@ -9725,6 +10982,14 @@ var ConversationStore = class {
 };
 
 // src/stores/conversation-list-store.ts
+function buildChatsSubscriptionFilters(userHome) {
+  const home = normalizeHomePath(userHome) ?? userHome;
+  return {
+    workspace: "raisin:access_control",
+    path: `${home}/inbox/chats/**`,
+    event_types: ["node:created", "node:updated"]
+  };
+}
 var ConversationListStore = class {
   constructor(options) {
     this.subscribers = /* @__PURE__ */ new Set();
@@ -9870,13 +11135,8 @@ var ConversationListStore = class {
       const rows = result.rows;
       const userHome = rows?.[0]?.home;
       if (!userHome) return;
-      const chatsPath = `${userHome}/inbox/chats`;
       this._realtimeSubscription = await events.subscribe(
-        {
-          workspace: "raisin:access_control",
-          path: chatsPath,
-          event_types: ["node:created", "node:updated"]
-        },
+        buildChatsSubscriptionFilters(userHome),
         async (event) => {
           const eventData = event;
           const nodeId = eventData.payload?.node_id;
@@ -9982,7 +11242,7 @@ function useConversation(react, options) {
 var INITIAL_LIST_SNAPSHOT = {
   conversations: [],
   totalUnreadCount: 0,
-  isLoading: false,
+  isLoading: true,
   error: null
 };
 function useConversationList(react, options) {
@@ -10860,6 +12120,160 @@ function createRaisinReact(react) {
     useFlow: useFlow2
   };
 }
+
+// src/integrations/vue/vue-auth.ts
+function createUseAuth2(vue) {
+  return function useAuth(client) {
+    const adapter = createAuthAdapter(client);
+    const snapshot = vue.ref(adapter.getSnapshot());
+    const unsubscribe = adapter.subscribe((s) => {
+      snapshot.value = s;
+    });
+    vue.onUnmounted(() => {
+      unsubscribe();
+      adapter.destroy();
+    });
+    return {
+      user: vue.computed(() => snapshot.value.user),
+      isAuthenticated: vue.computed(() => snapshot.value.isAuthenticated),
+      isLoading: vue.computed(() => snapshot.value.isLoading),
+      login: adapter.login,
+      register: adapter.register,
+      logout: adapter.logout,
+      initSession: adapter.initSession
+    };
+  };
+}
+
+// src/integrations/vue/vue-connection.ts
+function createUseConnection2(vue) {
+  return function useConnection(client) {
+    const adapter = createConnectionAdapter(client);
+    const snapshot = vue.ref(adapter.getSnapshot());
+    const unsubscribe = adapter.subscribe((s) => {
+      snapshot.value = s;
+    });
+    vue.onUnmounted(() => {
+      unsubscribe();
+      adapter.destroy();
+    });
+    return {
+      state: vue.computed(() => snapshot.value.state),
+      isConnected: vue.computed(() => snapshot.value.isConnected),
+      isReady: vue.computed(() => snapshot.value.isReady),
+      connect: adapter.connect,
+      disconnect: adapter.disconnect
+    };
+  };
+}
+
+// src/integrations/vue/vue-sql.ts
+function createUseSql2(vue) {
+  return function useSql(database, sql, params, options) {
+    const adapter = createSqlAdapter(database, sql, params, options);
+    const snapshot = vue.ref(adapter.getSnapshot());
+    const unsubscribe = adapter.subscribe((s) => {
+      snapshot.value = s;
+    });
+    vue.onUnmounted(() => {
+      unsubscribe();
+      adapter.destroy();
+    });
+    return {
+      data: vue.computed(() => snapshot.value.data),
+      isLoading: vue.computed(() => snapshot.value.isLoading),
+      error: vue.computed(() => snapshot.value.error),
+      refetch: adapter.refetch
+    };
+  };
+}
+
+// src/integrations/vue/vue-subscription.ts
+function createUseSubscription2(vue) {
+  return function useSubscription(database, filters, callback) {
+    const adapter = createSubscriptionAdapter(database, filters, callback);
+    vue.onUnmounted(() => adapter.destroy());
+    return {
+      unsubscribe: () => adapter.destroy()
+    };
+  };
+}
+
+// src/integrations/vue/vue-conversation.ts
+function createUseConversation(vue) {
+  return function useConversation2(options) {
+    const store = new ConversationStore(options);
+    const snapshot = vue.ref(store.getSnapshot());
+    const unsubscribe = store.subscribe((s) => {
+      snapshot.value = s;
+    });
+    vue.onUnmounted(() => {
+      unsubscribe();
+      store.destroy();
+    });
+    return {
+      conversation: vue.computed(() => snapshot.value.conversation),
+      messages: vue.computed(() => snapshot.value.messages),
+      isStreaming: vue.computed(() => snapshot.value.isStreaming),
+      isWaiting: vue.computed(() => snapshot.value.isWaiting),
+      streamingText: vue.computed(() => snapshot.value.streamingText),
+      error: vue.computed(() => snapshot.value.error),
+      activeToolCalls: vue.computed(() => snapshot.value.activeToolCalls),
+      plans: vue.computed(() => snapshot.value.plans),
+      isLoading: vue.computed(() => snapshot.value.isLoading),
+      conversationPath: vue.computed(() => snapshot.value.conversationPath),
+      sendMessage: (content) => store.sendMessage(content),
+      approvePlan: async (planPath) => {
+        await store.approvePlan(planPath);
+      },
+      rejectPlan: async (planPath, feedback) => {
+        await store.rejectPlan(planPath, feedback);
+      },
+      stop: () => store.stop(),
+      loadMessages: () => store.loadMessages(),
+      store
+    };
+  };
+}
+function createUseConversationList(vue) {
+  return function useConversationList2(options) {
+    const store = new ConversationListStore(options);
+    const snapshot = vue.ref(store.getSnapshot());
+    const unsubscribe = store.subscribe((s) => {
+      snapshot.value = s;
+    });
+    store.load().catch((err) => {
+      logger.error("[useConversationList] Initial load failed:", err);
+    });
+    vue.onUnmounted(() => {
+      unsubscribe();
+      store.destroy();
+    });
+    return {
+      conversations: vue.computed(() => snapshot.value.conversations),
+      totalUnreadCount: vue.computed(() => snapshot.value.totalUnreadCount),
+      isLoading: vue.computed(() => snapshot.value.isLoading),
+      error: vue.computed(() => snapshot.value.error),
+      createConversation: (opts) => store.createConversation(opts),
+      deleteConversation: (conversationPath) => store.deleteConversation(conversationPath),
+      markAsRead: (conversationPath) => store.markAsRead(conversationPath),
+      refresh: () => store.load(),
+      store
+    };
+  };
+}
+
+// src/integrations/vue/index.ts
+function createRaisinVue(vue) {
+  return {
+    useAuth: createUseAuth2(vue),
+    useConnection: createUseConnection2(vue),
+    useSql: createUseSql2(vue),
+    useSubscription: createUseSubscription2(vue),
+    useConversation: createUseConversation(vue),
+    useConversationList: createUseConversationList(vue)
+  };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AllNodeEventTypes,
@@ -10881,6 +12295,7 @@ function createRaisinReact(react) {
   DEFAULT_RETRY_BASE_DELAY,
   DEFAULT_RETRY_MAX_DELAY,
   DEFAULT_RETRY_OPTIONS,
+  DEFAULT_SEND_MESSAGE_INACTIVITY_TIMEOUT_MS,
   Database,
   ElementTypes,
   EventHandler,
@@ -10888,11 +12303,16 @@ function createRaisinReact(react) {
   FlowClient,
   FlowsApi,
   FunctionsApi,
+  HttpArchetypes,
   HttpDatabase,
+  HttpElementTypes,
   HttpFunctionsApi,
+  HttpNodeTypes,
   HttpWorkspaceClient,
+  InboxApi,
   LocalStorageTokenStorage,
   LogLevel,
+  McpClient,
   MemoryTokenStorage,
   NodeBuilder,
   NodeEventType,
@@ -10901,6 +12321,7 @@ function createRaisinReact(react) {
   NodeOperations,
   NodeTypes,
   RAISIN_CONTEXT_KEY,
+  RETRY_STRATEGIES,
   RaisinAbortError,
   RaisinAuthError,
   RaisinClient,
@@ -10915,6 +12336,7 @@ function createRaisinReact(react) {
   ResponseStatus,
   RetryBuilder,
   SSEClient,
+  SchedulerApi,
   SqlQuery,
   Tags,
   Transaction,
@@ -10936,6 +12358,7 @@ function createRaisinReact(react) {
   createFlowAdapter,
   createLoader,
   createRaisinReact,
+  createRaisinVue,
   createRequestScopedClient,
   createSSRClient,
   createSqlAdapter,
@@ -10948,13 +12371,18 @@ function createRaisinReact(react) {
   getErrorMessage,
   getLogLevel,
   getLoggerConfig,
+  getRefDisplayName,
+  getRefPath,
   isEventMessage,
+  isFlowDefinitionContainer,
+  isFlowDefinitionStep,
   isHttpClient,
   isResponseEnvelope,
   isRetryableError,
   isTerminalEvent,
   isWebSocketClient,
   logger,
+  normalizeHomePath,
   projectPlansFromMessages,
   rowsToObjects,
   setLogLevel,
@@ -10964,3 +12392,4 @@ function createRaisinReact(react) {
   useFlow,
   withRetry
 });
+//# sourceMappingURL=index.js.map