@rebasepro/client 0.22.0 → 0.24.0

package/dist/index.es.js

@@ -1,5 +1,5 @@
-import { DEFAULT_STORAGE_SOURCE_KEY, EntityReference, EntityRelation, GeoPoint, PUBLIC_STORAGE_PREFIX, RebaseApiError, RebaseApiError as RebaseApiError$1, RebaseClientError, RebaseClientError as RebaseClientError$1, SCHEMA_VERSION_HEADER, Vector, hasFieldOperation, isPublicStoragePath, isUnsupported, parseRelationAggregateSort, sortKeyToString, toCanonicalOp, unsupportedMethod } from "@rebasepro/types";
-import { COMPOSITE_ID_SEPARATOR, QueryBuilder, RebasePaginationError, and, buildCompositeId, collectAllPages, cond, mergeIncludeSpecs, normalizeOrderBy, not, or, paginateFind, resolveFindWindow, serializeFilter, serializeInclude, serializeLogicalCondition, serializeOrderBy } from "@rebasepro/common";
+import { DEFAULT_STORAGE_SOURCE_KEY, EntityReference, EntityRelation, GeoPoint, IMPERSONATE_HEADER, PUBLIC_STORAGE_PREFIX, RebaseApiError, RebaseApiError as RebaseApiError$1, RebaseClientError, RebaseClientError as RebaseClientError$1, SCHEMA_VERSION_HEADER, STORAGE_REFERENCE_SCHEME, Vector, hasFieldOperation, isPublicStoragePath, isStorageReference, isUnsupported, parseRelationAggregateSort, parseStorageReference, resolveStorageReferences, sortKeyToString, storageObjectPath, storageReference, toCanonicalOp, unsupportedMethod } from "@rebasepro/types";
+import { COMPOSITE_ID_SEPARATOR, QueryBuilder, RESERVED_QUERY_KEYS, RebasePaginationError, and, buildCompositeId, collectAllPages, cond, mergeIncludeSpecs, normalizeOrderBy, not, or, paginateFind, resolveFindWindow, serializeFilter, serializeInclude, serializeLogicalCondition, serializeOrderBy } from "@rebasepro/common";
 import { splitSearchTerms, toSnakeCase, unref } from "@rebasepro/utils";
 //#region src/reviver.ts
 function rebaseReviver(_key, value) {
@@ -118,13 +118,33 @@ function buildQueryString(params) {
 		const serialized = (root.conditions ?? []).map(serializeLogicalCondition).join(",");
 		parts.push(`${root.type}=${encodeURIComponent(`(${serialized})`)}`);
 	}
-	if (params.where) {
-		assertNoUndefinedFilterValues(params.where);
-		const serialized = serializeFilter(params.where);
-		for (const [field, value] of Object.entries(serialized)) if (Array.isArray(value)) for (const v of value) parts.push(`${encodeURIComponent(field)}=${encodeURIComponent(v)}`);
+	if (params.where) appendWhere(parts, params.where);
+	return parts.length > 0 ? "?" + parts.join("&") : "";
+}
+/**
+* Append a `where` to a query string, one `?<field>=<op>.<value>` parameter per
+* condition.
+*
+* Except on a column whose name the server reads as a parameter of its own —
+* `page`, `select`, `hard`, `where` ({@link RESERVED_QUERY_KEYS}). A filter on
+* such a column sent as its own parameter is read as that parameter, and the
+* filter is never applied. Those conditions go inside `?where=` instead, in the
+* same dot-string spelling, which the server decodes through the same codec and
+* merges in. A collection with no such column sends exactly what it did before.
+*/
+function appendWhere(parts, where) {
+	assertNoUndefinedFilterValues(where);
+	const serialized = serializeFilter(where);
+	const reserved = {};
+	for (const [field, value] of Object.entries(serialized)) {
+		if (RESERVED_QUERY_KEYS.has(field)) {
+			reserved[field] = value;
+			continue;
+		}
+		if (Array.isArray(value)) for (const v of value) parts.push(`${encodeURIComponent(field)}=${encodeURIComponent(v)}`);
 		else parts.push(`${encodeURIComponent(field)}=${encodeURIComponent(value)}`);
 	}
-	return parts.length > 0 ? "?" + parts.join("&") : "";
+	if (Object.keys(reserved).length > 0) parts.push(`where=${encodeURIComponent(JSON.stringify(reserved))}`);
 }
 /**
 * The query string for `GET /<collection>/aggregate`.
@@ -145,21 +165,46 @@ function buildAggregateQueryString(params) {
 	parts.push(`select=${encodeURIComponent(select)}`);
 	if (params.groupBy && params.groupBy.length > 0) parts.push(`groupBy=${encodeURIComponent(params.groupBy.join(","))}`);
 	if (params.limit != null) parts.push(`limit=${params.limit}`);
+	if (params.offset != null) parts.push(`offset=${params.offset}`);
 	if (params.searchString) parts.push(`searchString=${encodeURIComponent(params.searchString)}`);
 	if (params.logical) {
 		const root = params.logical;
 		const serialized = (root.conditions ?? []).map(serializeLogicalCondition).join(",");
 		parts.push(`${root.type}=${encodeURIComponent(`(${serialized})`)}`);
 	}
-	if (params.where) {
-		assertNoUndefinedFilterValues(params.where);
-		const serialized = serializeFilter(params.where);
-		for (const [field, value] of Object.entries(serialized)) if (Array.isArray(value)) for (const v of value) parts.push(`${encodeURIComponent(field)}=${encodeURIComponent(v)}`);
-		else parts.push(`${encodeURIComponent(field)}=${encodeURIComponent(value)}`);
-	}
+	if (params.where) appendWhere(parts, params.where);
 	return "?" + parts.join("&");
 }
 /**
+* The 401 codes that mean "the credential on this request is no good", which a
+* refreshed token can fix.
+*
+* The rest of the 401s are answers about something the caller *sent*: a wrong
+* current password (`INVALID_CREDENTIALS`), a mistyped MFA code (`INVALID_CODE`,
+* `CHALLENGE_EXHAUSTED`), a sign-in that needs a second factor
+* (`MFA_REQUIRED`). Refreshing and resending one of those rotated the session
+* for nothing, sent the same wrong answer twice — and an MFA challenge claims
+* an attempt before it judges the code, so every typo cost two of its five.
+*/
+var TOKEN_REFUSAL_CODES = /* @__PURE__ */ new Set([
+	"UNAUTHORIZED",
+	"INVALID_TOKEN",
+	"TOKEN_EXPIRED",
+	"SESSION_REVOKED"
+]);
+/**
+* Whether a 401's body says the token was the problem.
+*
+* A 401 with no code at all counts: it is what an older server, a proxy or
+* anything not speaking the envelope sends, and there the token is the
+* likeliest cause — refreshing is what this client always did with it.
+*/
+function isTokenRefusal(body) {
+	const error = body?.error;
+	const code = error && typeof error === "object" ? error.code : void 0;
+	return typeof code !== "string" || code === "" || TOKEN_REFUSAL_CODES.has(code);
+}
+/**
 * The base every request and every caller-built URL resolves against.
 *
 * `baseUrl` is optional because the common production shape is a Rebase
@@ -248,15 +293,18 @@ function createTransport(config, environment) {
 	}
 	const defaultHeaders = {
 		...config.headers ?? {},
-		...config.schemaVersion ? { [SCHEMA_VERSION_HEADER]: config.schemaVersion } : {}
+		...config.schemaVersion ? { [SCHEMA_VERSION_HEADER]: config.schemaVersion } : {},
+		...config.impersonate !== void 0 ? { [IMPERSONATE_HEADER]: config.impersonate } : {}
 	};
 	function getHeaders(activeToken, init) {
-		return {
+		const headers = {
 			"Content-Type": "application/json",
 			...defaultHeaders,
 			...activeToken ? { Authorization: `Bearer ${activeToken}` } : {},
 			...init?.headers || {}
 		};
+		if (init?.body instanceof FormData) delete headers["Content-Type"];
+		return headers;
 	}
 	/**
 	* The refusal for a success status carrying a body this client cannot read.
@@ -330,7 +378,6 @@ function createTransport(config, environment) {
 		} catch (e) {}
 		warnIfAnonymousServerClient(activeToken);
 		const headers = getHeaders(activeToken, init);
-		if (init?.body instanceof FormData) delete headers["Content-Type"];
 		const res = await fetchFn(url, {
 			...init,
 			headers
@@ -363,7 +410,7 @@ function createTransport(config, environment) {
 		} catch (e) {
 			unreadableBody = true;
 		}
-		if (res.status === 401 && onUnauthorizedHandler) {
+		if (res.status === 401 && onUnauthorizedHandler && isTokenRefusal(body)) {
 			if (await onUnauthorizedHandler()) {
 				let retryToken = token;
 				if (tokenGetter) try {
@@ -450,6 +497,7 @@ function mapRawUser(raw) {
 		providerId: raw.providerId ?? "password",
 		isAnonymous: raw.isAnonymous ?? false,
 		emailVerified: raw.emailVerified,
+		...raw.pendingEmail !== void 0 ? { pendingEmail: raw.pendingEmail } : {},
 		roles: raw.roles,
 		metadata: raw.metadata
 	};
@@ -505,9 +553,22 @@ function createAuth(transport, options) {
 	const REFRESH_RETRY_BASE_MS = 1e3;
 	const REFRESH_RETRY_MAX_MS = 3e4;
 	let currentSession = null;
+	/**
+	* Which sign-in `currentSession` belongs to. Bumped whenever the session
+	* is replaced by anything other than its own refresh — a sign-in, a
+	* sign-out, a revocation, a local abandon — so a refresh already in flight
+	* can tell, when its answer lands, that the session it was refreshing has
+	* ended. Its answer is then dropped: adopting it put a signed-out session
+	* back in memory, in storage and on the transport, announced
+	* TOKEN_REFRESHED after SIGNED_OUT, and overwrote whoever had signed in
+	* since.
+	*/
+	let sessionEpoch = 0;
 	const listeners = /* @__PURE__ */ new Set();
 	let refreshTimeout = null;
 	let inFlightRefresh = null;
+	/** The `sessionEpoch` the in-flight refresh was started for. */
+	let inFlightEpoch = -1;
 	let resolveInitialized;
 	const isInitialized = new Promise((resolve) => {
 		resolveInitialized = resolve;
@@ -518,13 +579,56 @@ function createAuth(transport, options) {
 	function getFetch() {
 		return transport.fetchFn || globalThis.fetch;
 	}
-	function throwApiError(status, body, statusText) {
-		throw new RebaseApiError(body?.error?.message || body?.message || statusText, {
+	/**
+	* The body of a request that presents the refresh token — `/refresh` and
+	* `/logout`.
+	*
+	* Empty in cookie mode. The token is in an HttpOnly cookie the browser
+	* attaches, and this client never holds it: what it holds is the `""` the
+	* server answers in its place. Sending that back was sending a blank token
+	* beside the cookie, and a server that refused the blank (0.10.0 through
+	* 0.23, with 400 INVALID_INPUT) never read the cookie — so no tab that outlived
+	* its access token could renew it, while a reload, which had no session in
+	* memory and so sent no field, could.
+	*/
+	function refreshTokenBody() {
+		return JSON.stringify(authFlowMode === "cookie" ? {} : { refreshToken: currentSession?.refreshToken });
+	}
+	/**
+	* The refresh token a new session keeps, given the one an answer carried.
+	*
+	* In cookie mode, none: the server answers `refreshToken: ""` because the
+	* cookie holds it, and that `""` is "not held here", not a token to carry
+	* forward or present. Otherwise the answer's token, or — from a server
+	* that omits it on a rotation it did not make — the one already held.
+	*/
+	function heldRefreshToken(received) {
+		if (authFlowMode === "cookie") return "";
+		return received || currentSession?.refreshToken || "";
+	}
+	/**
+	* Whether the server refused a refresh as malformed: a 400, which says the
+	* request this client built is not one that server accepts.
+	*
+	* That is a client/server contract mismatch, not a blip. The identical
+	* request is refused identically however often it is sent, so retrying it
+	* on a backoff only hides the error behind six identical ones — which is
+	* how a cookie-mode tab, refused this way after every wake from sleep,
+	* quietly ended on its login screen.
+	*/
+	function isMalformedRefreshError(err) {
+		return err instanceof RebaseApiError && err.status === 400;
+	}
+	function apiError(status, body, statusText) {
+		return new RebaseApiError(body?.error?.message || body?.message || statusText, {
 			status,
 			code: body?.error?.code || body?.code,
 			details: body?.error?.details || body?.details
 		});
 	}
+	function throwApiError(status, body, statusText) {
+		throw apiError(status, body, statusText);
+	}
 	function emit(event, session) {
 		for (const fn of listeners) try {
 			fn(event, session);
@@ -569,10 +673,25 @@ function createAuth(transport, options) {
 	* may be stale precisely because a sibling tab holds a live one, and
 	* logging out on its behalf would turn one tab's bad luck into everybody
 	* being signed out — the exact failure this work exists to remove.
+	*
+	* Storage is left alone when it no longer holds the session being
+	* abandoned. It is shared with every other tab of the app, so a different
+	* session there is a sibling's live one — a rotation this tab missed, or
+	* another sign-in — and deleting it signed that tab out on its next load.
 	*/
 	function abandonSessionLocally() {
+		endSession(storageHoldsCurrentSession());
+	}
+	/** Whether storage holds this client's session — or no session at all. */
+	function storageHoldsCurrentSession() {
+		const persisted = loadStoredSession();
+		return !persisted || !currentSession || persisted.refreshToken === currentSession.refreshToken;
+	}
+	/** Drop the session from memory, storage and the transport, and say so. */
+	function endSession(clearStorage = true) {
+		sessionEpoch++;
 		currentSession = null;
-		clearStoredSession();
+		if (clearStorage) clearStoredSession();
 		if (refreshTimeout) {
 			clearTimeout(refreshTimeout);
 			refreshTimeout = null;
@@ -600,32 +719,40 @@ function createAuth(transport, options) {
 			abandonSessionLocally();
 			return false;
 		}
+		const epoch = sessionEpoch;
 		try {
 			await refreshSession();
-			return true;
+			return epoch === sessionEpoch;
 		} catch (err) {
-			if (isFatalRefreshError(err)) abandonSessionLocally();
+			if (epoch === sessionEpoch && isFatalRefreshError(err)) abandonSessionLocally();
 			return false;
 		}
 	}
 	async function attemptScheduledRefresh(attempt) {
+		const epoch = sessionEpoch;
 		try {
 			await refreshSession();
 		} catch (err) {
+			if (epoch !== sessionEpoch) return;
 			if (isFatalRefreshError(err)) {
 				abandonSessionLocally();
 				return;
 			}
+			if (isMalformedRefreshError(err)) return;
 			if (attempt >= MAX_REFRESH_RETRIES) {
-				abandonSessionLocally();
+				if (err instanceof RebaseApiError && (err.status === 401 || err.status === 403)) abandonSessionLocally();
 				return;
 			}
-			const backoff = Math.min(REFRESH_RETRY_BASE_MS * 2 ** attempt, REFRESH_RETRY_MAX_MS);
-			refreshTimeout = setTimeout(() => {
-				attemptScheduledRefresh(attempt + 1);
-			}, backoff);
+			scheduleRetry(attempt);
 		}
 	}
+	/** Try the scheduled refresh again after a backoff: 1s, 2s, 4s, … capped. */
+	function scheduleRetry(attempt) {
+		const backoff = Math.min(REFRESH_RETRY_BASE_MS * 2 ** attempt, REFRESH_RETRY_MAX_MS);
+		refreshTimeout = setTimeout(() => {
+			attemptScheduledRefresh(attempt + 1);
+		}, backoff);
+	}
 	function scheduleRefresh(expiresAt) {
 		if (refreshTimeout) clearTimeout(refreshTimeout);
 		if (!autoRefresh) return;
@@ -666,10 +793,11 @@ function createAuth(transport, options) {
 		}
 	}
 	function handleAuthResponse(data, event) {
+		sessionEpoch++;
 		const user = mapRawUser(data.user);
 		const session = {
 			accessToken: data.tokens.accessToken,
-			refreshToken: data.tokens.refreshToken || currentSession?.refreshToken || "",
+			refreshToken: heldRefreshToken(data.tokens.refreshToken),
 			expiresAt: data.tokens.accessTokenExpiresAt,
 			user
 		};
@@ -714,8 +842,15 @@ function createAuth(transport, options) {
 		});
 		const body = await res.json().catch(() => ({}));
 		if (!res.ok) throwApiError(res.status, body, res.statusText);
+		if (body && typeof body === "object" && "confirmationRequired" in body && body.confirmationRequired === true) return {
+			confirmationRequired: true,
+			user: null,
+			accessToken: null,
+			refreshToken: null
+		};
 		const session = handleAuthResponse(body, "SIGNED_IN");
 		return {
+			confirmationRequired: false,
 			user: session.user,
 			accessToken: session.accessToken,
 			refreshToken: session.refreshToken
@@ -847,23 +982,17 @@ function createAuth(transport, options) {
 		});
 	}
 	async function signOut() {
+		sessionEpoch++;
 		const fetchFn = getFetch();
 		try {
 			if (authFlowMode === "cookie" || currentSession?.refreshToken) await fetchFn(authUrl("/logout"), {
 				method: "POST",
 				headers: { "Content-Type": "application/json" },
-				body: JSON.stringify({ refreshToken: currentSession?.refreshToken }),
+				body: refreshTokenBody(),
 				credentials: authFlowMode === "cookie" ? "include" : void 0
 			});
 		} catch (e) {}
-		currentSession = null;
-		clearStoredSession();
-		if (refreshTimeout) {
-			clearTimeout(refreshTimeout);
-			refreshTimeout = null;
-		}
-		transport.setToken(null);
-		emit("SIGNED_OUT", null);
+		endSession();
 	}
 	/**
 	* Serialise refreshes across TABS, not just within one.
@@ -899,32 +1028,112 @@ function createAuth(transport, options) {
 		}
 	}
 	function refreshSession() {
-		if (inFlightRefresh) return inFlightRefresh;
-		inFlightRefresh = withRefreshLock(() => doRefreshSession()).finally(() => {
-			inFlightRefresh = null;
+		if (inFlightRefresh && inFlightEpoch === sessionEpoch) return inFlightRefresh;
+		const refresh = withRefreshLock(() => doRefreshSession()).finally(() => {
+			if (inFlightRefresh === refresh) inFlightRefresh = null;
 		});
-		return inFlightRefresh;
+		inFlightRefresh = refresh;
+		inFlightEpoch = sessionEpoch;
+		return refresh;
+	}
+	/**
+	* What a refresh answers when its session ended while it was in flight.
+	*
+	* The tokens it received belong to a session this client no longer holds,
+	* so they are dropped, and so is any error it hit: a refusal of the old
+	* session's token says nothing about the new one, and acting on it signed
+	* out whoever had signed in since. The caller gets the session there is
+	* now — or, if there is none, is told so.
+	*/
+	function supersededRefresh() {
+		if (currentSession) return currentSession;
+		throw new RebaseClientError$1("The session was signed out while it was being refreshed.", { code: "NOT_SIGNED_IN" });
+	}
+	/**
+	* The session a sibling tab has persisted since this one last looked, when
+	* it continues this one.
+	*
+	* Tabs of one app share `localStorage` but each holds its session in
+	* memory, and a refresh rotates the refresh token. Once one tab has
+	* refreshed, every other tab is holding a token the server has already
+	* superseded: presented after the server's reuse window it is refused
+	* with TOKEN_ALREADY_USED, again on every retry, until the tab gives up
+	* and signs out. Its replacement was in storage all along.
+	*
+	* Only a session of the same user counts. A different user in storage
+	* means another tab signed someone else in, and that is not this tab's
+	* session to take over.
+	*/
+	function siblingSession() {
+		if (!persistSession || authFlowMode === "cookie" || !currentSession) return null;
+		const persisted = loadStoredSession();
+		if (!persisted?.accessToken || !persisted.refreshToken) return null;
+		if (persisted.refreshToken === currentSession.refreshToken) return null;
+		if (!persisted.user?.uid || persisted.user.uid !== currentSession.user?.uid) return null;
+		return persisted;
+	}
+	/**
+	* Take over a sibling's session. Its access token is used as it is while
+	* it has time left — exactly as a session restored on load would be — and
+	* otherwise this answers `null` and the caller refreshes, now with the
+	* sibling's refresh token rather than the superseded one.
+	*/
+	function adoptSibling(sibling) {
+		currentSession = sibling;
+		if (sibling.expiresAt - REFRESH_BUFFER_MS <= Date.now()) return null;
+		transport.setToken(sibling.accessToken);
+		scheduleRefresh(sibling.expiresAt);
+		emit("TOKEN_REFRESHED", sibling);
+		return sibling;
 	}
 	async function doRefreshSession() {
+		const epoch = sessionEpoch;
+		try {
+			const sibling = siblingSession();
+			if (sibling) {
+				const adopted = adoptSibling(sibling);
+				if (adopted) return adopted;
+			}
+			try {
+				return await requestRefresh(epoch);
+			} catch (err) {
+				const late = epoch === sessionEpoch && err instanceof RebaseApiError && err.code === "TOKEN_ALREADY_USED" ? siblingSession() : null;
+				if (!late) throw err;
+				return adoptSibling(late) ?? await requestRefresh(epoch);
+			}
+		} catch (err) {
+			if (epoch !== sessionEpoch) return supersededRefresh();
+			throw err;
+		}
+	}
+	async function requestRefresh(epoch) {
 		if (authFlowMode !== "cookie" && !currentSession?.refreshToken) throw new RebaseClientError$1("No active session to refresh. Sign in first, or set `authFlowMode: \"cookie\"` if the refresh token is held in an HttpOnly cookie.", { code: "NOT_SIGNED_IN" });
 		const res = await getFetch()(authUrl("/refresh"), {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify({ refreshToken: currentSession?.refreshToken }),
+			body: refreshTokenBody(),
 			credentials: authFlowMode === "cookie" ? "include" : void 0
 		});
 		const body = await res.json().catch(() => ({}));
-		if (!res.ok) throwApiError(res.status, body, res.statusText);
+		if (epoch !== sessionEpoch) return supersededRefresh();
+		if (!res.ok) {
+			const err = apiError(res.status, body, res.statusText);
+			if (isMalformedRefreshError(err)) console.error(`[rebase] POST ${authPath}/refresh was refused as malformed (${res.status}${err.code ? ` ${err.code}` : ""}): ${err.message}. The client and server disagree on the refresh request, so this session cannot be renewed and retrying will not help. Check that @rebasepro/client and @rebasepro/server are on compatible versions, and that \`authFlowMode\` matches the server's \`cookieAuth\`.`);
+			throw err;
+		}
 		const accessToken = body.tokens.accessToken;
 		transport.setToken(accessToken);
 		let user = currentSession?.user;
 		if (body.user && typeof body.user.uid === "string") user = mapRawUser(body.user);
-		else if (!user || !user.uid) try {
-			user = await getUser();
-		} catch {}
+		else if (!user || !user.uid) {
+			try {
+				user = await getUser();
+			} catch {}
+			if (epoch !== sessionEpoch) return supersededRefresh();
+		}
 		const session = {
 			accessToken,
-			refreshToken: body.tokens.refreshToken || currentSession?.refreshToken || "",
+			refreshToken: heldRefreshToken(body.tokens.refreshToken),
 			expiresAt: body.tokens.accessTokenExpiresAt,
 			user: user ?? EMPTY_USER
 		};
@@ -988,14 +1197,36 @@ function createAuth(transport, options) {
 		if (!res.ok) throwApiError(res.status, body, res.statusText);
 		return body;
 	}
+	/**
+	* Change the signed-in account's password. Every other session ends; this
+	* one is replaced by the fresh session the server answers with, so the
+	* client stays signed in.
+	*/
 	async function changePassword(oldPassword, newPassword) {
-		return transport.request(authPath + "/change-password", {
+		if (currentSession && currentSession.expiresAt <= Date.now() + 1e4) await refreshSession().catch(() => void 0);
+		const res = await getFetch()(authUrl("/change-password"), {
 			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...currentSession?.accessToken ? { Authorization: `Bearer ${currentSession.accessToken}` } : {}
+			},
 			body: JSON.stringify({
 				oldPassword,
 				newPassword
-			})
+			}),
+			credentials: authFlowMode === "cookie" ? "include" : void 0
 		});
+		const body = await res.json().catch(() => ({}));
+		if (!res.ok) throwApiError(res.status, body, res.statusText);
+		const result = body;
+		if (result.tokens && result.user) handleAuthResponse({
+			tokens: result.tokens,
+			user: result.user
+		}, "TOKEN_REFRESHED");
+		return {
+			success: result.success,
+			message: result.message
+		};
 	}
 	/**
 	* Link an OAuth provider to the **currently signed-in** account.
@@ -1024,14 +1255,113 @@ function createAuth(transport, options) {
 	async function sendVerificationEmail() {
 		return transport.request(authPath + "/send-verification", { method: "POST" });
 	}
-	async function verifyEmail(token) {
-		const res = await getFetch()(authUrl("/verify-email?token=" + encodeURIComponent(token)), {
-			method: "GET",
-			headers: { "Content-Type": "application/json" }
+	/**
+	* Verify the address with the token from the link.
+	*
+	* The link proves the inbox, not who registered the address, so the
+	* server keeps only what this call also proves: the current session (sent
+	* when this client is signed in as that account) or `password`. An account
+	* carrying a password or identity neither proves is refused with
+	* `PROOF_REQUIRED` and the token is left unspent — ask for the password,
+	* or pass `removeUnproven: true` to verify without it. With `password`,
+	* the call also signs in.
+	*/
+	async function verifyEmail(token, options) {
+		const fetchFn = getFetch();
+		const headers = { "Content-Type": "application/json" };
+		if (currentSession?.accessToken) headers.Authorization = `Bearer ${currentSession.accessToken}`;
+		const res = await fetchFn(authUrl("/verify-email"), {
+			method: "POST",
+			headers,
+			body: JSON.stringify({
+				token,
+				...options
+			}),
+			credentials: authFlowMode === "cookie" ? "include" : void 0
 		});
 		const body = await res.json().catch(() => ({}));
 		if (!res.ok) throwApiError(res.status, body, res.statusText);
-		return body;
+		const result = body;
+		const session = result.tokens && result.user ? handleAuthResponse({
+			tokens: result.tokens,
+			user: result.user
+		}, "SIGNED_IN") : null;
+		return {
+			success: result.success,
+			passwordRemoved: result.passwordRemoved,
+			removedProviders: result.removedProviders ?? [],
+			session
+		};
+	}
+	/**
+	* Move the signed-in account to `newEmail`. The server mails a link to the
+	* new address and a notice to the current one; nothing changes until the
+	* link is followed and {@link confirmEmailChange} is called with its
+	* token. A new request replaces the last.
+	*
+	* Rejects with `EMAIL_EXISTS` or `UNDELIVERABLE_ADDRESS` (409),
+	* `EMAIL_UNCHANGED` (400), `AAL2_REQUIRED` when the account has a second
+	* factor this session did not present, and `ANONYMOUS_USER` for a guest.
+	*/
+	async function changeEmail(newEmail) {
+		const data = await transport.request(authPath + "/change-email", {
+			method: "POST",
+			body: JSON.stringify({ newEmail })
+		});
+		if (currentSession) {
+			currentSession = {
+				...currentSession,
+				user: {
+					...currentSession.user,
+					pendingEmail: data.pendingEmail
+				}
+			};
+			saveSession(currentSession);
+			emit("USER_UPDATED", currentSession);
+		}
+		return {
+			pendingEmail: data.pendingEmail,
+			expiresAt: data.expiresAt
+		};
+	}
+	/**
+	* Follow an address-change link: the token from
+	* `<frontend>/confirm-email-change?token=…`. Needs no session — the link
+	* proves the new inbox — and when this client is signed in as the account
+	* it moved, its user is updated and `USER_UPDATED` is emitted.
+	*
+	* `removedProviders` names the sign-in providers detached because they
+	* vouched for the old address. Rejects with `INVALID_TOKEN` for a spent,
+	* replaced or expired link and `EMAIL_EXISTS` when the address was taken
+	* while the link waited.
+	*/
+	async function confirmEmailChange(token) {
+		const res = await getFetch()(authUrl("/confirm-email-change"), {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ token })
+		});
+		const body = await res.json().catch(() => ({}));
+		if (!res.ok) throwApiError(res.status, body, res.statusText);
+		const result = body;
+		if (currentSession && currentSession.user.uid === result.user.uid) {
+			currentSession = {
+				...currentSession,
+				user: {
+					...currentSession.user,
+					email: result.user.email,
+					emailVerified: true,
+					pendingEmail: null
+				}
+			};
+			saveSession(currentSession);
+			emit("USER_UPDATED", currentSession);
+		}
+		return {
+			uid: result.user.uid,
+			email: result.user.email,
+			removedProviders: result.removedProviders ?? []
+		};
 	}
 	async function sendMagicLink(email) {
 		const res = await getFetch()(authUrl("/magic-link"), {
@@ -1167,8 +1497,11 @@ function createAuth(transport, options) {
 		* Start enrolling a TOTP factor.
 		*
 		* Returns the secret and an `otpauth://` URI to render as a QR code,
-		* plus ten single-use recovery codes. **Show the recovery codes once
-		* and never again** — only their hashes are stored.
+		* plus — with the account's first factor — ten single-use recovery
+		* codes. **Show the recovery codes once and never again**: only their
+		* hashes are stored. Adding another factor keeps the codes the account
+		* has, and `recoveryCodes` is then `null`; `regenerateRecoveryCodes()`
+		* replaces them.
 		*
 		* The factor is not usable until `verify` confirms the user's
 		* authenticator produced a correct code from it.
@@ -1197,33 +1530,52 @@ function createAuth(transport, options) {
 		* Remove a factor. Requires an `aal2` session — one that has already
 		* answered a challenge — so a stolen `aal1` token cannot turn MFA off.
 		*/
+		/**
+		* Replace the account's recovery codes with ten new ones, shown once.
+		* Needs an `aal2` session. Adding a second factor keeps the codes the
+		* account already has; this is how to get new ones.
+		*/
+		async regenerateRecoveryCodes() {
+			return transport.request(authPath + "/mfa/recovery-codes", { method: "POST" });
+		},
 		async unenroll(factorId) {
 			return transport.request(authPath + "/mfa/unenroll", {
 				method: "DELETE",
 				body: JSON.stringify({ factorId })
 			});
 		},
-		/** Open a challenge against a verified factor. Expires in five minutes. */
-		async challenge(factorId) {
+		/**
+		* Open a challenge against a verified factor. Expires in five minutes.
+		*
+		* Pass `mfaToken` to finish a sign-in that was refused with
+		* `MFA_REQUIRED`: it is the `details.mfaToken` of that refusal, and the
+		* challenge is opened with it as this one request's credential. Without
+		* it, the challenge steps up the session this client already holds.
+		*/
+		async challenge(factorId, options) {
+			const payload = JSON.stringify({ factorId });
+			if (options?.mfaToken) return withPendingToken("/mfa/challenge", payload, options.mfaToken);
 			return transport.request(authPath + "/mfa/challenge", {
 				method: "POST",
-				body: JSON.stringify({ factorId })
+				body: payload
 			});
 		},
 		/**
 		* Answer a challenge with a TOTP code or a recovery code.
 		*
 		* This is where an MFA-enrolled account's real session is minted, at
-		* `aal2` — so the returned tokens replace the ones the sign-in handed
-		* back, and this client adopts them.
+		* `aal2` — so this client adopts the returned tokens and announces
+		* `SIGNED_IN`, exactly as any other sign-in does. Pass the same
+		* `mfaToken` the challenge was opened with when finishing a sign-in.
 		*/
-		async verifyChallenge(challengeId, code) {
-			const session = handleAuthResponse(await transport.request(authPath + "/mfa/challenge/verify", {
+		async verifyChallenge(challengeId, code, options) {
+			const payload = JSON.stringify({
+				challengeId,
+				code
+			});
+			const session = handleAuthResponse(options?.mfaToken ? await withPendingToken("/mfa/challenge/verify", payload, options.mfaToken) : await transport.request(authPath + "/mfa/challenge/verify", {
 				method: "POST",
-				body: JSON.stringify({
-					challengeId,
-					code
-				})
+				body: payload
 			}), "SIGNED_IN");
 			return {
 				user: session.user,
@@ -1232,6 +1584,31 @@ function createAuth(transport, options) {
 			};
 		}
 	};
+	/**
+	* POST to a challenge route with a sign-in's pending token as the credential.
+	*
+	* Straight to `fetch`, like the sign-in routes, and never through the
+	* transport: the token is a credential for these two requests only. Set on
+	* the transport it would go out on every request the app made while the
+	* code step was open — and stay there if the step were abandoned. It would
+	* also displace a session the client already holds, and a refused code
+	* (401 `INVALID_CODE`) would be taken for an expired session and refreshed
+	* and re-sent, spending a second of the challenge's attempts on it.
+	*/
+	async function withPendingToken(endpoint, payload, mfaToken) {
+		const res = await getFetch()(authUrl(endpoint), {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${mfaToken}`
+			},
+			body: payload,
+			credentials: authFlowMode === "cookie" ? "include" : void 0
+		});
+		const body = await res.json().catch(() => ({}));
+		if (!res.ok) throwApiError(res.status, body, res.statusText);
+		return body;
+	}
 	async function getSessions() {
 		return (await transport.request(authPath + "/sessions", { method: "GET" })).sessions;
 	}
@@ -1240,14 +1617,7 @@ function createAuth(transport, options) {
 	}
 	async function revokeAllSessions() {
 		const result = await transport.request(authPath + "/sessions", { method: "DELETE" });
-		currentSession = null;
-		clearStoredSession();
-		if (refreshTimeout) {
-			clearTimeout(refreshTimeout);
-			refreshTimeout = null;
-		}
-		transport.setToken(null);
-		emit("SIGNED_OUT", null);
+		endSession();
 		return result;
 	}
 	async function getAuthConfig() {
@@ -1275,12 +1645,18 @@ function createAuth(transport, options) {
 			resolveInitialized();
 		} else if (authFlowMode === "cookie" || stored.refreshToken) {
 			currentSession = stored;
+			const epoch = sessionEpoch;
 			refreshSession().then(() => {
 				resolveInitialized();
-			}).catch(() => {
-				currentSession = null;
-				clearStoredSession();
-				transport.setToken(null);
+			}).catch((err) => {
+				if (epoch === sessionEpoch && currentSession) if (isFatalRefreshError(err)) {
+					if (storageHoldsCurrentSession()) clearStoredSession();
+					currentSession = null;
+					transport.setToken(null);
+				} else {
+					transport.setToken(currentSession.accessToken);
+					if (autoRefresh && !isMalformedRefreshError(err)) scheduleRetry(0);
+				}
 				resolveInitialized();
 			});
 		} else resolveInitialized();
@@ -1323,6 +1699,8 @@ function createAuth(transport, options) {
 		linkProvider,
 		sendVerificationEmail,
 		verifyEmail,
+		changeEmail,
+		confirmEmailChange,
 		sendMagicLink,
 		verifyMagicLink,
 		sendEmailOtp,
@@ -1378,8 +1756,14 @@ function createCookieStorage(options = {}) {
 //#region src/admin.ts
 function createAdmin(transport, options) {
 	const adminPath = (options || {}).adminPath || "/admin";
-	async function listUsers() {
-		return transport.request(adminPath + "/users", { method: "GET" });
+	/**
+	* One page of users — the route's default is 25 — with the `total` that
+	* says whether there are more. Takes the same window as
+	* {@link listUsersPaginated}; without one, it used to hand back the first
+	* page typed as the whole list.
+	*/
+	async function listUsers(options) {
+		return listUsersPaginated(options);
 	}
 	async function listUsersPaginated(options) {
 		const params = new URLSearchParams();
@@ -1400,6 +1784,10 @@ function createAdmin(transport, options) {
 			body: JSON.stringify(data)
 		});
 	}
+	/**
+	* Change an account. `disabled: true` switches it off — no sign-in, no
+	* refresh, and every token it holds refused at once — without deleting it.
+	*/
 	async function updateUser(userId, data) {
 		return transport.request(adminPath + "/users/" + encodeURIComponent(userId), {
 			method: "PUT",
@@ -1409,6 +1797,14 @@ function createAdmin(transport, options) {
 	async function deleteUser(userId) {
 		return transport.request(adminPath + "/users/" + encodeURIComponent(userId), { method: "DELETE" });
 	}
+	/**
+	* Remove every second factor and recovery code the account has, and end
+	* its sessions — for someone who lost their authenticator and their
+	* codes. Needs `users:write`.
+	*/
+	async function resetMfa(userId) {
+		return transport.request(adminPath + "/users/" + encodeURIComponent(userId) + "/mfa", { method: "DELETE" });
+	}
 	async function resetPassword(userId, options) {
 		return transport.request(adminPath + "/users/" + encodeURIComponent(userId) + "/reset-password", {
 			method: "POST",
@@ -1428,6 +1824,7 @@ function createAdmin(transport, options) {
 		createUser,
 		updateUser,
 		deleteUser,
+		resetMfa,
 		resetPassword,
 		listRoles,
 		bootstrap
@@ -1474,17 +1871,24 @@ function createBackups(transport, options) {
 		return transport.request(backupsPath, { method: "GET" });
 	}
 	/**
-	* Download a backup's bytes. Uses an authenticated fetch (not the JSON
-	* transport) so the octet-stream response comes back as a Blob.
+	* Download a backup's bytes. Not through the JSON `request()`, since the
+	* answer is an octet-stream to hand back as a Blob — but through the
+	* transport's own `fetch` and headers all the same. It used the global
+	* `fetch` and a bare `Authorization` header, so a client configured with
+	* its own `fetch` or with default headers (a gateway key, the schema
+	* version) had every call but this one go where it was told.
 	*/
 	async function download(key) {
-		const token = await transport.resolveToken();
 		const url = `${transport.baseUrl}${transport.apiPath}${backupsPath}/download?key=${encodeURIComponent(key)}`;
-		const res = await fetch(url, {
+		const token = await transport.resolveToken();
+		const headers = transport.getHeaders();
+		delete headers["Content-Type"];
+		if (token) headers.Authorization = `Bearer ${token}`;
+		const res = await transport.fetchFn(url, {
 			method: "GET",
-			headers: token ? { Authorization: `Bearer ${token}` } : {}
+			headers
 		});
-		if (!res.ok) throw new Error(`Failed to download backup (${res.status})`);
+		if (!res.ok) throw new RebaseApiError$1(`Failed to download backup (${res.status})`, { status: res.status });
 		return res.blob();
 	}
 	return {
@@ -1495,7 +1899,8 @@ function createBackups(transport, options) {
 //#endregion
 //#region src/api-keys.ts
 /**
-* Creates a client for managing API keys via the admin routes.
+* Creates a client for the project's service keys, via the admin routes.
+* Needs `keys:read` / `keys:write`.
 *
 * @param transport - The shared HTTP transport created by `createTransport`.
 * @param options   - Optional overrides (e.g. a custom base path).
@@ -1536,6 +1941,43 @@ function createApiKeys(transport, options) {
 		revokeKey
 	};
 }
+/**
+* Creates a client for the signed-in account's own API keys — each acts as the
+* account and holds no scope it does not. Answers `PERSONAL_KEYS_DISABLED`
+* unless the backend sets `personalKeys: true` on the users collection.
+*/
+function createPersonalKeys(transport, options) {
+	const keysPath = options?.personalKeysPath || "/auth/keys";
+	const scopesPath = options?.scopesPath || "/auth/scopes";
+	/** List this account's keys (masked). */
+	async function listKeys() {
+		return transport.request(keysPath, { method: "GET" });
+	}
+	/** Create a key for this account. The full secret is included in the response. */
+	async function createKey(data) {
+		return transport.request(keysPath, {
+			method: "POST",
+			body: JSON.stringify(data)
+		});
+	}
+	/** Revoke one of this account's keys. */
+	async function revokeKey(id) {
+		return transport.request(keysPath + "/" + encodeURIComponent(id), { method: "DELETE" });
+	}
+	/**
+	* Every scope the backend knows, described, and the ones the caller holds —
+	* what a screen offering scopes for a key needs.
+	*/
+	async function listScopes() {
+		return transport.request(scopesPath, { method: "GET" });
+	}
+	return {
+		listKeys,
+		createKey,
+		revokeKey,
+		listScopes
+	};
+}
 //#endregion
 //#region src/sdk_query_builder.ts
 /**
@@ -1816,6 +2258,28 @@ var SDKQueryBuilder = class {
 */
 var NO_SOCKET = "Listen is only available when RebaseClient is configured with a websocketUrl, and not when it was created with realtime: false.";
 /**
+* Why a live query cannot be opened for these parameters, or `undefined` when
+* it can.
+*
+* A `listen()` is the same query as the `find()` beside it, so what `find()`
+* refuses it refuses too. The socket would not: a frame is JSON, where an
+* `undefined` filter value becomes `null`, so `["!=", uid]` with `uid` unset
+* subscribed to every row whose column is NOT NULL — an ownership filter
+* widened instead of refused. And `after` names a place in one run of the
+* query, which a subscription re-runs on every write; the server keeps no
+* cursor for one, so it was dropped, and page one streamed to a caller who had
+* asked for page two.
+*/
+function listenRefusal(params) {
+	if (params?.where) try {
+		assertNoUndefinedFilterValues(params.where);
+	} catch (error) {
+		if (error instanceof RebaseClientError$1) return error;
+		throw error;
+	}
+	if (params?.after) return new RebaseClientError$1("listen() cannot continue from a cursor: a subscription re-runs its query on every write, and `after` names a place in one run of it. Use `offset` or `page` for a live window, or `find({ after })` to read the page once.", { code: "CURSOR_NOT_LIVE" });
+}
+/**
 * Counts currently in flight, **per client**, keyed by the exact request they
 * issue. Entries live only for the duration of the request — see `count()` for
 * why they exist at all.
@@ -1953,14 +2417,27 @@ function createCollectionClient(transport, slug, ws) {
 		* One statement server-side (`INSERT ... ON CONFLICT DO UPDATE`), so
 		* unlike a `findById` followed by `create`-or-`update` it cannot lose
 		* the race between the two.
+		*
+		* Sent as a one-row bulk write with `upsert: true`, which is what the
+		* in-process accessor and the offline queue already send. It used to be
+		* `POST /data/<slug>` with `?on_conflict=` only when a target was
+		* named — and the route reads that POST without the parameter as the
+		* plain insert a `create` is, so the documented default ("on the
+		* primary key") never happened online: re-upserting an existing row
+		* answered 409, while the same call succeeded offline and in a
+		* function.
 		*/
 		async upsert(data, options) {
-			const query = options?.onConflict?.length ? `?on_conflict=${encodeURIComponent(options.onConflict.join(","))}` : "";
-			return await transport.request(`${basePath}${query}`, {
+			const raw = await transport.request(`${basePath}/bulk`, {
 				method: "POST",
-				body: JSON.stringify(data),
+				body: JSON.stringify({
+					rows: [data],
+					upsert: true,
+					...options?.onConflict?.length ? { onConflict: options.onConflict } : {}
+				}),
 				...writeHeaders(options)
 			});
+			return options?.returning === false ? void 0 : raw?.data?.[0];
 		},
 		async createMany(data, options) {
 			if (!Array.isArray(data)) throw new TypeError("createMany expects an array of records.");
@@ -2067,10 +2544,20 @@ function createCollectionClient(transport, slug, ws) {
 					partial: false
 				});
 			};
+			const wantsLive = options?.realtime !== false && !isUnsupported(client.listen);
+			const refusal = wantsLive ? listenRefusal(params) : void 0;
+			if (refusal) {
+				queueMicrotask(() => {
+					if (!closed) onError?.(refusal);
+				});
+				return () => {
+					closed = true;
+				};
+			}
 			client.find(params).then((result) => deliver(result, false)).catch((error) => {
 				if (!closed) onError?.(error);
 			});
-			const live = options?.realtime !== false && !isUnsupported(client.listen) ? client.listen(params, (result) => deliver(result, true), onError) : void 0;
+			const live = wantsLive ? client.listen(params, (result) => deliver(result, true), onError) : void 0;
 			return () => {
 				closed = true;
 				live?.();
@@ -2144,7 +2631,13 @@ function createCollectionClient(transport, slug, ws) {
 		*/
 		async aggregate(params) {
 			const qs = buildAggregateQueryString(params);
-			return (await transport.request(`${basePath}/aggregate${qs}`, { method: "GET" })).data || [];
+			const raw = await transport.request(`${basePath}/aggregate${qs}`, { method: "GET" });
+			const rows = raw.data || [];
+			if (raw.meta) Object.defineProperty(rows, "meta", {
+				value: raw.meta,
+				enumerable: false
+			});
+			return rows;
 		},
 		listen: unsupportedMethod(NO_SOCKET),
 		listenById: unsupportedMethod(NO_SOCKET)
@@ -2152,6 +2645,15 @@ function createCollectionClient(transport, slug, ws) {
 	if (ws) {
 		client.listen = (params, onUpdate, onError) => {
 			let active = true;
+			const refusal = listenRefusal(params);
+			if (refusal) {
+				queueMicrotask(() => {
+					if (active) onError?.(refusal);
+				});
+				return () => {
+					active = false;
+				};
+			}
 			let lastUpdateId = 0;
 			let lastKnownTotal;
 			const window = resolveFindWindow(params);
@@ -2301,7 +2803,10 @@ function createStorage(transport, storageId) {
 			formData.append("property", context.property);
 		}
 		let effectiveKey = key;
-		if (isPublic && effectiveKey && !isPublicStoragePath(effectiveKey)) effectiveKey = `${PUBLIC_STORAGE_PREFIX}${effectiveKey.replace(/^\/+/, "")}`;
+		if (isPublic) {
+			effectiveKey ||= file instanceof File && file.name ? file.name : "blob";
+			if (!isPublicStoragePath(effectiveKey)) effectiveKey = `${PUBLIC_STORAGE_PREFIX}${effectiveKey.replace(/^\/+/, "")}`;
+		}
 		if (effectiveKey) formData.append("key", effectiveKey);
 		if (bucket) formData.append("bucket", bucket);
 		if (storageId) formData.append("storageId", storageId);
@@ -2321,9 +2826,7 @@ function createStorage(transport, storageId) {
 			if (!cachedEntry.expiresAt || cachedEntry.expiresAt > Date.now()) return cachedEntry.config;
 			urlsCache.delete(cacheKey);
 		}
-		let filePath = keyOrUrl;
-		if (filePath && (filePath.startsWith("local://") || filePath.startsWith("s3://") || filePath.startsWith("gs://"))) filePath = filePath.substring(filePath.indexOf("://") + 3);
-		if (bucket && filePath && !filePath.startsWith(bucket)) filePath = `${bucket}/${filePath}`;
+		const filePath = storageObjectPath(keyOrUrl, bucket);
 		if (!filePath || filePath.trim() === "" || filePath === "/") return {
 			url: null,
 			fileNotFound: true
@@ -2374,9 +2877,7 @@ function createStorage(transport, storageId) {
 		return new File([blob], fileName, { type: blob.type });
 	}
 	async function deleteObject(key, bucket) {
-		let filePath = key;
-		if (filePath && (filePath.startsWith("local://") || filePath.startsWith("s3://") || filePath.startsWith("gs://"))) filePath = filePath.substring(filePath.indexOf("://") + 3);
-		if (bucket && filePath && !filePath.startsWith(bucket)) filePath = `${bucket}/${filePath}`;
+		const filePath = storageObjectPath(key, bucket);
 		if (!filePath || filePath.trim() === "" || filePath === "/") return;
 		try {
 			await transport.request(withStorageId(`/storage/file/${encodeStorageKey(filePath)}`), { method: "DELETE" });
@@ -2459,6 +2960,87 @@ var ClientStorageSourceRegistry = class ClientStorageSourceRegistry {
 	}
 };
 //#endregion
+//#region src/sql-script.ts
+/**
+* Read an `EXECUTE_SQL_SUCCESS` payload for a script run as a
+* {@link SqlScriptResult}, checking every field rather than trusting the frame.
+*
+* A server from before scripts existed answers `{ result }` alone, with parsed
+* values. Its rows are kept, as text, and no column is said to come from
+* anywhere — the console edits no cell of a result it cannot trace.
+*/
+function readSqlScriptResult(payload) {
+	const record = asRecord(payload);
+	const rows = Array.isArray(record?.result) ? record.result.map(asRecord).filter(isDefined).map(textRow) : [];
+	const result = {
+		rows,
+		columns: Array.isArray(record?.columns) ? record.columns.map(readColumn).filter(isDefined) : Object.keys(rows[0] ?? {}).map((name) => ({ name })),
+		tables: Array.isArray(record?.tables) ? record.tables.map(readTable).filter(isDefined) : [],
+		notices: Array.isArray(record?.notices) ? record.notices.map(readNotice).filter(isDefined) : []
+	};
+	if (typeof record?.command === "string") result.command = record.command;
+	if (typeof record?.rowCount === "number") result.rowCount = record.rowCount;
+	if (typeof record?.effectiveRole === "string") result.effectiveRole = record.effectiveRole;
+	return result;
+}
+function isDefined(value) {
+	return value !== void 0;
+}
+function asRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : void 0;
+}
+function textRow(row) {
+	return Object.fromEntries(Object.entries(row).map(([key, value]) => [key, asText(value)]));
+}
+function asText(value) {
+	if (value === null || value === void 0) return null;
+	if (typeof value === "string") return value;
+	if (typeof value === "object") return JSON.stringify(value);
+	return String(value);
+}
+function readColumn(value) {
+	const record = asRecord(value);
+	if (typeof record?.name !== "string") return void 0;
+	const column = { name: record.name };
+	if (typeof record.type === "string") column.type = record.type;
+	const source = asRecord(record.source);
+	if (typeof source?.schema === "string" && typeof source.table === "string" && typeof source.column === "string") column.source = {
+		schema: source.schema,
+		table: source.table,
+		column: source.column
+	};
+	return column;
+}
+var TABLE_KINDS = [
+	"table",
+	"partitioned table",
+	"view",
+	"materialized view",
+	"foreign table",
+	"other"
+];
+function readTable(value) {
+	const record = asRecord(value);
+	if (typeof record?.schema !== "string" || typeof record.table !== "string") return void 0;
+	const kind = TABLE_KINDS.find((candidate) => candidate === record.kind) ?? "other";
+	const primaryKey = Array.isArray(record.primaryKey) && record.primaryKey.every((column) => typeof column === "string") ? record.primaryKey : [];
+	return {
+		schema: record.schema,
+		table: record.table,
+		kind,
+		primaryKey,
+		hasInheritors: record.hasInheritors !== false
+	};
+}
+function readNotice(value) {
+	const record = asRecord(value);
+	if (typeof record?.message !== "string") return void 0;
+	return {
+		severity: typeof record.severity === "string" ? record.severity : "NOTICE",
+		message: record.message
+	};
+}
+//#endregion
 //#region src/websocket.ts
 /**
 * Extract error message and code from a WebSocket message payload.
@@ -2489,6 +3071,33 @@ function frameError(message) {
 	});
 }
 /**
+* A request whose socket closed after it was written and before the server
+* answered. The server may have run it. It is not re-sent — see `onclose`.
+*/
+function connectionLostError() {
+	return new RebaseApiError$1("The realtime connection closed before the server answered. The request may or may not have been applied, and it was not sent again.", { code: "CONNECTION_LOST" });
+}
+/**
+* A request that got no answer within `requestTimeoutMs` of the call — whether
+* it waited in the queue for a socket the whole time, or was written and never
+* answered (a half-open connection looks exactly like that).
+*/
+function requestTimeoutError(written) {
+	return new RebaseApiError$1(written ? "The server did not answer the realtime request in time. It may or may not have been applied." : "The realtime request timed out before it could be sent. It was not applied.", { code: "REQUEST_TIMEOUT" });
+}
+/**
+* What a live subscription or a joined channel is told, once, when the
+* connection has been down for longer than a blip. The registration is kept and
+* resumes when the socket is back.
+*/
+function realtimeLostError() {
+	return new RebaseApiError$1("The realtime connection is down, so live data is not updating. The client keeps reconnecting and refreshes this subscription when the connection is back.", { code: "CONNECTION_LOST" });
+}
+/** The ceiling of the reconnect backoff. */
+var MAX_RECONNECT_DELAY_MS = 3e4;
+/** Each reconnect delay is drawn from the last fifth below its step. */
+var RECONNECT_JITTER = .2;
+/**
 * Broadcast and presence frames.
 *
 * Fire-and-forget (the server sends no response envelope), and exempt from the
@@ -2504,6 +3113,26 @@ var CHANNEL_MESSAGE_TYPES = /* @__PURE__ */ new Set([
 	"channel_history"
 ]);
 /**
+* Subscription frames. Like channel frames they get no response envelope, and
+* like them they go out without an account when there is none: whether an
+* anonymous visitor may subscribe is the server's `requireAuth` to decide, and
+* a server that refuses answers the frame, which reaches the listener's
+* `onError`.
+*/
+var SUBSCRIPTION_MESSAGE_TYPES = /* @__PURE__ */ new Set([
+	"subscribe_collection",
+	"subscribe_one",
+	"unsubscribe"
+]);
+/**
+* The token getter's "there is no account" — an empty token, or its own
+* "not logged in". Distinct from a getter that failed, which says nothing about
+* whether there is one.
+*/
+function isNotSignedIn(error) {
+	return (error instanceof Error ? error.message : String(error)).includes("not logged in");
+}
+/**
 * The other direction: the frame types the *server* addresses by channel.
 *
 * Not the mirror of {@link CHANNEL_MESSAGE_TYPES} — a request and its answer
@@ -2563,16 +3192,56 @@ var RebaseWebSocketClient = class {
 	/** Set by `close()`. Blocks any later operation from silently redialling. */
 	closedByCaller = false;
 	/**
-	* Set when the backoff budget ran out, cleared by anything that earns a
-	* fresh one.
+	* Set when the backoff budget ran out with nothing registered, cleared by
+	* anything that earns a fresh one.
 	*
-	* Unlike {@link closedByCaller} this is not final — nobody *asked* for the
-	* socket to stay down. Five attempts with exponential backoff is about a
-	* minute, which a laptop lid, a wifi handover or a backend rollout all
-	* exceed routinely; treating that as permanent meant realtime silently
-	* stopped for the rest of the page's life, with a reload the only cure.
+	* Only reachable with nothing registered: while a subscription or a joined
+	* channel exists the client never stops retrying (see `attemptReconnect`).
+	* And it is not final like {@link closedByCaller} — nobody *asked* for the
+	* socket to stay down, so the next subscribe dials again.
 	*/
 	gaveUp = false;
+	/** See {@link state}. */
+	connectionState = "idle";
+	stateListeners = /* @__PURE__ */ new Set();
+	/**
+	* Whether the current outage has been reported to the registrations as
+	* `CONNECTION_LOST`. Once per outage: cleared when a socket opens.
+	*/
+	outageReported = false;
+	/**
+	* Where the connection is.
+	*
+	* - `idle` — no socket, and none wanted yet (the connection is lazy), or
+	*   the last one was dropped by a sign-out.
+	* - `connecting` — dialling, with no outage in progress.
+	* - `connected` — the socket is open.
+	* - `reconnecting` — the socket dropped and the client is redialling. A
+	*   blip, so far: nothing has been reported.
+	* - `disconnected` — the outage has outlasted the blip budget. Every
+	*   subscription and joined channel has been told `CONNECTION_LOST` once;
+	*   the client keeps redialling (every 30 s at most) while any exists.
+	* - `closed` — `client.close()`. Final.
+	*/
+	get state() {
+		return this.connectionState;
+	}
+	/** Called on every change of {@link state}. Returns the unsubscribe. */
+	onStateChange(listener) {
+		this.stateListeners.add(listener);
+		return () => {
+			this.stateListeners.delete(listener);
+		};
+	}
+	setState(next) {
+		if (next === this.connectionState) return;
+		this.connectionState = next;
+		for (const listener of [...this.stateListeners]) try {
+			listener(next);
+		} catch (error) {
+			console.error("Error in realtime state listener:", error);
+		}
+	}
 	/**
 	* Whether a socket exists at all (open or still opening).
 	*
@@ -2599,6 +3268,18 @@ var RebaseWebSocketClient = class {
 	onReconnect(handler) {
 		return this.on("reconnect", handler);
 	}
+	/**
+	* Notified once per outage that outlasted a blip, with the
+	* `CONNECTION_LOST` error — so a joined channel can tell its `onError`
+	* handlers, as subscriptions are told through theirs.
+	*/
+	onConnectionLost(handler) {
+		this.connectionLostHandlers.add(handler);
+		return () => {
+			this.connectionLostHandlers.delete(handler);
+		};
+	}
+	connectionLostHandlers = /* @__PURE__ */ new Set();
 	on(event, cb) {
 		if (!this.listeners.has(event)) this.listeners.set(event, /* @__PURE__ */ new Set());
 		this.listeners.get(event).add(cb);
@@ -2613,7 +3294,29 @@ var RebaseWebSocketClient = class {
 	backendToEntityKey = /* @__PURE__ */ new Map();
 	pendingRequests = /* @__PURE__ */ new Map();
 	reconnectAttempts = 0;
+	/**
+	* With nothing registered, how many failed redials before the client stops
+	* trying until something asks for the connection. With a registration it
+	* never stops.
+	*/
 	maxReconnectAttempts = 5;
+	/**
+	* How many failed redials make a blip an outage: the point at which every
+	* registration is told `CONNECTION_LOST` and {@link state} reads
+	* `disconnected`. Three is 2 + 4 + 8 s of backoff, about 14 s down.
+	*/
+	lostAfterAttempts = 3;
+	/**
+	* Whether a socket of this client has ever opened — what makes the next
+	* open a *reconnect*, whose server has forgotten every subscription and
+	* channel membership and must be told them again.
+	*
+	* Not `reconnectAttempts > 0`: that counter is a backoff budget, and a
+	* fresh one (after giving up, or after a sign-out dropped the socket)
+	* starts at zero, so the socket that finally came back looked like a first
+	* connect and nothing was re-sent.
+	*/
+	hadConnection = false;
 	isConnected = false;
 	messageQueue = [];
 	requestTimeoutMs = 3e4;
@@ -2624,10 +3327,12 @@ var RebaseWebSocketClient = class {
 	WebSocketConstructor;
 	onUnauthorized;
 	refreshInProgress = null;
+	impersonate;
 	constructor(config) {
 		this.websocketUrl = config.websocketUrl;
 		this.getAuthToken = config.getAuthToken;
 		this.onUnauthorized = config.onUnauthorized;
+		this.impersonate = config.impersonate;
 		this.WebSocketConstructor = config.WebSocket || (typeof WebSocket !== "undefined" ? WebSocket : void 0);
 	}
 	/**
@@ -2646,29 +3351,58 @@ var RebaseWebSocketClient = class {
 			}
 			return;
 		}
-		this.installOnlineListener();
+		this.installNetworkListeners();
 		if (this.ws || this.reconnectTimeout) return;
 		if (this.gaveUp) {
 			this.gaveUp = false;
 			this.reconnectAttempts = 0;
+			this.outageReported = false;
 		}
+		if (!this.outageReported) this.setState("connecting");
 		this.initWebSocket();
 	}
 	/**
-	* The browser says the network is back — the usual reason the budget ran
-	* out in the first place. Registered lazily so a Node client, or a page
-	* that never subscribes, adds no listener.
+	* Dial now rather than at the next backoff step — the browser says the
+	* network is back, or the tab is in front of the user again. Both are the
+	* usual end of an outage; neither fires for a server restart, which the
+	* backoff covers.
 	*/
-	installOnlineListener() {
+	retryNow(reason) {
+		if (this.closedByCaller) return;
+		if (this.connectionState !== "reconnecting" && this.connectionState !== "disconnected") return;
+		if (this.ws) return;
+		console.debug(`${reason} — retrying the realtime connection`);
+		if (this.reconnectTimeout) {
+			clearTimeout(this.reconnectTimeout);
+			this.reconnectTimeout = null;
+		}
+		this.gaveUp = false;
+		this.reconnectAttempts = 0;
+		this.initWebSocket();
+	}
+	/**
+	* `online` and `visibilitychange`. Registered lazily so a Node client, or a
+	* page that never subscribes, adds no listener.
+	*/
+	installNetworkListeners() {
 		if (this.onlineListener || typeof window === "undefined" || typeof window.addEventListener !== "function") return;
-		this.onlineListener = () => {
-			if (this.closedByCaller || !this.gaveUp) return;
-			console.debug("Network is back — retrying the realtime connection");
-			this.ensureConnected();
-		};
+		this.onlineListener = () => this.retryNow("Network is back");
 		window.addEventListener("online", this.onlineListener);
+		if (typeof document !== "undefined" && typeof document.addEventListener === "function") {
+			this.visibilityListener = () => {
+				if (document.visibilityState === "visible") this.retryNow("Tab is visible again");
+			};
+			document.addEventListener("visibilitychange", this.visibilityListener);
+		}
+	}
+	removeNetworkListeners() {
+		if (this.onlineListener && typeof window !== "undefined") window.removeEventListener("online", this.onlineListener);
+		if (this.visibilityListener && typeof document !== "undefined") document.removeEventListener("visibilitychange", this.visibilityListener);
+		this.onlineListener = null;
+		this.visibilityListener = null;
 	}
 	onlineListener = null;
+	visibilityListener = null;
 	/**
 	* Authenticate the WebSocket connection
 	*/
@@ -2693,7 +3427,10 @@ var RebaseWebSocketClient = class {
 			const message = {
 				type: "AUTHENTICATE",
 				requestId,
-				payload: { token }
+				payload: this.impersonate !== void 0 ? {
+					token,
+					impersonate: this.impersonate
+				} : { token }
 			};
 			if (!this.isConnected || !this.ws) this.messageQueue.unshift(message);
 			else this.ws.send(JSON.stringify(message));
@@ -2726,17 +3463,19 @@ var RebaseWebSocketClient = class {
 	*/
 	disconnect(permanent = false) {
 		if (permanent) this.closedByCaller = true;
-		if (permanent && this.onlineListener && typeof window !== "undefined") {
-			window.removeEventListener("online", this.onlineListener);
-			this.onlineListener = null;
-		}
+		if (permanent) this.removeNetworkListeners();
 		this.isAuthenticated = false;
 		this.authPromise = null;
 		if (this.reconnectTimeout) {
 			clearTimeout(this.reconnectTimeout);
 			this.reconnectTimeout = null;
 		}
+		this.reconnectAttempts = 0;
+		this.outageReported = false;
+		this.gaveUp = false;
+		this.setState(permanent ? "closed" : "idle");
 		this.suspendSubscribeWatchdogs();
+		this.forgetCachedData();
 		if (this.ws) {
 			this.ws.onclose = null;
 			this.ws.onerror = null;
@@ -2759,9 +3498,13 @@ var RebaseWebSocketClient = class {
 			this.ws = socket;
 			this.ws.onopen = async () => {
 				console.debug("Connected to PostgreSQL backend");
-				const wasReconnect = this.reconnectAttempts > 0;
+				const wasReconnect = this.hadConnection;
+				this.hadConnection = true;
 				this.isConnected = true;
 				this.reconnectAttempts = 0;
+				this.outageReported = false;
+				this.gaveUp = false;
+				this.setState("connected");
 				if (this.getAuthToken && !this.isAuthenticated) try {
 					const token = await this.getAuthToken();
 					if (token) {
@@ -2772,7 +3515,7 @@ var RebaseWebSocketClient = class {
 					console.debug("WebSocket connected without auth:", error?.message || error);
 				}
 				this.emit(wasReconnect ? "reconnect" : "connect");
-				this.processMessageQueue();
+				this.processMessageQueue(wasReconnect);
 				if (wasReconnect) this.resubscribeAll();
 				this.armPendingSubscribeWatchdogs();
 			};
@@ -2793,14 +3536,11 @@ var RebaseWebSocketClient = class {
 				this.suspendSubscribeWatchdogs();
 				this.emit("disconnect");
 				for (const [reqId, request] of this.pendingRequests.entries()) {
-					if (reqId.startsWith("auth_")) request.reject(/* @__PURE__ */ new Error("Connection closed during authentication"));
-					else if (request.message) {
-						request.message._queuedResolve = request.resolve;
-						request.message._queuedReject = request.reject;
-						this.messageQueue.push(request.message);
-					} else request.reject(new RebaseApiError$1("Connection closed"));
 					this.pendingRequests.delete(reqId);
+					if (reqId.startsWith("auth_")) request.reject(/* @__PURE__ */ new Error("Connection closed during authentication"));
+					else request.reject(connectionLostError());
 				}
+				this.setState(this.outageReported ? "disconnected" : "reconnecting");
 				this.attemptReconnect();
 			};
 			this.ws.onerror = (error) => {
@@ -2813,27 +3553,117 @@ var RebaseWebSocketClient = class {
 			this.attemptReconnect();
 		}
 	}
-	processMessageQueue() {
+	processMessageQueue(isReconnect) {
 		while (this.messageQueue.length > 0 && this.isConnected) {
 			const message = this.messageQueue.shift();
-			if (message) this.sendMessage(message);
+			if (!message) continue;
+			if (!this.shouldSendQueued(message, isReconnect)) {
+				const resolveQueued = message._queuedResolve;
+				if (typeof resolveQueued === "function") resolveQueued(void 0);
+				continue;
+			}
+			this.sendMessage(message);
+		}
+	}
+	/**
+	* Whether a frame that waited in the queue should go out on the socket
+	* that just opened. Only a subscribe can be refused, and one is exactly
+	* when sending it would give the server a subscription this side will not
+	* read:
+	*
+	* - Its registration is gone, or has been given a new id, while it waited.
+	*   A listener that unmounted before the socket opened (a StrictMode double
+	*   mount does exactly this) sends no `unsubscribe`, because there was no
+	*   socket to send it on, so the server would keep that one forever.
+	* - This open is a reconnect. `resubscribeAll` sends every registration
+	*   under a fresh id right after the queue drains, so the queued copy would
+	*   be the second of two. It is handed back to that pass instead.
+	*/
+	shouldSendQueued(message, isReconnect) {
+		if (message.type !== "subscribe_collection" && message.type !== "subscribe_one") return true;
+		const payload = message.payload;
+		if (!payload || typeof payload !== "object" || !("subscriptionId" in payload)) return true;
+		const subscriptionId = payload.subscriptionId;
+		if (typeof subscriptionId !== "string") return true;
+		const registration = message.type === "subscribe_collection" ? this.collectionSubscriptions.get(this.backendToCollectionKey.get(subscriptionId) ?? "") : this.singleSubscriptions.get(this.backendToEntityKey.get(subscriptionId) ?? "");
+		if (!registration || registration.backendSubscriptionId !== subscriptionId) return false;
+		if (isReconnect) {
+			registration.subscribeInFlight = false;
+			return false;
 		}
+		return true;
 	}
 	attemptReconnect() {
-		if (this.reconnectAttempts >= this.maxReconnectAttempts) {
-			console.error("Max reconnection attempts reached");
+		if (this.closedByCaller) return;
+		if (this.reconnectAttempts >= this.lostAfterAttempts) this.reportConnectionLost();
+		if (this.reconnectAttempts >= this.maxReconnectAttempts && !this.hasRegistrations()) {
+			console.warn("[Rebase] Realtime: the server is unreachable and nothing is subscribed. Not retrying until something asks for the connection.");
 			this.gaveUp = true;
-			this.failAllPendingSubscriptions(new RebaseApiError$1("Connection lost", { code: "CONNECTION_LOST" }));
 			return;
 		}
-		this.reconnectAttempts++;
-		const delay = Math.min(1e3 * Math.pow(2, this.reconnectAttempts), 3e4);
-		console.debug(`Attempting to reconnect in ${delay}ms (attempt ${this.reconnectAttempts})`);
-		if (this.reconnectTimeout) clearTimeout(this.reconnectTimeout);
-		this.reconnectTimeout = setTimeout(() => {
-			this.reconnectTimeout = null;
-			this.initWebSocket();
-		}, delay);
+		this.reconnectAttempts = Math.min(this.reconnectAttempts + 1, 30);
+		const ceiling = Math.min(1e3 * Math.pow(2, this.reconnectAttempts), MAX_RECONNECT_DELAY_MS);
+		const delay = ceiling - Math.floor(Math.random() * ceiling * RECONNECT_JITTER);
+		console.debug(`Attempting to reconnect in ${delay}ms (attempt ${this.reconnectAttempts})`);
+		if (this.reconnectTimeout) clearTimeout(this.reconnectTimeout);
+		this.reconnectTimeout = setTimeout(() => {
+			this.reconnectTimeout = null;
+			this.initWebSocket();
+		}, delay);
+	}
+	/**
+	* Whether anything depends on the socket coming back: a subscription, a
+	* joined channel, or a request whose caller is still waiting for a socket.
+	*/
+	hasRegistrations() {
+		return this.collectionSubscriptions.size > 0 || this.singleSubscriptions.size > 0 || this.channelHandlers.size > 0 || this.messageQueue.some((frame) => typeof frame._queuedReject === "function");
+	}
+	/**
+	* Tell every subscription and joined channel, once per outage, that the
+	* connection is down and their data is not updating.
+	*
+	* Registrations are kept — that is the difference from a subscribe that
+	* failed. When the socket is back they are re-subscribed, and the fresh
+	* `onUpdate` is the recovery.
+	*/
+	reportConnectionLost() {
+		if (this.outageReported) return;
+		this.outageReported = true;
+		this.setState("disconnected");
+		const error = realtimeLostError();
+		for (const subscription of this.collectionSubscriptions.values()) this.notifyError(subscription.callbacks, error);
+		for (const subscription of this.singleSubscriptions.values()) this.notifyError(subscription.callbacks, error);
+		for (const handler of [...this.connectionLostHandlers]) try {
+			handler(error);
+		} catch (handlerError) {
+			console.error("Error in connection-lost handler:", handlerError);
+		}
+	}
+	notifyError(callbacks, error) {
+		for (const callback of [...callbacks.values()]) {
+			if (!callback.onError) continue;
+			try {
+				callback.onError(error);
+			} catch (callbackError) {
+				console.error("Error in subscription error callback:", callbackError);
+			}
+		}
+	}
+	/**
+	* A listener attaching while an outage is being reported is told at once:
+	* its subscribe waits for a socket that may be minutes away, and nothing
+	* else would say so.
+	*/
+	reportOutageTo(onError) {
+		if (!this.outageReported || !onError) return;
+		queueMicrotask(() => {
+			if (!this.outageReported) return;
+			try {
+				onError(realtimeLostError());
+			} catch (callbackError) {
+				console.error("Error in subscription error callback:", callbackError);
+			}
+		});
 	}
 	isAuthError(message) {
 		if (message.type === "AUTH_ERROR") return true;
@@ -2977,8 +3807,9 @@ var RebaseWebSocketClient = class {
 				}
 			}
 		}
-		if (subscriptionId && (type === "ERROR" || message.error)) {
-			const collectionKey = this.backendToCollectionKey.get(subscriptionId);
+		const erroredSubscriptionId = subscriptionId ?? requestId;
+		if (erroredSubscriptionId && (type === "ERROR" || message.error)) {
+			const collectionKey = this.backendToCollectionKey.get(erroredSubscriptionId);
 			if (collectionKey) {
 				const collectionSub = this.collectionSubscriptions.get(collectionKey);
 				if (collectionSub) {
@@ -2996,7 +3827,7 @@ var RebaseWebSocketClient = class {
 					return;
 				}
 			}
-			const entityKey = this.backendToEntityKey.get(subscriptionId);
+			const entityKey = this.backendToEntityKey.get(erroredSubscriptionId);
 			if (entityKey) {
 				const entitySub = this.singleSubscriptions.get(entityKey);
 				if (entitySub) {
@@ -3080,49 +3911,89 @@ var RebaseWebSocketClient = class {
 	*/
 	sendMessage(message) {
 		const queuedMsg = message;
-		if (queuedMsg._queuedResolve && queuedMsg._queuedReject) return this.doSendMessage(message, queuedMsg._queuedResolve, queuedMsg._queuedReject);
-		if (!this.isConnected || !this.ws) {
-			this.ensureConnected();
-			return new Promise((resolve, reject) => {
-				const queueable = message;
-				queueable._queuedResolve = resolve;
-				queueable._queuedReject = reject;
-				this.messageQueue.push(message);
-			});
+		if (queuedMsg._queuedResolve && queuedMsg._queuedReject) {
+			const resolve = queuedMsg._queuedResolve;
+			const reject = queuedMsg._queuedReject;
+			delete queuedMsg._queuedResolve;
+			delete queuedMsg._queuedReject;
+			return this.doSendMessage(message, resolve, reject);
 		}
 		return new Promise((resolve, reject) => {
-			this.doSendMessage(message, resolve, reject);
+			let settled = false;
+			let deadline;
+			const onResolve = (value) => {
+				if (settled) return;
+				settled = true;
+				if (deadline) clearTimeout(deadline);
+				resolve(value);
+			};
+			const onReject = (error) => {
+				if (settled) return;
+				settled = true;
+				if (deadline) clearTimeout(deadline);
+				this.abandonedFrames.add(message);
+				reject(error);
+			};
+			if (this.expectsResponse(message)) deadline = setTimeout(() => {
+				const queuedAt = this.messageQueue.indexOf(message);
+				if (queuedAt >= 0) this.messageQueue.splice(queuedAt, 1);
+				let written = false;
+				for (const [requestId, pending] of this.pendingRequests) {
+					if (pending.message !== message) continue;
+					this.pendingRequests.delete(requestId);
+					written = true;
+				}
+				onReject(requestTimeoutError(written));
+			}, this.requestTimeoutMs);
+			if (!this.isConnected || !this.ws) {
+				this.ensureConnected();
+				queuedMsg._queuedResolve = onResolve;
+				queuedMsg._queuedReject = onReject;
+				this.messageQueue.push(message);
+				return;
+			}
+			this.doSendMessage(message, onResolve, onReject);
 		});
 	}
+	/**
+	* Frames whose caller has already been answered — timed out, or rejected
+	* by a close. One can still be on its way to the socket (awaiting
+	* authentication), and must not be written after its caller was told it
+	* failed.
+	*/
+	abandonedFrames = /* @__PURE__ */ new WeakSet();
+	/** Whether the server answers this frame with a response envelope. */
+	expectsResponse(message) {
+		const type = message.type;
+		return !(SUBSCRIPTION_MESSAGE_TYPES.has(type) || CHANNEL_MESSAGE_TYPES.has(type));
+	}
 	async doSendMessage(message, resolve, reject) {
+		const isSubscriptionFrame = SUBSCRIPTION_MESSAGE_TYPES.has(message.type);
 		if (message.type !== "AUTHENTICATE" && !CHANNEL_MESSAGE_TYPES.has(message.type) && this.getAuthToken && !this.isAuthenticated) try {
 			await this.ensureAuthenticated();
 		} catch (error) {
-			reject(new RebaseApiError$1(error instanceof Error ? error.message : "Authentication required"));
+			if (!(isSubscriptionFrame && isNotSignedIn(error))) {
+				reject(new RebaseApiError$1(error instanceof Error ? error.message : "Authentication required"));
+				return;
+			}
+		}
+		if (this.abandonedFrames.has(message)) return;
+		if (!this.isConnected || !this.ws) {
+			const queueable = message;
+			queueable._queuedResolve = resolve;
+			queueable._queuedReject = reject;
+			this.messageQueue.push(message);
+			this.ensureConnected();
 			return;
 		}
 		const requestId = message.requestId || `req_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
 		message.requestId = requestId;
-		const expectsResponse = !(message.type === "subscribe_collection" || message.type === "subscribe_one" || message.type === "unsubscribe" || CHANNEL_MESSAGE_TYPES.has(message.type));
-		if (expectsResponse && !this.pendingRequests.has(requestId)) {
-			const timeoutHandle = setTimeout(() => {
-				if (this.pendingRequests.has(requestId)) {
-					this.pendingRequests.delete(requestId);
-					reject(new RebaseApiError$1("Request timed out"));
-				}
-			}, this.requestTimeoutMs);
-			this.pendingRequests.set(requestId, {
-				resolve: (value) => {
-					clearTimeout(timeoutHandle);
-					resolve(value);
-				},
-				reject: (error) => {
-					clearTimeout(timeoutHandle);
-					reject(error);
-				},
-				message
-			});
-		}
+		const expectsResponse = this.expectsResponse(message);
+		if (expectsResponse && !this.pendingRequests.has(requestId)) this.pendingRequests.set(requestId, {
+			resolve,
+			reject,
+			message
+		});
 		try {
 			this.ws.send(JSON.stringify(message));
 			if (!expectsResponse) resolve(void 0);
@@ -3164,6 +4035,25 @@ var RebaseWebSocketClient = class {
 			}
 		})).result || [];
 	}
+	/**
+	* Run a script a person wrote — the Studio console — and get back what its
+	* last statement returned, every value as the database's text, with the
+	* table column each result column was read from. See
+	* `SQLAdmin.runSqlScript`.
+	*/
+	async runSqlScript(sql, options) {
+		return readSqlScriptResult(await this.sendMessage({
+			type: "EXECUTE_SQL",
+			payload: {
+				sql,
+				options: {
+					database: options?.database,
+					role: options?.role
+				},
+				mode: "script"
+			}
+		}));
+	}
 	async fetchAvailableDatabases() {
 		return (await this.sendMessage({
 			type: "FETCH_DATABASES",
@@ -3345,6 +4235,7 @@ var RebaseWebSocketClient = class {
 				onUpdate,
 				onError
 			});
+			this.reportOutageTo(onError);
 			if (existingSubscription.latestData !== void 0 && existingSubscription.isInitialDataReceived) try {
 				onUpdate(existingSubscription.latestData, existingSubscription.latestMeta);
 			} catch (error) {
@@ -3372,6 +4263,7 @@ var RebaseWebSocketClient = class {
 			onUpdate,
 			onError
 		});
+		this.reportOutageTo(onError);
 		this.collectionSubscriptions.set(subscriptionKey, {
 			backendSubscriptionId,
 			callbacks: callbackMap,
@@ -3407,6 +4299,7 @@ var RebaseWebSocketClient = class {
 				onUpdate,
 				onError
 			});
+			this.reportOutageTo(onError);
 			if (existingSubscription.latestData !== void 0 && existingSubscription.isInitialDataReceived) try {
 				onUpdate(existingSubscription.latestData);
 			} catch (error) {
@@ -3434,6 +4327,7 @@ var RebaseWebSocketClient = class {
 			onUpdate,
 			onError
 		});
+		this.reportOutageTo(onError);
 		this.singleSubscriptions.set(subscriptionKey, {
 			backendSubscriptionId,
 			callbacks: callbackMap,
@@ -3476,6 +4370,7 @@ var RebaseWebSocketClient = class {
 		if (this.isConnected) this.sendCollectionSubscribeWatchdog(subscriptionKey);
 		this.sendMessage({
 			type: "subscribe_collection",
+			requestId: backendSubscriptionId,
 			payload: {
 				...subscription.props,
 				subscriptionId: backendSubscriptionId
@@ -3497,6 +4392,7 @@ var RebaseWebSocketClient = class {
 		if (this.isConnected) this.sendEntitySubscribeWatchdog(subscriptionKey);
 		this.sendMessage({
 			type: "subscribe_one",
+			requestId: backendSubscriptionId,
 			payload: {
 				...subscription.props,
 				subscriptionId: backendSubscriptionId
@@ -3564,6 +4460,26 @@ var RebaseWebSocketClient = class {
 		}
 	}
 	/**
+	* Drop every registration's cached rows, keeping the registrations.
+	*
+	* A registration without rows counts as not loaded, so the next listener
+	* to attach asks the server (or waits for the resubscribe) instead of
+	* being handed what is cached.
+	*/
+	forgetCachedData() {
+		for (const sub of this.collectionSubscriptions.values()) {
+			sub.latestData = void 0;
+			sub.latestMeta = void 0;
+			sub.lastUpdated = void 0;
+			sub.isInitialDataReceived = false;
+		}
+		for (const sub of this.singleSubscriptions.values()) {
+			sub.latestData = void 0;
+			sub.lastUpdated = void 0;
+			sub.isInitialDataReceived = false;
+		}
+	}
+	/**
 	* Arm watchdogs for subscribes that were requested while offline and have
 	* just been flushed to the socket. Their timers were deliberately not set at
 	* request time, so without this they would have no timeout at all.
@@ -3595,20 +4511,6 @@ var RebaseWebSocketClient = class {
 		}, this.subscriptionTimeoutMs);
 	}
 	/**
-	* Fail every subscription that never received data. Called when reconnection
-	* is given up on, so views surface an error instead of spinning forever.
-	*/
-	failAllPendingSubscriptions(error) {
-		for (const key of [...this.collectionSubscriptions.keys()]) {
-			const sub = this.collectionSubscriptions.get(key);
-			if (sub && !sub.isInitialDataReceived) this.failCollectionSubscription(key, error);
-		}
-		for (const key of [...this.singleSubscriptions.keys()]) {
-			const sub = this.singleSubscriptions.get(key);
-			if (sub && !sub.isInitialDataReceived) this.failEntitySubscription(key, error);
-		}
-	}
-	/**
 	* Re-send all active subscriptions to the backend after a reconnect.
 	* The server wipes subscription state when a client disconnects, so
 	* we need to re-register everything to resume receiving updates.
@@ -3616,6 +4518,7 @@ var RebaseWebSocketClient = class {
 	resubscribeAll() {
 		console.debug(`[WS] Re-subscribing: ${this.collectionSubscriptions.size} collection(s), ${this.singleSubscriptions.size} row(ies)`);
 		for (const [key, sub] of this.collectionSubscriptions.entries()) {
+			if (sub.subscribeInFlight) continue;
 			const oldBackendId = sub.backendSubscriptionId;
 			const newBackendId = `collection_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
 			sub.backendSubscriptionId = newBackendId;
@@ -3624,6 +4527,7 @@ var RebaseWebSocketClient = class {
 			this.sendCollectionSubscribe(key);
 		}
 		for (const [key, sub] of this.singleSubscriptions.entries()) {
+			if (sub.subscribeInFlight) continue;
 			const oldBackendId = sub.backendSubscriptionId;
 			const newBackendId = `entity_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
 			sub.backendSubscriptionId = newBackendId;
@@ -3702,6 +4606,27 @@ var RebaseRealtimeChannel = class {
 	pendingLive = [];
 	catchUpInFlight = false;
 	/**
+	* Whether {@link lastSeq} is a position this client reached, rather than
+	* the zero of a handle that has not caught up yet.
+	*
+	* A client joining for the first time asks for whatever is retained, so
+	* history pruned before it ever joined is not something it missed. Only a
+	* client with a position can have a hole in what it saw.
+	*/
+	positioned = false;
+	/** The page size the catch-up in flight asked for, reused for its later pages. */
+	catchUpLimit;
+	/**
+	* `latestSeq` of an empty page that left this client behind, while a
+	* second request confirms it.
+	*
+	* The server reads the retained messages and then the cursor, so a message
+	* committed between the two shows up in `latestSeq` and not in the page.
+	* The second request returns it if it exists; only a second empty page
+	* means the messages up to this seq are gone.
+	*/
+	emptyTailSeq = null;
+	/**
 	* Deadline for a catch-up response.
 	*
 	* Buffering live messages is only safe because the wait is bounded. A
@@ -3773,6 +4698,8 @@ var RebaseRealtimeChannel = class {
 		this.unsubscribers.push(this.transport.onReconnect(() => {
 			this.rejoin();
 		}));
+		const onConnectionLost = this.transport.onConnectionLost?.((error) => this.emitError(error));
+		if (onConnectionLost) this.unsubscribers.push(onConnectionLost);
 		await this.send("join_channel");
 		await this.send("presence_state");
 		if (this.wantsHistory) await this.requestHistory();
@@ -3793,6 +4720,7 @@ var RebaseRealtimeChannel = class {
 	*/
 	async requestHistory(limit) {
 		this.catchUpInFlight = true;
+		this.catchUpLimit = limit;
 		if (this.catchUpTimeout) clearTimeout(this.catchUpTimeout);
 		this.catchUpTimeout = setTimeout(() => this.abandonCatchUp(), CATCH_UP_TIMEOUT_MS);
 		unref(this.catchUpTimeout);
@@ -3820,6 +4748,7 @@ var RebaseRealtimeChannel = class {
 		}
 		if (!this.catchUpInFlight) return;
 		this.catchUpInFlight = false;
+		this.emptyTailSeq = null;
 		for (const resolve of this.historyWaiters.splice(0)) resolve({
 			messages: [],
 			retained: false
@@ -3886,6 +4815,12 @@ var RebaseRealtimeChannel = class {
 	* retention cannot be served; `CHANNEL_BUS_PAYLOAD_TOO_LARGE` when a
 	* broadcast on an ephemeral channel is too big to cross the bus.
 	*
+	* `CHANNEL_HISTORY_GAP` is raised by the client: a catch-up found that the
+	* server no longer retains messages this client never received, so its
+	* state has a hole a replay cannot fill. `details` is `{ from, to }`, the
+	* inclusive range of sequence numbers missed. Resync the channel's state
+	* from its source of truth.
+	*
 	* These used to be dropped on the floor — there is no promise to reject on
 	* a fire-and-forget frame, so a forbidden broadcast looked exactly like a
 	* delivered one. With no handler attached they are logged as a warning,
@@ -3927,7 +4862,10 @@ var RebaseRealtimeChannel = class {
 	*/
 	async history(options = {}) {
 		await this.join();
-		if (options.sinceSeq !== void 0) this.lastSeq = options.sinceSeq;
+		if (options.sinceSeq !== void 0) {
+			this.lastSeq = options.sinceSeq;
+			this.positioned = options.sinceSeq > 0;
+		}
 		const result = new Promise((resolve) => {
 			this.historyWaiters.push(resolve);
 		});
@@ -3942,6 +4880,8 @@ var RebaseRealtimeChannel = class {
 		this.presenceHandlers.clear();
 		this.broadcastHandlers.clear();
 		this.lastSeq = 0;
+		this.positioned = false;
+		this.emptyTailSeq = null;
 		this.pendingLive = [];
 		this.catchUpInFlight = false;
 		if (this.catchUpTimeout) {
@@ -3999,11 +4939,11 @@ var RebaseRealtimeChannel = class {
 				}
 				if (seq <= this.lastSeq) break;
 				this.lastSeq = seq;
+				this.positioned = true;
 				this.deliver(event);
 				break;
 			}
 			case "channel_history": {
-				this.catchUpInFlight = false;
 				if (this.catchUpTimeout) {
 					clearTimeout(this.catchUpTimeout);
 					this.catchUpTimeout = null;
@@ -4014,6 +4954,9 @@ var RebaseRealtimeChannel = class {
 					retained,
 					latestSeq
 				});
+				const wasPositioned = this.positioned;
+				const firstNew = entries.find((entry) => entry.seq > this.lastSeq);
+				if (firstNew && wasPositioned && firstNew.seq > this.lastSeq + 1) this.reportHistoryGap(this.lastSeq + 1, firstNew.seq - 1);
 				for (const entry of entries) {
 					if (entry.seq <= this.lastSeq) continue;
 					this.lastSeq = entry.seq;
@@ -4024,6 +4967,28 @@ var RebaseRealtimeChannel = class {
 						replayed: true
 					});
 				}
+				if (retained) this.positioned = true;
+				const behind = retained && latestSeq !== void 0 && latestSeq > this.lastSeq;
+				if (behind && firstNew) {
+					this.emptyTailSeq = null;
+					this.requestHistory(this.catchUpLimit);
+					break;
+				}
+				if (behind && wasPositioned) {
+					if (this.emptyTailSeq === null) {
+						this.emptyTailSeq = latestSeq;
+						this.requestHistory(this.catchUpLimit);
+						break;
+					}
+					const firstLive = this.pendingLive.reduce((min, event) => event.seq !== void 0 && (min === void 0 || event.seq < min) ? event.seq : min, void 0);
+					const end = firstLive !== void 0 ? Math.min(this.emptyTailSeq, firstLive - 1) : this.emptyTailSeq;
+					if (end > this.lastSeq) {
+						this.reportHistoryGap(this.lastSeq + 1, end);
+						this.lastSeq = end;
+					}
+				}
+				this.emptyTailSeq = null;
+				this.catchUpInFlight = false;
 				this.flushPendingLive();
 				break;
 			}
@@ -4032,20 +4997,32 @@ var RebaseRealtimeChannel = class {
 				const raw = message.payload?.error;
 				const asObject = typeof raw === "object" ? raw : void 0;
 				const text = asObject?.message ?? (typeof raw === "string" ? raw : void 0) ?? message.error ?? "The server refused a channel operation.";
-				const error = new RebaseApiError$1(text, { ...asObject?.code ? { code: asObject.code } : {} });
-				if (this.errorHandlers.size === 0) {
-					console.warn(`[Rebase] Channel "${this.name}" error${asObject?.code ? ` (${asObject.code})` : ""}: ${text}. Attach \`channel.onError(...)\` to handle it.`);
-					break;
-				}
-				for (const handler of [...this.errorHandlers]) try {
-					handler(error);
-				} catch (e) {
-					console.error("Error in channel error handler:", e);
-				}
+				this.emitError(new RebaseApiError$1(text, { ...asObject?.code ? { code: asObject.code } : {} }));
 				break;
 			}
 		}
 	}
+	/** Tell the app that retention dropped messages it never received. */
+	reportHistoryGap(from, to) {
+		this.emitError(new RebaseApiError$1(`Channel "${this.name}" missed messages ${from}–${to}: the server no longer retains them. Resync this channel's state.`, {
+			code: "CHANNEL_HISTORY_GAP",
+			details: {
+				from,
+				to
+			}
+		}));
+	}
+	emitError(error) {
+		if (this.errorHandlers.size === 0) {
+			console.warn(`[Rebase] Channel "${this.name}" error${error.code ? ` (${error.code})` : ""}: ${error.message}. Attach \`channel.onError(...)\` to handle it.`);
+			return;
+		}
+		for (const handler of [...this.errorHandlers]) try {
+			handler(error);
+		} catch (e) {
+			console.error("Error in channel error handler:", e);
+		}
+	}
 	/** Deliver everything held back during a catch-up, in sequence order. */
 	flushPendingLive() {
 		if (this.pendingLive.length === 0) return;
@@ -4056,6 +5033,7 @@ var RebaseRealtimeChannel = class {
 			if (seq !== void 0) {
 				if (seq <= this.lastSeq) continue;
 				this.lastSeq = seq;
+				this.positioned = true;
 			}
 			this.deliver(event);
 		}
@@ -4200,6 +5178,16 @@ var IDEMPOTENCY_IN_PROGRESS = "IDEMPOTENCY_KEY_IN_PROGRESS";
 function isIdempotencyInProgressError(error) {
 	return error instanceof RebaseApiError && error.status === 409 && error.code === IDEMPOTENCY_IN_PROGRESS;
 }
+/**
+* Is this key held for a different request than the one just sent with it?
+*
+* For a create the queue already sent once, that is an answer rather than a
+* failure: the key is live only because the first attempt got through and
+* committed, and only its response went missing.
+*/
+function isIdempotencyKeyReusedError(error) {
+	return error instanceof RebaseApiError && error.status === 422 && error.code === "IDEMPOTENCY_KEY_REUSED";
+}
 /** Is this failure worth another attempt later? */
 function isRetryableError(error) {
 	if (isNetworkError(error)) return true;
@@ -4242,12 +5230,18 @@ var ConnectivityMonitor = class {
 	clearTimer;
 	/** Called when the backoff window expires, to drive an automatic retry. */
 	onRetryDue;
+	/**
+	* Called when the browser says the connection is back. Its own hook rather
+	* than {@link onRetryDue}: a client with automatic retries off sets no retry
+	* callback, and the `online` event has to wake it all the same.
+	*/
+	onOnline;
 	handleOnline = () => {
 		this.retryAt = 0;
 		this.backoffMs = this.initialBackoffMs;
 		this.clearPendingTimer();
 		this.setState("online");
-		this.onRetryDue?.();
+		(this.onOnline ?? this.onRetryDue)?.();
 	};
 	handleOffline = () => {
 		this.setState("offline");
@@ -4322,6 +5316,7 @@ var ConnectivityMonitor = class {
 		this.clearPendingTimer();
 		this.listeners.clear();
 		this.onRetryDue = void 0;
+		this.onOnline = void 0;
 	}
 	scheduleRetry(delay) {
 		this.clearPendingTimer();
@@ -4550,9 +5545,10 @@ var IndexedDBOfflineStore = class {
 *   would have included them.
 * - `ORDER BY` puts nulls last ascending and first descending, which is the
 *   Postgres default.
-* - The wire format carries no types, so values arriving as strings are
-*   compared numerically against numeric columns and as instants against
-*   date columns. `["==", "3"]` matches the number `3`, as it does server-side.
+* - A filter value may arrive as a string (off a URL, say), so a string is
+*   compared numerically against a number and as an instant against a date.
+*   `["==", "3"]` matches the number `3`, as it does server-side. Two strings
+*   compare as text: `"01234"` is not `"1234"`.
 *
 * Two things it deliberately approximates, both flagged by
 * {@link isExactlyEvaluable}: `searchString` becomes a case-insensitive
@@ -4592,9 +5588,11 @@ function compareValues(a, b) {
 	const right = toComparable(b);
 	if (isNullish(left) || isNullish(right)) return void 0;
 	if (typeof left === "boolean" || typeof right === "boolean") return (left === true || left === "true" || left === 1 ? 1 : 0) - (right === true || right === "true" || right === 1 ? 1 : 0);
-	const leftNum = typeof left === "number" ? left : numericOrNaN(left);
-	const rightNum = typeof right === "number" ? right : numericOrNaN(right);
-	if (!Number.isNaN(leftNum) && !Number.isNaN(rightNum)) return leftNum < rightNum ? -1 : leftNum > rightNum ? 1 : 0;
+	if (isNumeric(left) || isNumeric(right)) {
+		const leftNum = numericOrNaN(left);
+		const rightNum = numericOrNaN(right);
+		if (!Number.isNaN(leftNum) && !Number.isNaN(rightNum)) return leftNum < rightNum ? -1 : leftNum > rightNum ? 1 : 0;
+	}
 	if (typeof left === "number" || typeof right === "number") {
 		const leftTime = toTime(left);
 		const rightTime = toTime(right);
@@ -4605,6 +5603,9 @@ function compareValues(a, b) {
 	if (collator) return collator.compare(leftStr, rightStr);
 	return leftStr < rightStr ? -1 : leftStr > rightStr ? 1 : 0;
 }
+function isNumeric(value) {
+	return typeof value === "number" || typeof value === "bigint";
+}
 function numericOrNaN(value) {
 	if (typeof value === "number") return value;
 	if (typeof value === "string" && value.trim() !== "") {
@@ -4621,12 +5622,17 @@ function toTime(value) {
 		return Number.isNaN(t) ? void 0 : t;
 	}
 }
-/** Equality with the wire's type erasure allowed for, but never across NULL. */
+/**
+* Equality with a string filter value allowed to name a number, a boolean or
+* an instant, but never across NULL. Two strings are equal only when they are
+* the same string, as text is in Postgres.
+*/
 function looseEquals(a, b) {
 	const left = toComparable(a);
 	const right = toComparable(b);
 	if (isNullish(left) || isNullish(right)) return isNullish(left) && isNullish(right);
 	if (left === right) return true;
+	if (typeof left === "string" && typeof right === "string") return false;
 	return compareValues(left, right) === 0;
 }
 /**
@@ -4711,12 +5717,44 @@ function matchesOperator(rowValue, op, filterValue) {
 function isTuple(value) {
 	return Array.isArray(value) && value.length === 2 && typeof value[0] === "string" && toCanonicalOp(value[0]) !== void 0;
 }
+/**
+* One field's condition, as the tuples this evaluator can read.
+*
+* The single reading of a condition, for {@link matchesWhere} and
+* {@link isExactlyEvaluable} both. Each used to have its own, and only the
+* first was hardened: `{ status: undefined }` (a skipped filter) and the bare
+* wire string `"eq.active"` both reached `.filter` on a non-array in the
+* second and threw.
+*
+* `unreadable` is set when the condition is there but yields nothing this
+* build understands — a wire string, an operator from a newer server. Such a
+* condition filters nothing locally while the server does filter on it, so an
+* answer that ignored it would be wider than the server's.
+*/
+function conditionTuples(condition) {
+	if (condition === void 0) return {
+		tuples: [],
+		unreadable: false
+	};
+	if (isTuple(condition)) return {
+		tuples: [condition],
+		unreadable: false
+	};
+	if (!Array.isArray(condition)) return {
+		tuples: [],
+		unreadable: true
+	};
+	const tuples = condition.filter(isTuple);
+	return {
+		tuples,
+		unreadable: tuples.length !== condition.length || tuples.length === 0
+	};
+}
 /** Evaluate a `where` clause: every field, and every tuple on a field, AND-ed. */
 function matchesWhere(row, where) {
 	if (!where) return true;
 	for (const [field, condition] of Object.entries(where)) {
-		if (condition === void 0) continue;
-		const tuples = isTuple(condition) ? [condition] : Array.isArray(condition) ? condition.filter(isTuple) : [];
+		const { tuples } = conditionTuples(condition);
 		for (const [rawOp, value] of tuples) {
 			const op = toCanonicalOp(rawOp) ?? rawOp;
 			if (!matchesOperator(row[field], op, value)) return false;
@@ -4830,10 +5868,18 @@ var ORDERING_OPS = /* @__PURE__ */ new Set([
 	">",
 	">="
 ]);
-/** Does any condition in this `where` clause order its operands? */
-function whereOrders(where) {
+/**
+* Does any condition in this `where` clause order its operands — or say
+* something this evaluator cannot read at all? Either way the local answer is
+* not the server's.
+*/
+function whereNotExact(where) {
 	if (!where) return false;
-	for (const condition of Object.values(where)) if ((isTuple(condition) ? [condition] : condition.filter(isTuple)).some(([op]) => ORDERING_OPS.has(op))) return true;
+	for (const condition of Object.values(where)) {
+		const { tuples, unreadable } = conditionTuples(condition);
+		if (unreadable) return true;
+		if (tuples.some(([op]) => ORDERING_OPS.has(toCanonicalOp(op) ?? op))) return true;
+	}
 	return false;
 }
 /** The same question, through an `and(...)`/`or(...)` tree. */
@@ -4890,7 +5936,7 @@ function isExactlyEvaluable(params) {
 	if (hasAnyInclude(params.include)) return false;
 	if (params.searchString) return false;
 	if (params.vectorSearch) return false;
-	if (whereOrders(params.where)) return false;
+	if (whereNotExact(params.where)) return false;
 	if (logicalOrders(params.logical)) return false;
 	if (whereReachesThroughRelation(params.where)) return false;
 	if (logicalReachesThroughRelation(params.logical)) return false;
@@ -4911,14 +5957,14 @@ function logicalReachesThroughRelation(condition, depth = 0) {
 *
 * Asked of the rows rather than of the query, because unlike a filter this one
 * *is* decidable from the data in hand: {@link compareValues} reaches the
-* collator only when it cannot read both operands as numbers, and `toComparable`
-* has already turned dates and relations into numbers and ids by then. If every
+* collator only when neither operand is a number, and `toComparable` has
+* already turned dates and relations into numbers and ids by then. If every
 * value on the sort column normalises to a number, the collator is unreachable
 * and the local order is the server's order.
 *
 * A text column is therefore refused — see {@link isExactlyEvaluable} for why
-* the two cannot be made to agree — and so is a column this page happens to see
-* only as strings, which is the same thing from here.
+* the two cannot be made to agree — including one holding only digits, which
+* Postgres orders as text ("10", "100", "9").
 *
 * Nulls are fine either way: they are ordered by an explicit rule (last
 * ascending, first descending) that matches Postgres and never reaches the
@@ -4933,7 +5979,6 @@ function isLocallySortable(rows, orderBy) {
 		if (isNullish(value)) return true;
 		if (typeof value === "number" || typeof value === "boolean") return true;
 		if (typeof value === "bigint") return true;
-		if (typeof value === "string" && value.trim() !== "" && !Number.isNaN(Number(value))) return true;
 		return false;
 	}));
 }
@@ -4972,6 +6017,27 @@ function offlineError(message) {
 		code: "OFFLINE"
 	});
 }
+/**
+* What a write discarded because an earlier write it depends on was refused is
+* reported with. It was never sent; the refusal that doomed it is its `cause`.
+*/
+function dependencyRejected(refused, error) {
+	return new RebaseApiError(`Not sent: an earlier queued write to the same row was refused (${error.message}).`, {
+		status: error instanceof RebaseApiError ? error.status : void 0,
+		code: "DEPENDENCY_REJECTED",
+		details: { rejectedMutationId: refused.mutationId },
+		cause: error
+	});
+}
+/**
+* A refusal about what a write contains — a field the collection no longer
+* has, one the caller may not write, a value a constraint refuses — rather
+* than about the row or the caller as a whole.
+*/
+function isFieldRefusal(error) {
+	if (!(error instanceof RebaseApiError)) return false;
+	return error.status === 400 || error.status === 403 || error.status === 422;
+}
 function generateOfflineStringId() {
 	if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
 	return `off-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
@@ -5025,6 +6091,29 @@ function optimisticRow(fields, id) {
 		id
 	};
 }
+/**
+* Whether a query answers with something narrower than whole rows: `fields`
+* returns only the columns it names (and the key), and `distinct` collapses
+* rows into their distinct projections. Either way what comes back is not a
+* row of the collection, and must not be stored as one.
+*/
+function isProjection(params) {
+	return (params?.fields?.length ?? 0) > 0 || params?.distinct === true;
+}
+/** `row` narrowed to `keys`: a local row in the shape a projection has. */
+function pick(row, keys) {
+	const out = {};
+	for (const key of keys) if (key in row) out[key] = row[key];
+	return out;
+}
+/** A snapshot as read back from the store, its projected rows revived. */
+function readSnapshot(value) {
+	const snapshot = value;
+	return snapshot.rows ? {
+		...snapshot,
+		rows: snapshot.rows.map((row) => hydrateRow(row))
+	} : snapshot;
+}
 var MISSING = "\0missing";
 /**
 * Replays to spend on a mutation whose idempotency key the server is still
@@ -5037,6 +6126,8 @@ var MISSING = "\0missing";
 * blocking the queue behind it indefinitely.
 */
 var IN_PROGRESS_MIN_RETRIES = 12;
+/** The scope of whatever is cached and queued while nobody is signed in. */
+var SIGNED_OUT_SCOPE = "anon";
 var OfflineManager = class {
 	store;
 	maxCachedQueries;
@@ -5046,7 +6137,27 @@ var OfflineManager = class {
 	createInner;
 	inners = /* @__PURE__ */ new Map();
 	connectivity;
-	scope = "anon";
+	scope = SIGNED_OUT_SCOPE;
+	/**
+	* Set while the manager does not know whose data it holds: from
+	* {@link holdScope} until the next {@link setScope}. `scope` is not
+	* consulted meanwhile — no operation gets a {@link ScopeTicket}, and
+	* nothing reads or writes the store.
+	*/
+	scopeHold;
+	/**
+	* Bumped by every change of user, and by `clear()`.
+	*
+	* The load paths always re-checked the scope after their awaits; the write
+	* paths did not. A `find` sent for user A that answered after B had signed
+	* in wrote A's RLS-filtered rows into B's local database, under B's keys,
+	* and showed them to B's observers; a replay acknowledged after the switch
+	* dequeued a key under B's scope that did not exist, so A's write stayed
+	* queued and was sent again when A came back. Every write now carries the
+	* {@link ScopeTicket} its operation started under, and one that is stale
+	* touches nothing that belongs to the new user.
+	*/
+	scopeEpoch = 0;
 	/** The local database: normalized rows and query snapshots per collection. */
 	collections = /* @__PURE__ */ new Map();
 	/** In-memory mirror of the current scope's queue, in replay order. */
@@ -5103,6 +6214,9 @@ var OfflineManager = class {
 		if (maxBackoffMs > 0) this.connectivity.onRetryDue = () => {
 			this.sync().catch(() => void 0);
 		};
+		this.connectivity.onOnline = () => {
+			this.sync().catch(() => void 0);
+		};
 		this.connectivity.onChange((online) => {
 			this.patchStatus({ online });
 			if (online) this.revalidateAll();
@@ -5115,7 +6229,12 @@ var OfflineManager = class {
 		} catch {}
 		this.api = {
 			sync: () => this.sync(),
-			pending: async () => {
+			pending: async (options) => {
+				if (options?.orphaned) {
+					await this.scopeKnown();
+					if (this.scope === SIGNED_OUT_SCOPE) return [];
+					return await this.store.listQueue(`${SIGNED_OUT_SCOPE}|`);
+				}
 				await this.ensureQueueLoaded();
 				return this.queue.map((m) => structuredClone(m));
 			},
@@ -5124,7 +6243,15 @@ var OfflineManager = class {
 				this.statusListeners.add(listener);
 				return () => this.statusListeners.delete(listener);
 			},
-			clear: async () => {
+			clear: async (options) => {
+				await this.scopeKnown();
+				if (options?.orphaned) {
+					if (this.scope === SIGNED_OUT_SCOPE) return;
+					await this.store.clear(`${SIGNED_OUT_SCOPE}|`);
+					this.broadcast({ type: "queue" }, SIGNED_OUT_SCOPE);
+					return;
+				}
+				this.scopeEpoch++;
 				await this.store.clear(`${this.scope}|`);
 				this.queue = [];
 				this.resetCollections();
@@ -5148,9 +6275,45 @@ var OfflineManager = class {
 	* across a sign-out/sign-in on a shared browser.
 	*/
 	setScope(uid) {
-		const next = uid || "anon";
-		if (next === this.scope) return;
+		const next = uid || SIGNED_OUT_SCOPE;
+		const hold = this.scopeHold;
+		if (!hold && next === this.scope) return;
 		this.scope = next;
+		this.scopeHold = void 0;
+		this.leaveScope();
+		hold?.release();
+		this.revalidateAll();
+		this.sync().catch(() => void 0);
+	}
+	/**
+	* Forget whose data this is until the next {@link setScope}.
+	*
+	* For the time before the client knows who is signed in — a session being
+	* restored on load. Taking that time for "signed out" would put the user's
+	* own writes in the signed-out queue, which no sign-in replays, and show
+	* them the signed-out local database instead of theirs.
+	*
+	* Meanwhile the manager has no scope at all. Every operation — a read, a
+	* write, a replay, `pending()`, `clear()` — waits for one and then runs
+	* for whoever it turns out to be, and nothing reads or writes the store.
+	* A realtime frame arriving in between is handed on as the server sent it
+	* and kept nowhere.
+	*/
+	holdScope() {
+		if (this.scopeHold) return;
+		let release;
+		const known = new Promise((resolve) => {
+			release = resolve;
+		});
+		this.scopeHold = {
+			known,
+			release
+		};
+		this.leaveScope();
+	}
+	/** Let go of the current user's rows and queue: in memory, and on screen. */
+	leaveScope() {
+		this.scopeEpoch++;
 		this.queueLoad = void 0;
 		this.queue = [];
 		this.resetCollections();
@@ -5160,8 +6323,34 @@ var OfflineManager = class {
 		});
 		this.notifyQueue();
 		for (const slug of this.observers.keys()) this.notifyCollection(slug, false);
-		this.revalidateAll();
-		this.sync().catch(() => void 0);
+	}
+	/** Settles once the manager knows whose data it holds — see {@link holdScope}. */
+	async scopeKnown() {
+		while (this.scopeHold) await this.scopeHold.known;
+	}
+	/**
+	* The user an operation is running for — see {@link scopeEpoch} — or
+	* nothing while that is not known ({@link holdScope}). An operation takes
+	* it as `this.ticket() ?? await this.nextTicket()`, before its first await.
+	*/
+	ticket() {
+		if (this.scopeHold) return void 0;
+		return {
+			scope: this.scope,
+			epoch: this.scopeEpoch
+		};
+	}
+	/** The ticket of whoever the held scope turns out to be. */
+	async nextTicket() {
+		await this.scopeKnown();
+		return {
+			scope: this.scope,
+			epoch: this.scopeEpoch
+		};
+	}
+	/** Whether an operation's user is still the signed-in one. */
+	isCurrent(ticket) {
+		return ticket.epoch === this.scopeEpoch;
 	}
 	/**
 	* Throw away every local row, for a scope change or an explicit clear.
@@ -5199,12 +6388,15 @@ var OfflineManager = class {
 		this.inners.set(slug, inner);
 		const wrapped = {
 			find: async (params) => {
+				const ticket = this.ticket() ?? await this.nextTicket();
 				const state = await this.ensureCollection(slug);
 				if (this.connectivity.shouldAttempt()) try {
 					const res = await inner.find(params);
 					this.connectivity.markSuccess();
-					await this.ingest(slug, res.data ?? []);
-					const snapshot = this.recordSnapshot(slug, params, res);
+					if (!this.isCurrent(ticket)) return res;
+					await this.ingest(slug, res.data ?? [], ticket, isProjection(params));
+					if (!this.isCurrent(ticket)) return res;
+					const snapshot = this.recordSnapshot(slug, params, res, ticket);
 					const answer = this.answer(slug, params, snapshot);
 					this.notifyCollection(slug, false);
 					return {
@@ -5234,12 +6426,14 @@ var OfflineManager = class {
 			iterate: (params) => paginateFind((p) => wrapped.find(p), params, slug),
 			findAll: (params) => collectAllPages((p) => wrapped.find(p), params, slug),
 			findById: async (id) => {
+				const ticket = this.ticket() ?? await this.nextTicket();
 				await this.ensureCollection(slug);
 				if (this.connectivity.shouldAttempt()) try {
 					const row = await inner.findById(id);
 					this.connectivity.markSuccess();
-					if (row !== void 0) await this.ingest(slug, [row]);
-					else if (!this.hasPending(slug, id)) this.removeLocalRow(slug, id, true);
+					if (!this.isCurrent(ticket)) return row;
+					if (row !== void 0) await this.ingest(slug, [row], ticket);
+					else if (!this.hasPending(slug, id)) this.removeLocalRow(slug, id, ticket, true);
 					this.notifyCollection(slug, false);
 					return this.localRow(slug, id);
 				} catch (error) {
@@ -5259,18 +6453,25 @@ var OfflineManager = class {
 				});
 				return row;
 			},
-			create: async (data, id) => {
+			create: async (data, id, options) => {
+				const ticket = this.ticket() ?? await this.nextTicket();
 				await this.ensureCollection(slug);
+				const idempotencyKey = options?.idempotencyKey ?? createMutationId();
+				let sent = false;
 				if (this.connectivity.shouldAttempt()) try {
-					const row = await inner.create(data, id);
+					const row = await inner.create(data, id, {
+						...options,
+						idempotencyKey
+					});
 					this.connectivity.markSuccess();
-					await this.ingest(slug, [row]);
+					await this.ingest(slug, [row], ticket);
 					this.notifyCollection(slug);
 					this.scheduleRefresh(slug);
 					return row;
 				} catch (error) {
 					if (!isNetworkError(error)) throw error;
 					this.connectivity.markFailure();
+					sent = true;
 				}
 				const providedId = id ?? data.id;
 				const rowId = providedId ?? this.mintOfflineId(slug);
@@ -5281,27 +6482,40 @@ var OfflineManager = class {
 					id: rowId,
 					data: row,
 					generatedId: providedId === void 0,
+					...sent ? { sent: {
+						idempotencyKey,
+						data: { ...data },
+						id
+					} } : {},
 					rollback: { rows: { [String(rowId)]: this.rawLocalRow(slug, rowId) ?? null } }
-				});
-				this.setLocalRow(slug, rowId, row);
+				}, ticket);
+				this.setLocalRow(slug, rowId, row, ticket);
 				this.notifyCollection(slug);
 				return row;
 			},
 			createMany: async (data, options) => {
+				const ticket = this.ticket() ?? await this.nextTicket();
 				await this.ensureCollection(slug);
 				if (!Array.isArray(data)) throw new TypeError("createMany expects an array of records.");
 				if (data.length === 0) return [];
+				const idempotencyKey = options?.idempotencyKey ?? createMutationId();
+				let sent = false;
 				if (this.connectivity.shouldAttempt()) try {
-					const rows = await inner.createMany(data, options);
+					const rows = await inner.createMany(data, {
+						...options,
+						idempotencyKey
+					});
 					this.connectivity.markSuccess();
-					await this.ingest(slug, rows);
+					await this.ingest(slug, rows, ticket);
 					this.notifyCollection(slug);
 					this.scheduleRefresh(slug);
 					return rows;
 				} catch (error) {
 					if (!isNetworkError(error)) throw error;
 					this.connectivity.markFailure();
+					sent = true;
 				}
+				if (!sent && options?.onConflict?.length) throw new RebaseClientError(`Cannot upsert into "${slug}" while offline: the rows it would replace can only be found by the server. Upserting on the primary key, with the key in each row, is queued; upserting on a natural key is not.`, { code: "OFFLINE_UPSERT_UNSUPPORTED" });
 				const rows = data.map((r) => optimisticRow(r, r.id ?? this.mintOfflineId(slug)));
 				const rollback = {};
 				for (const row of rows) {
@@ -5313,9 +6527,14 @@ var OfflineManager = class {
 					type: "createMany",
 					data: rows,
 					upsert: options?.upsert,
+					...sent ? { sent: {
+						idempotencyKey,
+						data: data.map((r) => ({ ...r })),
+						...options?.onConflict?.length ? { onConflict: [...options.onConflict] } : {}
+					} } : {},
 					rollback: { rows: rollback }
-				});
-				for (const row of rows) this.setLocalRow(slug, row.id, row);
+				}, ticket);
+				for (const row of rows) this.setLocalRow(slug, row.id, row, ticket);
 				this.notifyCollection(slug);
 				return rows;
 			},
@@ -5331,11 +6550,12 @@ var OfflineManager = class {
 			* queue drains — the exact outcome upsert exists to prevent.
 			*/
 			upsert: async (data, options) => {
+				const ticket = this.ticket() ?? await this.nextTicket();
 				await this.ensureCollection(slug);
 				if (this.connectivity.shouldAttempt()) try {
 					const row = await inner.upsert(data, options);
 					this.connectivity.markSuccess();
-					await this.ingest(slug, [row]);
+					await this.ingest(slug, [row], ticket);
 					this.notifyCollection(slug);
 					this.scheduleRefresh(slug);
 					return row;
@@ -5352,12 +6572,13 @@ var OfflineManager = class {
 					data: [row],
 					upsert: true,
 					rollback: { rows: { [String(rowId)]: this.rawLocalRow(slug, rowId) ?? null } }
-				});
-				this.setLocalRow(slug, rowId, row);
+				}, ticket);
+				this.setLocalRow(slug, rowId, row, ticket);
 				this.notifyCollection(slug);
 				return row;
 			},
 			updateMany: async (updates, options) => {
+				const ticket = this.ticket() ?? await this.nextTicket();
 				await this.ensureCollection(slug);
 				if (!Array.isArray(updates)) throw new TypeError("updateMany expects an array of { id, data } entries.");
 				if (updates.length === 0) return [];
@@ -5365,7 +6586,7 @@ var OfflineManager = class {
 				if (this.connectivity.shouldAttempt() && !anyPending) try {
 					const rows = await inner.updateMany(updates, options);
 					this.connectivity.markSuccess();
-					await this.ingest(slug, rows);
+					await this.ingest(slug, rows, ticket);
 					this.notifyCollection(slug);
 					return rows;
 				} catch (error) {
@@ -5390,12 +6611,13 @@ var OfflineManager = class {
 						data: u.data
 					})),
 					rollback: { rows: rollback }
-				});
-				for (const row of optimistic) this.setLocalRow(slug, row.id, row);
+				}, ticket);
+				for (const row of optimistic) this.setLocalRow(slug, row.id, row, ticket);
 				this.notifyCollection(slug);
 				return optimistic;
 			},
 			deleteMany: async (ids, options) => {
+				const ticket = this.ticket() ?? await this.nextTicket();
 				await this.ensureCollection(slug);
 				if (!Array.isArray(ids)) throw new TypeError("deleteMany expects an array of ids.");
 				if (ids.length === 0) return;
@@ -5403,7 +6625,7 @@ var OfflineManager = class {
 				if (this.connectivity.shouldAttempt() && !anyPending) try {
 					await inner.deleteMany(ids, options);
 					this.connectivity.markSuccess();
-					for (const id of ids) this.removeLocalRow(slug, id, true);
+					for (const id of ids) this.removeLocalRow(slug, id, ticket, true);
 					this.notifyCollection(slug);
 					this.scheduleRefresh(slug);
 					return;
@@ -5418,66 +6640,94 @@ var OfflineManager = class {
 					type: "deleteMany",
 					ids,
 					rollback: { rows: rollback }
-				});
-				for (const id of ids) this.removeLocalRow(slug, id, false);
+				}, ticket);
+				for (const id of ids) this.removeLocalRow(slug, id, ticket, false);
 				this.notifyCollection(slug);
 			},
 			update: async (id, data, options) => {
+				const ticket = this.ticket() ?? await this.nextTicket();
 				await this.ensureCollection(slug);
+				const idempotencyKey = options?.idempotencyKey ?? createMutationId();
+				let sent = false;
+				let sendFailure;
 				if (this.connectivity.shouldAttempt() && !this.hasPending(slug, id)) try {
-					const row = await inner.update(id, data, options);
+					const row = await inner.update(id, data, {
+						...options,
+						idempotencyKey
+					});
 					this.connectivity.markSuccess();
-					await this.ingest(slug, [row]);
+					await this.ingest(slug, [row], ticket);
 					this.notifyCollection(slug);
 					return row;
 				} catch (error) {
 					if (!isNetworkError(error)) throw error;
 					this.connectivity.markFailure();
+					sent = true;
+					sendFailure = error;
+				}
+				if (hasFieldOperation(data)) {
+					if (sent) throw new RebaseApiError(`The connection failed after a field operation on "${slug}" was sent, so it may or may not have been applied. Retry it with the idempotencyKey in \`details\` to apply it at most once.`, {
+						status: 0,
+						code: "NETWORK_ERROR",
+						details: { idempotencyKey },
+						cause: sendFailure
+					});
+					throw new RebaseClientError(`Cannot apply a field operation to "${slug}" while offline: it is evaluated against the stored value, which this device does not have a current copy of. Send the value itself, or retry when the connection is back.`, { code: "OFFLINE_FIELD_OP_UNSUPPORTED" });
 				}
-				if (hasFieldOperation(data)) throw new RebaseClientError(`Cannot apply a field operation to "${slug}" while offline: it is evaluated against the stored value, which this device does not have a current copy of. Send the value itself, or retry when the connection is back.`, { code: "OFFLINE_FIELD_OP_UNSUPPORTED" });
 				const base = this.rawLocalRow(slug, id);
 				await this.enqueue({
 					collection: slug,
 					type: "update",
 					id,
 					data,
+					...sent ? { sent: { idempotencyKey } } : {},
 					rollback: { rows: { [String(id)]: base ?? null } }
-				});
+				}, ticket);
 				const optimistic = optimisticRow({
 					...base ?? {},
 					...data
 				}, id);
-				this.setLocalRow(slug, id, optimistic);
+				this.setLocalRow(slug, id, optimistic, ticket);
 				this.notifyCollection(slug);
 				return optimistic;
 			},
 			delete: async (id, options) => {
+				const ticket = this.ticket() ?? await this.nextTicket();
 				await this.ensureCollection(slug);
+				const idempotencyKey = options?.idempotencyKey ?? createMutationId();
+				let sent = false;
 				if (this.connectivity.shouldAttempt() && !this.hasPending(slug, id)) try {
-					await inner.delete(id, options);
+					await inner.delete(id, {
+						...options,
+						idempotencyKey
+					});
 					this.connectivity.markSuccess();
-					this.removeLocalRow(slug, id, true);
+					this.removeLocalRow(slug, id, ticket, true);
 					this.notifyCollection(slug);
 					this.scheduleRefresh(slug);
 					return;
 				} catch (error) {
 					if (!isNetworkError(error)) throw error;
 					this.connectivity.markFailure();
+					sent = true;
 				}
 				await this.enqueue({
 					collection: slug,
 					type: "delete",
 					id,
+					...sent ? { sent: { idempotencyKey } } : {},
 					rollback: { rows: { [String(id)]: this.rawLocalRow(slug, id) ?? null } }
-				});
-				this.removeLocalRow(slug, id);
+				}, ticket);
+				this.removeLocalRow(slug, id, ticket);
 				this.notifyCollection(slug);
 			},
 			count: async (params) => {
+				const ticket = this.ticket() ?? await this.nextTicket();
 				await this.ensureCollection(slug);
 				if (this.connectivity.shouldAttempt()) try {
 					const n = await inner.count(params);
 					this.connectivity.markSuccess();
+					if (!this.isCurrent(ticket)) return n;
 					this.writeCache(this.countKey(slug, params), n);
 					return Math.max(0, n + this.pendingDelta(slug, params));
 				} catch (error) {
@@ -5511,12 +6761,40 @@ var OfflineManager = class {
 			listenById: inner.listenById
 		};
 		if (!isUnsupported(inner.listen)) wrapped.listen = (params, onUpdate, onError) => inner.listen(params, (response) => {
-			this.ingest(slug, response.data ?? []).then(() => this.notifyCollection(slug, false));
-			onUpdate(response);
+			const ticket = this.ticket();
+			if (!ticket) {
+				onUpdate(response);
+				return;
+			}
+			this.ingest(slug, response.data ?? [], ticket, isProjection(params)).then(() => {
+				if (!this.isCurrent(ticket)) return;
+				const snapshot = this.recordSnapshot(slug, params, response, ticket);
+				const answer = this.answer(slug, params, snapshot);
+				this.notifyCollection(slug, false);
+				onUpdate({
+					...response,
+					data: answer.data,
+					meta: answer.meta
+				});
+			});
 		}, onError);
 		if (!isUnsupported(inner.listenById)) wrapped.listenById = (id, onUpdate, onError) => inner.listenById(id, (row) => {
-			if (row) this.ingest(slug, [row]).then(() => this.notifyCollection(slug, false));
-			onUpdate(row);
+			const ticket = this.ticket();
+			if (!ticket) {
+				onUpdate(row);
+				return;
+			}
+			if (!row) {
+				if (!this.hasPending(slug, id)) this.removeLocalRow(slug, id, ticket, true);
+				this.notifyCollection(slug, false);
+				onUpdate(row);
+				return;
+			}
+			this.ingest(slug, [row], ticket).then(() => {
+				if (!this.isCurrent(ticket)) return;
+				this.notifyCollection(slug, false);
+				onUpdate(this.localRow(slug, id) ?? row);
+			});
 		}, onError);
 		return wrapped;
 	}
@@ -5560,8 +6838,10 @@ var OfflineManager = class {
 			if (!closed) observer.emit();
 		})();
 		if (options?.realtime !== false && !isUnsupported(inner.listen)) unlisten = inner.listen(params, (response) => {
-			this.ingest(slug, response.data ?? []).then(() => {
-				this.recordSnapshot(slug, params, response);
+			const ticket = this.ticket();
+			if (!ticket) return;
+			this.ingest(slug, response.data ?? [], ticket, isProjection(params)).then(() => {
+				this.recordSnapshot(slug, params, response, ticket);
 				this.notifyCollection(slug, false);
 			});
 		}, onError);
@@ -5612,12 +6892,14 @@ var OfflineManager = class {
 			if (!closed) observer.emit();
 		})();
 		if (options?.realtime !== false && !isUnsupported(inner.listenById)) unlisten = inner.listenById(id, (row) => {
+			const ticket = this.ticket();
+			if (!ticket) return;
 			if (!row) {
-				if (!this.hasPending(slug, id)) this.removeLocalRow(slug, id, true);
+				if (!this.hasPending(slug, id)) this.removeLocalRow(slug, id, ticket, true);
 				this.notifyCollection(slug, false);
 				return;
 			}
-			this.ingest(slug, [row]).then(() => this.notifyCollection(slug, false));
+			this.ingest(slug, [row], ticket).then(() => this.notifyCollection(slug, false));
 		}, onError);
 		return () => {
 			closed = true;
@@ -5638,7 +6920,8 @@ var OfflineManager = class {
 		const state = this.collections.get(slug);
 		return `${total}|${rows.map((row) => {
 			const key = String(row.id);
-			return `${key}:${state?.rows.get(key)?.rev ?? 0}`;
+			const entry = state?.rows.get(key);
+			return entry?.row === row ? `${key}:${entry.rev}` : `${key}=${JSON.stringify(row)}`;
 		}).join(",")}`;
 	}
 	notifyCollection(slug, broadcast = true) {
@@ -5672,6 +6955,7 @@ var OfflineManager = class {
 		return state;
 	}
 	ensureCollection(slug) {
+		if (this.scopeHold) return this.scopeKnown().then(() => this.ensureCollection(slug));
 		const state = this.collectionState(slug);
 		if (!state.loaded) {
 			const scope = this.scope;
@@ -5694,7 +6978,7 @@ var OfflineManager = class {
 				}
 				for (const entry of snapshots) {
 					const key = entry.key.slice(`${scope}|q|${slug}|`.length);
-					if (entry.value) state.snapshots.set(key, entry.value);
+					if (entry.value) state.snapshots.set(key, readSnapshot(entry.value));
 				}
 				for (const entry of absent) state.absent.add(entry.key.slice(`${scope}|abs|${slug}|`.length));
 			})().catch(() => void 0).finally(() => {
@@ -5744,6 +7028,7 @@ var OfflineManager = class {
 				partial: true
 			};
 		}
+		if (snapshot.rows) return this.projectedAnswer(slug, params, snapshot, snapshot.rows, fromCache);
 		const rows = [];
 		const seen = /* @__PURE__ */ new Set();
 		/** Rows the server counted that we know are no longer in the result. */
@@ -5786,6 +7071,71 @@ var OfflineManager = class {
 			partial: !exact || !orderIsLocal
 		};
 	}
+	/**
+	* Answer a projected query (`fields`, `distinct`) from the server's own
+	* answer to it.
+	*
+	* The server's rows are the answer. The local database contributes only
+	* what it knows better: a row with unsynced writes shows them, narrowed to
+	* the columns the server sent, or drops out if it was deleted here or
+	* edited out of a filter this side can evaluate; and rows created here
+	* join the first page when there is somewhere to put them. A distinct
+	* query, or an order on a column the projection does not carry, leaves
+	* them out, and the result says it is partial.
+	*/
+	projectedAnswer(slug, params, snapshot, served, fromCache) {
+		const state = this.collectionState(slug);
+		const exact = isExactlyEvaluable(params);
+		const rows = [];
+		const seen = /* @__PURE__ */ new Set();
+		let removed = 0;
+		for (const row of served) {
+			const key = row.id === void 0 || row.id === null ? void 0 : String(row.id);
+			if (key !== void 0) seen.add(key);
+			if (key === void 0 || !this.hasPending(slug, key)) {
+				rows.push(row);
+				continue;
+			}
+			const local = state.rows.get(key)?.row;
+			if (!local || exact && !matchesParams(local, params)) {
+				removed++;
+				continue;
+			}
+			rows.push(pick(local, Object.keys(row)));
+		}
+		let added = 0;
+		let unplaced = false;
+		const offset = snapshot.offset ?? 0;
+		if (exact && offset === 0) {
+			const shape = served.length > 0 ? Object.keys(served[0]) : ["id", ...params?.fields ?? []];
+			const placeable = !params?.distinct && (normalizeOrderBy(params?.orderBy) ?? []).every(([field]) => shape.includes(field));
+			for (const [key, entry] of state.rows) {
+				if (seen.has(key) || !this.hasPending(slug, key)) continue;
+				if (!this.isLocallyCreated(slug, key)) continue;
+				if (!matchesParams(entry.row, params)) continue;
+				if (!placeable) {
+					unplaced = true;
+					continue;
+				}
+				rows.push(pick(entry.row, shape));
+				added++;
+			}
+		}
+		const orderIsLocal = added === 0 || isLocallySortable(rows, params?.orderBy);
+		if (added > 0 && params?.orderBy && orderIsLocal) sortRows(rows, params.orderBy);
+		return {
+			data: rows,
+			meta: {
+				total: Math.max(rows.length, snapshot.total - removed + added),
+				limit: snapshot.limit,
+				offset,
+				hasMore: snapshot.hasMore
+			},
+			fromCache,
+			hasPendingWrites: rows.some((row) => row.id !== void 0 && row.id !== null && this.hasPending(slug, row.id)),
+			partial: !exact || !orderIsLocal || unplaced
+		};
+	}
 	localFind(slug, params) {
 		const state = this.collections.get(slug);
 		const snapshot = this.snapshotFor(slug, params);
@@ -5826,7 +7176,8 @@ var OfflineManager = class {
 	localRow(slug, id) {
 		return this.collections.get(slug)?.rows.get(String(id))?.row;
 	}
-	setLocalRow(slug, id, row) {
+	setLocalRow(slug, id, row, ticket) {
+		if (!this.isCurrent(ticket)) return;
 		const state = this.collectionState(slug);
 		const key = String(id);
 		const cachedAt = Date.now();
@@ -5846,7 +7197,8 @@ var OfflineManager = class {
 	* it, opening a deleted row while offline would report a missing local
 	* database instead of a missing row.
 	*/
-	removeLocalRow(slug, id, known = false) {
+	removeLocalRow(slug, id, ticket, known = false) {
+		if (!this.isCurrent(ticket)) return;
 		const state = this.collectionState(slug);
 		const key = String(id);
 		const existed = state.rows.delete(key);
@@ -5869,25 +7221,37 @@ var OfflineManager = class {
 	* Rows that came back unchanged keep their identity and revision, so a
 	* refetch that changed nothing does not re-render every live query that
 	* touches them — or rewrite them all to disk.
+	*
+	* A `projection` (see {@link isProjection}) only refreshes the columns it
+	* carries on rows already held, and never creates one. It is not a row:
+	* stored as one, it replaced the full row every other query reads and
+	* wrote the narrowed copy to disk, so a list lost its columns because a
+	* dropdown elsewhere asked for titles.
 	*/
-	async ingest(slug, rows) {
-		if (rows.length === 0) return;
+	async ingest(slug, rows, ticket, projection = false) {
+		if (rows.length === 0 || !this.isCurrent(ticket)) return;
 		const state = await this.ensureCollection(slug);
+		if (!this.isCurrent(ticket)) return;
 		const cachedAt = Date.now();
 		const writes = [];
 		const deletes = [];
 		for (const raw of rows) {
 			if (!raw || raw.id === void 0 || raw.id === null) continue;
 			const key = String(raw.id);
-			const merged = this.hasPending(slug, key) ? this.applyPendingToRow(slug, key, { ...raw }) : { ...raw };
+			const existing = state.rows.get(key);
+			if (projection && !existing) continue;
+			const base = projection && existing ? {
+				...existing.row,
+				...raw
+			} : { ...raw };
+			const merged = this.hasPending(slug, key) ? this.applyPendingToRow(slug, key, base) : base;
 			if (merged === void 0) {
 				state.rows.delete(key);
 				deletes.push(this.rowKey(slug, key));
 				continue;
 			}
 			this.forgetTombstone(slug, key);
-			state.freshRows.add(key);
-			const existing = state.rows.get(key);
+			if (!projection) state.freshRows.add(key);
 			if (existing && JSON.stringify(existing.row) === JSON.stringify(merged)) {
 				existing.cachedAt = cachedAt;
 				continue;
@@ -5940,7 +7304,7 @@ var OfflineManager = class {
 		}
 		return row;
 	}
-	recordSnapshot(slug, params, result) {
+	recordSnapshot(slug, params, result, ticket) {
 		const window = resolvePagination(params);
 		const meta = result.meta ?? {
 			total: result.data?.length ?? 0,
@@ -5952,13 +7316,18 @@ var OfflineManager = class {
 			total: meta.total ?? result.data?.length ?? 0,
 			limit: meta.limit ?? window.limit,
 			offset: meta.offset ?? window.offset,
-			hasMore: meta.hasMore ?? false
+			hasMore: meta.hasMore ?? false,
+			...isProjection(params) ? { rows: (result.data ?? []).map((row) => ({ ...row })) } : {}
 		};
+		if (!this.isCurrent(ticket)) return snapshot;
 		const state = this.collectionState(slug);
 		const key = buildQueryString(params);
 		state.snapshots.set(key, snapshot);
 		state.fresh.add(key);
-		this.writeCache(`${this.scope}|q|${slug}|${key}`, snapshot);
+		this.writeCache(`${this.scope}|q|${slug}|${key}`, snapshot.rows ? {
+			...snapshot,
+			rows: snapshot.rows.map((row) => dehydrateRow(row))
+		} : snapshot);
 		this.evictSnapshots(slug);
 		return snapshot;
 	}
@@ -6006,6 +7375,7 @@ var OfflineManager = class {
 		this.deleteCache(doomed.map((key) => `${this.scope}|q|${slug}|${key}`));
 	}
 	ensureQueueLoaded() {
+		if (this.scopeHold) return this.scopeKnown().then(() => this.ensureQueueLoaded());
 		if (!this.queueLoad) {
 			const scope = this.scope;
 			this.queueLoad = this.store.listQueue(`${scope}|`).then((queue) => {
@@ -6017,12 +7387,22 @@ var OfflineManager = class {
 		}
 		return this.queueLoad;
 	}
-	enqueue(mutation) {
+	enqueue(mutation, ticket) {
 		const result = this.enqueueChain.then(async () => {
 			await this.ensureQueueLoaded();
+			if (!this.isCurrent(ticket)) {
+				const orphan = {
+					...mutation,
+					mutationId: createMutationId(),
+					queuedAt: Date.now()
+				};
+				await this.store.enqueue(`${ticket.scope}|${orphan.mutationId}`, orphan);
+				return;
+			}
 			if (mutation.type === "update") {
 				const tail = this.queue[this.queue.length - 1];
-				if (tail && tail.mutationId !== this.inFlightId && tail.collection === mutation.collection && (tail.type === "create" || tail.type === "update") && tail.id === mutation.id) {
+				if (tail && tail.mutationId !== this.inFlightId && tail.sent === void 0 && tail.collection === mutation.collection && (tail.type === "create" || tail.type === "update") && tail.id === mutation.id) {
+					if (tail.type === "update") tail.parts = [...tail.parts ?? [{ ...tail.data }], { ...mutation.data }];
 					tail.data = {
 						...tail.data,
 						...mutation.data,
@@ -6033,7 +7413,7 @@ var OfflineManager = class {
 				}
 			}
 			if (mutation.type === "delete") {
-				if (this.queue.some((m) => m.collection === mutation.collection && m.type === "create" && m.id === mutation.id && m.generatedId === true && m.mutationId !== this.inFlightId)) {
+				if (this.queue.some((m) => m.collection === mutation.collection && m.type === "create" && m.id === mutation.id && m.generatedId === true && m.sent === void 0 && m.mutationId !== this.inFlightId)) {
 					const doomed = this.queue.filter((m) => m.collection === mutation.collection && m.id === mutation.id && (m.type === "create" || m.type === "update") && m.mutationId !== this.inFlightId);
 					for (const op of doomed) await this.store.dequeue(this.queueKey(op));
 					this.queue = this.queue.filter((m) => !doomed.includes(m));
@@ -6089,12 +7469,14 @@ var OfflineManager = class {
 	}
 	sync() {
 		if (this.flushPromise) return this.flushPromise;
-		this.flushPromise = this.withLock(() => this.flush()).finally(() => {
+		const run = () => this.withLock(() => this.flush());
+		this.flushPromise = (this.scopeHold ? this.scopeKnown().then(run) : run()).finally(() => {
 			this.flushPromise = void 0;
 		});
 		return this.flushPromise;
 	}
 	async flush() {
+		const ticket = this.ticket() ?? await this.nextTicket();
 		await this.ensureQueueLoaded();
 		await this.reloadQueue();
 		if (this.queue.length === 0) return {
@@ -6106,13 +7488,13 @@ var OfflineManager = class {
 		const queuedAtStart = this.queue.length;
 		let flushed = 0;
 		try {
-			while (this.queue.length > 0 && !this.disposed) {
+			while (this.queue.length > 0 && !this.disposed && this.isCurrent(ticket)) {
 				const op = this.queue[0];
 				touched.add(op.collection);
 				this.inFlightId = op.mutationId;
 				try {
 					try {
-						await this.replay(op);
+						await this.replay(op, ticket);
 					} catch (error) {
 						if (isNetworkError(error)) {
 							this.connectivity.markFailure();
@@ -6122,16 +7504,20 @@ var OfflineManager = class {
 						op.lastError = error?.message ?? String(error);
 						const limit = isIdempotencyInProgressError(error) ? Math.max(this.maxRetries, IN_PROGRESS_MIN_RETRIES) : this.maxRetries;
 						if (isRetryableError(error) && op.attempts < limit) {
-							await this.store.enqueue(this.queueKey(op), op).catch(() => void 0);
+							await this.store.enqueue(`${ticket.scope}|${op.mutationId}`, op).catch(() => void 0);
 							this.connectivity.deferRetry();
 							this.patchStatus({ lastError: op.lastError });
 							break;
 						}
-						await this.rejectMutation(op, error);
+						if (isFieldRefusal(error) && (op.parts?.length ?? 0) > 1) {
+							await this.splitCoalesced(op, ticket);
+							continue;
+						}
+						await this.rejectMutation(op, error, ticket);
 						continue;
 					}
 					this.connectivity.markSuccess();
-					await this.drop(op);
+					await this.drop(op, ticket);
 					flushed++;
 				} finally {
 					this.inFlightId = null;
@@ -6140,6 +7526,10 @@ var OfflineManager = class {
 		} finally {
 			this.patchStatus({ syncing: false });
 		}
+		if (!this.isCurrent(ticket)) return {
+			flushed,
+			remaining: this.queue.length
+		};
 		if (this.queue.length !== queuedAtStart) {
 			for (const slug of touched) {
 				this.notifyCollection(slug);
@@ -6153,42 +7543,65 @@ var OfflineManager = class {
 			remaining: this.queue.length
 		};
 	}
-	async replay(op) {
+	async replay(op, ticket) {
 		const inner = this.innerFor(op.collection);
 		if (op.type === "create") {
 			let row;
 			try {
-				row = await inner.create(op.data, void 0, { idempotencyKey: op.mutationId });
+				row = await this.sendQueuedWrite(op, (idempotencyKey) => inner.create(op.data, void 0, { idempotencyKey }), (sent) => inner.create(sent.data, sent.id, { idempotencyKey: sent.idempotencyKey }));
 			} catch (error) {
 				if (!(op.generatedId === true && isDuplicateKeyError(error))) throw error;
-				row = await inner.findById(op.id).catch(() => void 0);
-				if (!row) return;
+				row = await inner.findById(op.id);
+				if (!row) throw error;
 			}
-			await this.adoptServerRow(op, op.id, row);
+			await this.adoptServerRow(op, op.id, row, ticket);
 		} else if (op.type === "createMany") {
 			const queued = op.data ?? [];
-			const rows = await inner.createMany(queued, {
+			const asSent = (sent) => inner.createMany(sent.data, {
 				...op.upsert ? { upsert: true } : {},
-				idempotencyKey: op.mutationId
+				...sent.onConflict?.length ? { onConflict: sent.onConflict } : {},
+				idempotencyKey: sent.idempotencyKey
 			});
-			for (let i = 0; i < rows.length; i++) await this.adoptServerRow(op, queued[i]?.id, rows[i]);
+			const rows = op.sent?.onConflict?.length ? await asSent(op.sent) : await this.sendQueuedWrite(op, (idempotencyKey) => inner.createMany(queued, {
+				...op.upsert ? { upsert: true } : {},
+				idempotencyKey
+			}), asSent);
+			for (let i = 0; i < rows.length; i++) await this.adoptServerRow(op, queued[i]?.id, rows[i], ticket);
 		} else if (op.type === "updateMany") {
 			const queued = op.updates ?? [];
 			const rows = await inner.updateMany(queued.map((u) => ({
 				id: u.id,
 				data: u.data
 			})), { idempotencyKey: op.mutationId });
-			for (let i = 0; i < rows.length; i++) await this.ingestReplaced(op, queued[i].id, rows[i]);
+			for (let i = 0; i < rows.length; i++) await this.ingestReplaced(op, queued[i].id, rows[i], ticket);
 		} else if (op.type === "update") {
-			const row = await inner.update(op.id, op.data);
-			await this.ingestReplaced(op, op.id, row);
+			const row = await inner.update(op.id, op.data, op.sent ? { idempotencyKey: op.sent.idempotencyKey } : void 0);
+			await this.ingestReplaced(op, op.id, row, ticket);
 		} else if (op.type === "deleteMany") {
 			const ids = op.ids ?? [];
 			await inner.deleteMany(ids, { idempotencyKey: op.mutationId });
-			for (const id of ids) this.removeLocalRow(op.collection, id, true);
+			for (const id of ids) this.removeLocalRow(op.collection, id, ticket, true);
 		} else if (op.type === "delete") {
-			await inner.delete(op.id);
-			this.removeLocalRow(op.collection, op.id, true);
+			await inner.delete(op.id, { idempotencyKey: op.sent?.idempotencyKey ?? op.mutationId });
+			this.removeLocalRow(op.collection, op.id, ticket, true);
+		}
+	}
+	/**
+	* Send a queued write under its key.
+	*
+	* A write the queue sent once already, before it was queued, carries that
+	* attempt's key and is sent under it again, as queued. If the server holds
+	* the key for a different request, the difference is the ids minted here
+	* — so the first attempt committed and only its answer was lost, and
+	* sending that request again returns the stored answer instead of a
+	* second copy of the rows.
+	*/
+	async sendQueuedWrite(op, asQueued, asSent) {
+		try {
+			return await asQueued(op.sent?.idempotencyKey ?? op.mutationId);
+		} catch (error) {
+			if (!op.sent || !isIdempotencyKeyReusedError(error)) throw error;
+			return asSent(op.sent);
 		}
 	}
 	/**
@@ -6199,14 +7612,15 @@ var OfflineManager = class {
 	* has to move with it, including queued writes that were made against it
 	* before it was ever sent.
 	*/
-	async adoptServerRow(op, localId, row) {
+	async adoptServerRow(op, localId, row, ticket) {
 		if (!row) return;
 		const slug = op.collection;
 		const serverId = row.id;
 		if (localId !== void 0 && serverId !== void 0 && String(serverId) !== String(localId)) {
 			const oldKey = String(localId);
-			this.removeLocalRow(slug, localId);
-			for (const queued of this.queue) {
+			this.removeLocalRow(slug, localId, ticket);
+			const queue = this.isCurrent(ticket) ? this.queue : await this.store.listQueue(`${ticket.scope}|`).catch(() => []);
+			for (const queued of queue) {
 				if (queued.collection !== slug) continue;
 				let dirty = false;
 				if (queued.id !== void 0 && String(queued.id) === oldKey) {
@@ -6220,10 +7634,10 @@ var OfflineManager = class {
 					delete rollbackRows[oldKey];
 					dirty = true;
 				}
-				if (dirty) await this.store.enqueue(this.queueKey(queued), queued).catch(() => void 0);
+				if (dirty) await this.store.enqueue(`${ticket.scope}|${queued.mutationId}`, queued).catch(() => void 0);
 			}
 		}
-		await this.ingestReplaced(op, serverId ?? localId, row);
+		await this.ingestReplaced(op, serverId ?? localId, row, ticket);
 	}
 	/**
 	* Write a server row over the local one, ignoring the mutation that just
@@ -6233,13 +7647,15 @@ var OfflineManager = class {
 	* back to the server's version in front of the user, only to change again
 	* when they replay a moment later.
 	*/
-	async ingestReplaced(op, id, row) {
+	async ingestReplaced(op, id, row, ticket) {
+		if (!this.isCurrent(ticket)) return;
 		const slug = op.collection;
 		const state = await this.ensureCollection(slug);
+		if (!this.isCurrent(ticket)) return;
 		const key = String(id);
 		const merged = this.applyPendingToRow(slug, key, { ...row }, op.mutationId);
 		if (merged === void 0) {
-			this.removeLocalRow(slug, key);
+			this.removeLocalRow(slug, key, ticket);
 			return;
 		}
 		const cachedAt = Date.now();
@@ -6263,7 +7679,8 @@ var OfflineManager = class {
 	* of it, so both stand on their own and are kept — dropping them would
 	* silently lose writes the server would have accepted.
 	*/
-	async rejectMutation(op, error) {
+	async rejectMutation(op, error, ticket) {
+		if (!this.isCurrent(ticket)) return;
 		const ids = new Set(Object.keys(op.rollback?.rows ?? {}));
 		if (op.id !== void 0) ids.add(String(op.id));
 		const doomed = [op];
@@ -6276,24 +7693,61 @@ var OfflineManager = class {
 			if (later.type === "update") doomed.push(later);
 			else for (const id of hit) orphaned.delete(id);
 		}
-		for (const dropped of doomed) await this.drop(dropped);
+		for (const dropped of doomed) await this.drop(dropped, ticket);
+		if (!this.isCurrent(ticket)) return;
 		for (const [idKey, previous] of Object.entries(op.rollback?.rows ?? {})) {
 			const restored = this.applyPendingToRow(op.collection, idKey, previous ?? void 0);
-			if (restored === void 0) this.removeLocalRow(op.collection, idKey);
-			else this.setLocalRow(op.collection, idKey, restored);
+			if (restored === void 0) this.removeLocalRow(op.collection, idKey, ticket);
+			else this.setLocalRow(op.collection, idKey, restored, ticket);
 		}
 		this.patchStatus({ lastError: error.message });
 		this.notifyCollection(op.collection);
 		this.scheduleRefresh(op.collection);
-		for (const dropped of doomed) this.onSyncError?.(error, dropped);
+		for (const dropped of doomed) this.onSyncError?.(dropped === op ? error : dependencyRejected(op, error), dropped);
+	}
+	/**
+	* Put the separate edits a coalesced `update` was made of back in the
+	* queue, in its place and in their order, each with the row as it stood
+	* before it as its rollback — so a refusal undoes that edit alone.
+	*
+	* Their ids extend the merged op's, which sorts them after it and before
+	* whatever was queued next, so the queue's order survives a reload.
+	*/
+	async splitCoalesced(op, ticket) {
+		const parts = op.parts ?? [];
+		const idKey = String(op.id);
+		let before = op.rollback?.rows?.[idKey] ?? null;
+		const pieces = parts.map((part, index) => {
+			const piece = {
+				mutationId: `${op.mutationId}:${index}`,
+				collection: op.collection,
+				type: "update",
+				id: op.id,
+				data: { ...part },
+				queuedAt: op.queuedAt,
+				rollback: { rows: { [idKey]: before === null ? null : { ...before } } }
+			};
+			if (before !== null) before = {
+				...before,
+				...part
+			};
+			return piece;
+		});
+		for (const piece of pieces) await this.store.enqueue(`${ticket.scope}|${piece.mutationId}`, piece).catch(() => void 0);
+		await this.store.dequeue(`${ticket.scope}|${op.mutationId}`).catch(() => void 0);
+		if (!this.isCurrent(ticket)) return;
+		const position = this.queue.indexOf(op);
+		this.queue.splice(position < 0 ? 0 : position, position < 0 ? 0 : 1, ...pieces);
+		this.afterQueueChange(false);
 	}
 	/** Every row id a mutation writes to. */
 	idsOf(op) {
 		if (op.type === "createMany") return (op.data ?? []).map((r) => String(r.id));
 		return op.id === void 0 ? [] : [String(op.id)];
 	}
-	async drop(op) {
-		await this.store.dequeue(this.queueKey(op)).catch(() => void 0);
+	async drop(op, ticket) {
+		await this.store.dequeue(`${ticket.scope}|${op.mutationId}`).catch(() => void 0);
+		if (!this.isCurrent(ticket)) return;
 		this.queue = this.queue.filter((m) => m.mutationId !== op.mutationId);
 		this.afterQueueChange(false);
 	}
@@ -6315,12 +7769,12 @@ var OfflineManager = class {
 			return fn();
 		}
 	}
-	broadcast(message) {
+	broadcast(message, scope = this.scope) {
 		if (!this.channel) return;
 		try {
 			this.channel.postMessage({
 				...message,
-				scope: this.scope,
+				scope,
 				sender: this.tabId
 			});
 		} catch {}
@@ -6328,14 +7782,14 @@ var OfflineManager = class {
 	onBroadcast(message) {
 		if (this.disposed || !message || typeof message !== "object") return;
 		const msg = message;
-		if (msg.sender === this.tabId || msg.scope !== this.scope) return;
+		if (this.scopeHold || msg.sender === this.tabId || msg.scope !== this.scope) return;
 		if (msg.type === "rows") for (const slug of msg.slugs ?? []) this.reloadCollection(slug);
 		else if (msg.type === "queue") this.reloadQueue();
 	}
 	/** Re-read one collection from the store, replacing what is in memory. */
 	async reloadCollection(slug) {
 		const state = this.collections.get(slug);
-		if (!state?.loaded) return;
+		if (!state?.loaded || this.scopeHold) return;
 		await this.reloadQueue();
 		const scope = this.scope;
 		const [rows, snapshots, absent] = await Promise.all([
@@ -6362,12 +7816,13 @@ var OfflineManager = class {
 		state.snapshots = /* @__PURE__ */ new Map();
 		for (const entry of snapshots) {
 			const key = entry.key.slice(`${scope}|q|${slug}|`.length);
-			if (entry.value) state.snapshots.set(key, entry.value);
+			if (entry.value) state.snapshots.set(key, readSnapshot(entry.value));
 		}
 		state.absent = new Set(absent.map((entry) => entry.key.slice(`${scope}|abs|${slug}|`.length)));
 		this.notifyCollection(slug, false);
 	}
 	async reloadQueue() {
+		if (this.scopeHold) return;
 		const scope = this.scope;
 		const queue = await this.store.listQueue(`${scope}|`).catch(() => void 0);
 		if (!queue || this.scope !== scope) return;
@@ -6469,6 +7924,7 @@ function createRebaseClient(options) {
 	const cron = createCron(transport, options.cron);
 	const backups = createBackups(transport);
 	const apiKeys = createApiKeys(transport, options.apiKeys);
+	const personalKeys = createPersonalKeys(transport, options.personalKeys);
 	const storage = createStorage(transport);
 	const functions = createFunctionsClient(transport);
 	const createStorageSource = (storageId) => storageId === DEFAULT_STORAGE_SOURCE_KEY ? storage : createStorage(transport, storageId);
@@ -6503,15 +7959,29 @@ function createRebaseClient(options) {
 				let session = auth.getSession();
 				if (session && session.expiresAt <= Date.now() + 1e4) try {
 					session = await auth.refreshSession();
-				} catch (e) {}
+				} catch (e) {
+					session = auth.getSession();
+				}
 				return session?.accessToken || options.token || "";
 			},
-			onUnauthorized: options.onUnauthorized || (() => auth.handleUnauthorized())
+			onUnauthorized: options.onUnauthorized || (() => auth.handleUnauthorized()),
+			impersonate: options.impersonate
 		});
+		let realtimeUid = auth.getSession()?.user?.uid ?? null;
 		auth.onAuthStateChange((event, session) => {
 			if (!ws) return;
-			if (event === "SIGNED_OUT") ws.disconnect();
-			else if (event === "SIGNED_IN" || event === "TOKEN_REFRESHED") {
+			if (event === "SIGNED_OUT") {
+				realtimeUid = null;
+				ws.disconnect();
+			} else if (event === "SIGNED_IN" || event === "TOKEN_REFRESHED") {
+				const uid = session?.user?.uid ?? null;
+				if (uid !== realtimeUid) {
+					realtimeUid = uid;
+					const hadSocket = ws.hasSocket;
+					ws.disconnect();
+					if (hadSocket) ws.ensureConnected();
+					return;
+				}
 				if (session?.accessToken && ws.hasSocket) ws.authenticate(session.accessToken).catch(console.warn);
 			}
 		});
@@ -6556,10 +8026,11 @@ function createRebaseClient(options) {
 	}
 	const offlineManager = options.offline ? new OfflineManager(typeof options.offline === "object" ? options.offline : {}, (slug) => createCollectionClient(transport, slug)) : void 0;
 	if (offlineManager) {
-		offlineManager.setScope(auth.getSession()?.user?.uid);
+		offlineManager.holdScope();
 		auth.onAuthStateChange((event, session) => {
 			offlineManager.setScope(event === "SIGNED_OUT" ? void 0 : session?.user?.uid);
 		});
+		auth.isInitialized().then(() => offlineManager.setScope(auth.getSession()?.user?.uid));
 	}
 	const collectionClients = /* @__PURE__ */ new Map();
 	let untypedWarned = false;
@@ -6602,6 +8073,7 @@ function createRebaseClient(options) {
 		cron,
 		backups,
 		apiKeys,
+		personalKeys,
 		functions,
 		storage,
 		storageRegistry,
@@ -6651,21 +8123,30 @@ channel: (name, options) => {
 			const prefix = endpoint.startsWith("/") ? "" : "/";
 			return transport.request(`${prefix}${endpoint}`, {
 				method: "POST",
-				body: payload ? JSON.stringify(payload) : void 0
+				body: payload !== void 0 ? JSON.stringify(payload) : void 0
 			});
 		},
-		batch: async (operations, options) => {
+		batch: async (operations, batchOptions) => {
 			if (!Array.isArray(operations)) throw new TypeError("batch expects an array of operations.");
 			if (operations.length === 0) return {
 				data: [],
 				meta: { operations: 0 }
 			};
 			const headers = {};
-			if (options?.idempotencyKey) headers["Idempotency-Key"] = options.idempotencyKey;
-			if (options?.returning === false) headers.Prefer = "return=minimal";
+			if (batchOptions?.idempotencyKey) headers["Idempotency-Key"] = batchOptions.idempotencyKey;
+			if (batchOptions?.returning === false) headers.Prefer = "return=minimal";
+			const dictionary = options.collections;
+			const wire = dictionary ? operations.map((operation) => {
+				if (!operation || typeof operation !== "object") return operation;
+				const name = operation.collection;
+				return typeof name === "string" && Object.hasOwn(dictionary, name) ? {
+					...operation,
+					collection: dictionary[name]
+				} : operation;
+			}) : operations;
 			return transport.request("/data/_batch", {
 				method: "POST",
-				body: JSON.stringify({ operations }),
+				body: JSON.stringify({ operations: wire }),
 				...Object.keys(headers).length > 0 ? { headers } : {}
 			});
 		},
@@ -6674,6 +8155,6 @@ channel: (name, options) => {
 	};
 }
 //#endregion
-export { MemoryOfflineStore, QueryBuilder, RebaseApiError, RebaseClientError, RebasePaginationError, RebaseRealtimeChannel, RebaseWebSocketClient, and, cond, createBackups, createCookieStorage, createMemoryStorage, createRebaseClient, etagOf, isOfflineError, not, or };
+export { MemoryOfflineStore, QueryBuilder, RebaseApiError, RebaseClientError, RebasePaginationError, RebaseRealtimeChannel, RebaseWebSocketClient, STORAGE_REFERENCE_SCHEME, and, cond, createBackups, createCookieStorage, createMemoryStorage, createRebaseClient, etagOf, isOfflineError, isStorageReference, not, or, parseStorageReference, resolveStorageReferences, storageReference };
 
 //# sourceMappingURL=index.es.js.map