@rebasepro/client 0.25.0 → 0.26.0

package/README.md

@@ -34,7 +34,7 @@ of it resolves too: Node has supported `require(esm)` since 22.12.
 |---|---|
 | `createRebaseClient<DB>(options)` | Create a client instance. Generic `DB` parameter enables type-safe `client.data.*` access. |
 | `CreateRebaseClientResult<DB>` | The client type it returns (`RebaseClient<DB>` from `@rebasepro/types`, narrowed) — includes `auth`, `admin`, `cron`, `functions`, `storage`, `ws`, `data`, `call`, and token management methods. |
-| `CreateRebaseClientOptions` | Extends `RebaseClientConfig` with the `auth`, `admin`, `cron`, `apiKeys` and `personalKeys` sub-configs, plus `storageSources`, `collections` and `offline`. |
+| `CreateRebaseClientOptions` | Extends `RebaseClientConfig` with the `auth`, `admin`, `cron`, `apiKeys` and `personalKeys` sub-configs, plus `storageSources`, `collections`, `offline` and `debug`. |
 
 ### Config
 
@@ -49,6 +49,7 @@ of it resolves too: Node has supported `require(esm)` since 22.12.
 | `realtime` | `boolean` | `true` | Open the WebSocket — `false` lets a one-shot script exit |
 | `collections` | `Record<string, string>` | — | Maps accessor names to collection slugs |
 | `offline` | `boolean \| OfflineConfig` | `false` | Local-first sync — see [the docs](https://rebase.pro/docs/sdk/offline) |
+| `debug` | `boolean` | `false` | Log the realtime connection's progress with `console.debug`. One browser can turn it on with `localStorage.setItem("rebase_debug", "1")` — see [Connection logging](https://rebase.pro/docs/sdk#connection-logging) |
 
 ### Tokens
 

package/dist/admin.d.ts

@@ -11,6 +11,14 @@ export interface ListUsersOptions {
     offset?: number;
     orderBy?: string;
     orderDir?: "asc" | "desc";
+    /** Only the users holding this role id (`?role=`). */
+    role?: string;
+    /**
+     * Resolve exactly these users in one round trip (`?ids=`), for turning
+     * stored ids into names. The window, search and role are ignored when it
+     * is given, and ids that name no user are left out of the answer.
+     */
+    ids?: readonly string[];
 }
 export declare function createAdmin(transport: Transport, options?: CreateAdminOptions): {
     listUsers: (options?: ListUsersOptions) => Promise<{

package/dist/index.d.ts

@@ -9,7 +9,7 @@ import { createFunctionsClient } from "./functions.js";
 import { RebaseWebSocketClient } from "./websocket.js";
 import { RebaseRealtimeChannel, type ChannelOptions } from "./realtime-channel.js";
 import type { OfflineApi, OfflineConfig } from "./offline.js";
-import { type BatchOperation, type BatchResult, type IncludeOf, InsertOf, RebaseClient, RebaseSdkData, RowOf, StorageSource, StorageSourceDefinition, StorageSourceRegistry, UpdateOf, type WriteOptions } from "@rebasepro/types";
+import { type AccessSimulation, type BatchOperation, type BatchResult, type IncludeOf, InsertOf, RebaseClient, RebaseSdkData, RowOf, StorageSource, StorageSourceDefinition, StorageSourceRegistry, UpdateOf, type WriteOptions } from "@rebasepro/types";
 export { RebaseApiError } from "./transport.js";
 export { RebaseClientError } from "./errors.js";
 export type { RebaseErrorCode } from "@rebasepro/types";
@@ -57,10 +57,17 @@ export interface CreateRebaseClientOptions extends RebaseClientConfig {
      */
     storageSources?: StorageSourceDefinition[];
     /**
-     * Maps camelCase property names / safe identifiers to the actual
-     * collection slugs on the server (e.g. `{ companyMembers: "company-members" }`).
-     * If provided, the data layer proxy will resolve property accessors to their
-     * correct slugs via this map before falling back to automatic snake_casing.
+     * Maps each `client.data` accessor to the collection slug the server
+     * serves (e.g. `{ companyMembers: "company-members" }`): the generated
+     * `collectionsDictionary`.
+     *
+     * **Required for a typed client** (`createRebaseClient<Database>`). The
+     * types offer every accessor, but without the map the proxy sends
+     * `client.data.companyMembers` to `/data/company_members`, so a kebab-case
+     * slug or a renamed accessor (`collectionCollection`) answers 404; a
+     * one-time warning names the accessor. With the map, an unknown accessor
+     * throws `UNKNOWN_COLLECTION` with a suggestion. A later version will make
+     * it required in the types when `Database` is supplied.
      */
     collections?: Record<string, string>;
     /**
@@ -78,6 +85,17 @@ export interface CreateRebaseClientOptions extends RebaseClientConfig {
      * shared across tabs. Off by default.
      */
     offline?: boolean | OfflineConfig;
+    /**
+     * Log the realtime connection's progress — opened, signed in, closed,
+     * redialling — with `console.debug`. Off by default, so a public page says
+     * nothing about its backend in a visitor's console; warnings and errors
+     * are written either way.
+     *
+     * Without a code change, one browser can turn it on from its console with
+     * `localStorage.setItem("rebase_debug", "1")` (remove the key to stop), and
+     * any runtime with `globalThis.__REBASE_DEBUG__ = true`.
+     */
+    debug?: boolean;
 }
 type KebabToCamelCase<S extends string> = S extends `${infer T}-${infer U}` ? `${T}${Capitalize<KebabToCamelCase<U>>}` : S;
 /** The accessor whose generated entry declares `Slug: S`, or `never`. */
@@ -101,7 +119,19 @@ type TypedDataLayer<DB> = {
  * capabilities populated and the `data` layer narrowed to provide
  * typed collection accessors when a `DB` schema generic is supplied.
  */
-export type CreateRebaseClientResult<DB = Record<string, unknown>> = Omit<RebaseClient<DB>, "data" | "email"> & {
+export type CreateRebaseClientResult<DB = Record<string, unknown>> = Omit<RebaseClient<DB>, "data" | "email" | "simulate"> & {
+    /**
+     * A client whose data requests run with simulated access — as a role, a
+     * uid holding a role, or a service key — for an administrator checking
+     * what row-level security lets that identity read. See
+     * {@link RebaseClient.simulate} for what the server honours and refuses.
+     *
+     * Always present here, typed by the same `Database` (it is built with the
+     * same `collections` dictionary), and closable: it is a client of its own,
+     * so release it with `close()` when done. On `RebaseClient` it is optional
+     * and untyped, because a server-side client has none.
+     */
+    simulate: (simulation: AccessSimulation) => CreateRebaseClientResult<DB>;
     /**
      * Send this token from now on, over HTTP and on the realtime socket. An
      * open socket is rebuilt to authenticate with it. A token getter, when one

package/dist/index.es.js

@@ -1,5 +1,5 @@
 import { c as invalidBulkBody, d as RebaseApiError, h as parseRebaseJson, i as isOfflineError, l as SDKQueryBuilder, m as defaultCodeForStatus, n as MemoryOfflineStore, o as createCollectionClient, p as createTransport, s as etagOf, u as RebaseClientError } from "./offline-store-BhYXViha.js";
-import { DEFAULT_STORAGE_SOURCE_KEY, PUBLIC_STORAGE_PREFIX, RebaseApiError as RebaseApiError$1, RebaseClientError as RebaseClientError$1, STORAGE_REFERENCE_SCHEME, isPublicStoragePath, isStorageReference, isUnsupported, parseStorageReference, resolveStorageReferences, storageObjectPath, storageReference, storageReferencesForDownloadUrls, storageTargetOfDownloadUrl, storageTargetsInText } from "@rebasepro/types";
+import { DEFAULT_STORAGE_SOURCE_KEY, PUBLIC_STORAGE_PREFIX, RebaseApiError as RebaseApiError$1, RebaseClientError as RebaseClientError$1, STORAGE_REFERENCE_SCHEME, isPublicStoragePath, isStorageReference, isUnsupported, parseStorageReference, resolveStorageReferences, simulationHeaders, storageObjectPath, storageReference, storageReferencesForDownloadUrls, storageTargetOfDownloadUrl, storageTargetsInText } from "@rebasepro/types";
 import { COMPOSITE_ID_SEPARATOR, DOWNLOAD_URL_CONCURRENCY, RESUMABLE_UPLOAD_THRESHOLD, RebasePaginationError, and, buildCompositeId, cond, createBatchLoader, createConcurrencyLimit, createDownloadUrlCache, not, or, warnDeprecated, withETag } from "@rebasepro/common";
 import { toSnakeCase, unref } from "@rebasepro/utils";
 //#region src/auth.ts
@@ -1364,6 +1364,8 @@ function createAdmin(transport, options) {
 		if (options?.search) params.set("search", options.search);
 		if (options?.orderBy) params.set("orderBy", options.orderBy);
 		if (options?.orderDir) params.set("orderDir", options.orderDir);
+		if (options?.role) params.set("role", options.role);
+		if (options?.ids) params.set("ids", options.ids.join(","));
 		const qs = params.toString();
 		return transport.request(adminPath + "/users" + (qs ? "?" + qs : ""), { method: "GET" });
 	}
@@ -2139,10 +2141,23 @@ function requestTimeoutError(written) {
 * connection has been down for longer than a blip. The registration is kept and
 * resumes when the socket is back.
 */
-function realtimeLostError() {
+function realtimeLostError(refusal) {
+	if (refusal) return new RebaseApiError$1(`The server refused this realtime connection (${refusal.code}: ${refusal.message}), so live data is not updating. The client keeps retrying, more slowly each time, and refreshes this subscription once it is let in.`, {
+		code: "CONNECTION_LOST",
+		details: { reason: refusal.code },
+		cause: refusal
+	});
 	return new RebaseApiError$1("The realtime connection is down, so live data is not updating. The client keeps reconnecting and refreshes this subscription when the connection is back.", { code: "CONNECTION_LOST" });
 }
 /**
+* Whether `error` is the server refusing this socket for its per-user ceiling
+* (`REALTIME_MAX_SOCKETS_PER_USER`): it answers AUTHENTICATE with
+* `TOO_MANY_SOCKETS` and closes the socket.
+*/
+function isSocketCeilingRefusal(error) {
+	return error instanceof RebaseApiError$1 && error.code === "TOO_MANY_SOCKETS";
+}
+/**
 * Whether realtime debugging is on: `globalThis.__REBASE_DEBUG_REALTIME__ = true`,
 * set from a console or a test. While it is, each refetched row that differs
 * from the one held is explained key by key with `console.debug`.
@@ -2150,6 +2165,48 @@ function realtimeLostError() {
 function realtimeDebugOn() {
 	return Reflect.get(globalThis, "__REBASE_DEBUG_REALTIME__") === true;
 }
+/**
+* The `localStorage` key that turns connection logging on for one browser,
+* without a code change or a rebuild: `localStorage.setItem("rebase_debug", "1")`
+* in its console. For a page that loads the client as a plain script, where
+* `createRebaseClient({ debug: true })` means editing and redeploying the site.
+*/
+var DEBUG_STORAGE_KEY = "rebase_debug";
+/**
+* Whether connection logging was switched on from outside the code:
+* `globalThis.__REBASE_DEBUG__`, `globalThis.__REBASE_DEBUG_REALTIME__` (which
+* also explains refetched rows), or {@link DEBUG_STORAGE_KEY} in this
+* browser's `localStorage`. Read at each line, so it can be switched on in a
+* console without reloading a page whose socket is already open.
+*/
+function debugSwitchedOn() {
+	if (Reflect.get(globalThis, "__REBASE_DEBUG__") === true || realtimeDebugOn()) return true;
+	if (typeof window === "undefined" || typeof localStorage === "undefined") return false;
+	try {
+		const value = localStorage.getItem(DEBUG_STORAGE_KEY);
+		return value === "1" || value === "true";
+	} catch {
+		return false;
+	}
+}
+/**
+* The codes an `AUTHENTICATE` is refused with when the server will not honour
+* the session: the token does not verify or has expired, the session was
+* revoked or its account is gone (`SESSION_REVOKED`), the account is disabled
+* (`ACCOUNT_DISABLED`) — the codes the HTTP routes answer the same token with.
+* An answer, not a failure: asking again with the same token gets the same one.
+*/
+var SESSION_REFUSAL_CODES = /* @__PURE__ */ new Set([
+	"INVALID_TOKEN",
+	"TOKEN_EXPIRED",
+	"JWT_EXPIRED",
+	"SESSION_REVOKED",
+	"ACCOUNT_DISABLED",
+	"SESSION_ENDED"
+]);
+function isSessionRefusal(error) {
+	return error instanceof RebaseApiError$1 && typeof error.code === "string" && SESSION_REFUSAL_CODES.has(error.code);
+}
 /** The ceiling of the reconnect backoff. */
 var MAX_RECONNECT_DELAY_MS = 3e4;
 /**
@@ -2452,11 +2509,28 @@ var RebaseWebSocketClient = class {
 	onUnauthorized;
 	refreshInProgress = null;
 	impersonate;
+	debug;
+	/**
+	* Connection chatter: the socket opened, signed in, closed, is redialling.
+	*
+	* Silent unless asked for, with the `debug` option or
+	* {@link debugSwitchedOn}. It used to go to `console.debug` in every
+	* browser: a public page printed "Connected to PostgreSQL backend" and
+	* "WebSocket auto-authenticated" to each visitor's console, naming the
+	* backend on every load. In Node, where `console.debug` is `console.log`,
+	* it opened a script's stdout ahead of what the script prints. Warnings and
+	* errors are not chatter and are always written.
+	*/
+	connectionDebug(...args) {
+		if (!this.debug && !debugSwitchedOn()) return;
+		console.debug(...args);
+	}
 	constructor(config) {
 		this.websocketUrl = config.websocketUrl;
 		this.getAuthToken = config.getAuthToken;
 		this.onUnauthorized = config.onUnauthorized;
 		this.impersonate = config.impersonate;
+		this.debug = config.debug === true;
 		this.WebSocketConstructor = config.WebSocket || (typeof WebSocket !== "undefined" ? WebSocket : void 0);
 	}
 	/**
@@ -2495,7 +2569,7 @@ var RebaseWebSocketClient = class {
 		if (this.closedByCaller) return;
 		if (this.connectionState !== "reconnecting" && this.connectionState !== "disconnected") return;
 		if (this.ws) return;
-		console.debug(`${reason} — retrying the realtime connection`);
+		this.connectionDebug(`${reason} — retrying the realtime connection`);
 		if (this.reconnectTimeout) {
 			clearTimeout(this.reconnectTimeout);
 			this.reconnectTimeout = null;
@@ -2527,6 +2601,39 @@ var RebaseWebSocketClient = class {
 	}
 	onlineListener = null;
 	visibilityListener = null;
+	/** The session this socket's server refused, and why. Cleared when a socket opens. */
+	refusedSession = null;
+	/**
+	* Whether `error` is the server refusing the session `token` signs in as —
+	* revoked, its account gone or disabled, a token that does not verify. Said
+	* once per socket and token, as a warning that names the code.
+	*/
+	noteSessionRefused(token, error) {
+		if (!isSessionRefusal(error)) return false;
+		if (this.refusedSession?.token !== token) {
+			this.refusedSession = {
+				token,
+				error
+			};
+			console.warn(`[Rebase] Realtime: the server refused this session (${error.code}: ${error.message}). The socket is connected but not signed in, and what needs an account is refused with that code.`);
+		}
+		return true;
+	}
+	/** Whether the current run of ceiling refusals has been said in the console. */
+	socketCeilingWarned = false;
+	/**
+	* The server refused this socket for its per-user ceiling. Said once per
+	* run of refusals, as a warning, and reported to every registration at
+	* once as an outage — a refusal is not a blip that the next dial fixes.
+	*/
+	noteSocketCeiling(error) {
+		if (!this.socketCeilingWarned) {
+			this.socketCeilingWarned = true;
+			console.warn(`[Rebase] Realtime: the server refused this connection (${error.code}: ${error.message}). Live data is not updating; the client retries, more slowly each time, until another connection closes.`);
+		}
+		this.clearOutageTimer();
+		this.reportConnectionLost(error);
+	}
 	/**
 	* Authenticate the WebSocket connection
 	*/
@@ -2575,10 +2682,10 @@ var RebaseWebSocketClient = class {
 		if (this.isConnected && !this.isAuthenticated && !this.authPromise) this.getAuthToken().then((token) => {
 			if (!this.ws) return;
 			if (token) this.authenticate(token).catch((e) => {
-				if (this.ws) console.debug("WebSocket auto-auth skipped:", e?.message || e);
+				if (this.ws) this.connectionDebug("WebSocket auto-auth skipped:", e?.message || e);
 			});
 		}).catch((e) => {
-			if (this.ws) console.debug("WebSocket auto-auth skipped:", e?.message || e);
+			if (this.ws) this.connectionDebug("WebSocket auto-auth skipped:", e?.message || e);
 		});
 	}
 	/**
@@ -2594,6 +2701,7 @@ var RebaseWebSocketClient = class {
 		if (permanent) this.removeNetworkListeners();
 		this.isAuthenticated = false;
 		this.authPromise = null;
+		this.refusedSession = null;
 		if (this.reconnectTimeout) {
 			clearTimeout(this.reconnectTimeout);
 			this.reconnectTimeout = null;
@@ -2628,24 +2736,35 @@ var RebaseWebSocketClient = class {
 			const socket = new this.WebSocketConstructor(withOptIns(this.websocketUrl));
 			this.ws = socket;
 			this.ws.onopen = async () => {
-				console.debug("Connected to PostgreSQL backend");
+				this.connectionDebug("Connected to PostgreSQL backend");
 				const wasReconnect = this.hadConnection;
 				this.hadConnection = true;
 				this.isConnected = true;
+				this.gaveUp = false;
+				if (!this.outageReported) this.setState("connected");
+				this.refusedSession = null;
+				if (this.getAuthToken && !this.isAuthenticated) {
+					let token = null;
+					try {
+						token = await this.getAuthToken();
+						if (token) {
+							await this.authenticate(token);
+							this.connectionDebug("WebSocket auto-authenticated");
+						}
+					} catch (error) {
+						if (isSocketCeilingRefusal(error)) {
+							this.noteSocketCeiling(error);
+							return;
+						}
+						if (!(token && this.noteSessionRefused(token, error))) this.connectionDebug("WebSocket connected, not signed in yet:", error?.message || error);
+					}
+				}
+				if (this.ws !== socket) return;
 				this.reconnectAttempts = 0;
 				this.clearOutageTimer();
 				this.outageReported = false;
-				this.gaveUp = false;
+				this.socketCeilingWarned = false;
 				this.setState("connected");
-				if (this.getAuthToken && !this.isAuthenticated) try {
-					const token = await this.getAuthToken();
-					if (token) {
-						await this.authenticate(token);
-						console.debug("WebSocket auto-authenticated");
-					}
-				} catch (error) {
-					console.debug("WebSocket connected without auth:", error?.message || error);
-				}
 				this.emit(wasReconnect ? "reconnect" : "connect");
 				this.processMessageQueue(wasReconnect);
 				if (wasReconnect) this.resubscribeAll();
@@ -2661,7 +2780,7 @@ var RebaseWebSocketClient = class {
 				}
 			};
 			const onClosed = () => {
-				console.debug("Disconnected from PostgreSQL backend");
+				this.connectionDebug("Disconnected from PostgreSQL backend");
 				this.stopLivenessWatch();
 				this.forgetServerOptIns();
 				if (this.ws === socket) this.ws = null;
@@ -2791,7 +2910,7 @@ var RebaseWebSocketClient = class {
 		this.reconnectAttempts = Math.min(this.reconnectAttempts + 1, 30);
 		const ceiling = Math.min(1e3 * Math.pow(2, this.reconnectAttempts), MAX_RECONNECT_DELAY_MS);
 		const delay = MIN_RECONNECT_DELAY_MS + Math.floor(Math.random() * (ceiling - MIN_RECONNECT_DELAY_MS));
-		console.debug(`Attempting to reconnect in ${delay}ms (attempt ${this.reconnectAttempts})`);
+		this.connectionDebug(`Attempting to reconnect in ${delay}ms (attempt ${this.reconnectAttempts})`);
 		if (this.reconnectTimeout) clearTimeout(this.reconnectTimeout);
 		this.reconnectTimeout = setTimeout(() => {
 			this.reconnectTimeout = null;
@@ -2817,11 +2936,11 @@ var RebaseWebSocketClient = class {
 		if (this.outageTimer) clearTimeout(this.outageTimer);
 		this.outageTimer = null;
 	}
-	reportConnectionLost() {
+	reportConnectionLost(refusal) {
 		if (this.outageReported) return;
 		this.outageReported = true;
 		this.setState("disconnected");
-		const error = realtimeLostError();
+		const error = realtimeLostError(refusal);
 		for (const subscription of this.collectionSubscriptions.values()) this.notifyError(subscription.callbacks, error);
 		for (const subscription of this.singleSubscriptions.values()) this.notifyError(subscription.callbacks, error);
 		for (const handler of [...this.connectionLostHandlers]) try {
@@ -3060,31 +3179,36 @@ var RebaseWebSocketClient = class {
 	}
 	async runAuthentication(retryCount) {
 		let lastError = null;
-		for (let attempt = 0; attempt < retryCount; attempt++) try {
-			const token = await this.getAuthToken();
-			if (!token) throw new Error("user not logged in");
-			await this.authenticate(token);
-			console.debug("WebSocket authenticated on demand");
-			return;
-		} catch (error) {
-			lastError = error;
-			const errMsg = error instanceof Error ? error.message : String(error);
-			if (errMsg.includes("not logged in") || errMsg.includes("Session expired")) {
-				console.warn("WebSocket auth failed: user not logged in");
-				throw error;
-			}
-			if (errMsg.includes("still loading")) {
+		for (let attempt = 0; attempt < retryCount; attempt++) {
+			let token = null;
+			try {
+				token = await this.getAuthToken();
+				if (!token) throw new Error("user not logged in");
+				if (this.refusedSession?.token === token) throw this.refusedSession.error;
+				await this.authenticate(token);
+				this.connectionDebug("WebSocket authenticated on demand");
+				return;
+			} catch (error) {
+				lastError = error;
+				if (token && this.noteSessionRefused(token, error)) throw error;
+				const errMsg = error instanceof Error ? error.message : String(error);
+				if (errMsg.includes("not logged in") || errMsg.includes("Session expired")) {
+					console.warn("WebSocket auth failed: user not logged in");
+					throw error;
+				}
+				if (errMsg.includes("still loading")) {
+					if (attempt < retryCount - 1) {
+						const delay = Math.min(500 * (attempt + 1), 2e3);
+						await new Promise((resolve) => setTimeout(resolve, delay));
+						continue;
+					}
+				}
 				if (attempt < retryCount - 1) {
-					const delay = Math.min(500 * (attempt + 1), 2e3);
+					const delay = Math.min(1e3 * (attempt + 1), 3e3);
+					this.connectionDebug(`WebSocket auth attempt ${attempt + 1} failed, retrying in ${delay}ms...`);
 					await new Promise((resolve) => setTimeout(resolve, delay));
-					continue;
 				}
 			}
-			if (attempt < retryCount - 1) {
-				const delay = Math.min(1e3 * (attempt + 1), 3e3);
-				console.debug(`WebSocket auth attempt ${attempt + 1} failed, retrying in ${delay}ms...`);
-				await new Promise((resolve) => setTimeout(resolve, delay));
-			}
 		}
 		console.warn("WebSocket on-demand auth failed after retries:", lastError);
 		throw lastError;
@@ -3096,7 +3220,7 @@ var RebaseWebSocketClient = class {
 			const token = await this.getAuthToken();
 			if (!token) throw new Error("user not logged in");
 			await this.authenticate(token);
-			console.debug("WebSocket reauthenticated successfully");
+			this.connectionDebug("WebSocket reauthenticated successfully");
 		} catch (error) {
 			console.error("WebSocket reauthentication failed:", error);
 			throw error;
@@ -3170,6 +3294,10 @@ var RebaseWebSocketClient = class {
 			await this.ensureAuthenticated();
 		} catch (error) {
 			if (!(isSubscriptionFrame && isNotSignedIn(error))) {
+				if (error instanceof RebaseApiError$1) {
+					reject(error);
+					return;
+				}
 				reject(new RebaseApiError$1(error instanceof Error ? error.message : "Authentication required"));
 				return;
 			}
@@ -3782,7 +3910,7 @@ var RebaseWebSocketClient = class {
 	* we need to re-register everything to resume receiving updates.
 	*/
 	resubscribeAll() {
-		console.debug(`[WS] Re-subscribing: ${this.collectionSubscriptions.size} collection(s), ${this.singleSubscriptions.size} row(ies)`);
+		this.connectionDebug(`[WS] Re-subscribing: ${this.collectionSubscriptions.size} collection(s), ${this.singleSubscriptions.size} row(ies)`);
 		for (const [key, sub] of this.collectionSubscriptions.entries()) {
 			if (sub.subscribeInFlight) continue;
 			const oldBackendId = sub.backendSubscriptionId;
@@ -4072,12 +4200,28 @@ var RebaseRealtimeChannel = class {
 	*/
 	async broadcast(event, payload) {
 		await this.join();
+		this.rememberOwnSender(this.transport.socketClientId);
 		await this.send("broadcast", {
 			event,
 			payload
 		});
 	}
 	/**
+	* The socket ids this channel has broadcast from — the current one and the
+	* ones before a reconnect. A message in history from any of them is this
+	* client's own, and a sender is never sent its own messages: replayed after
+	* a reconnect whose `broadcast_ack` was lost, it was applied twice.
+	*/
+	ownSenderIds = /* @__PURE__ */ new Set();
+	rememberOwnSender(id) {
+		if (id === void 0 || this.ownSenderIds.has(id)) return;
+		this.ownSenderIds.add(id);
+		if (this.ownSenderIds.size > 16) {
+			const oldest = this.ownSenderIds.values().next().value;
+			if (oldest !== void 0) this.ownSenderIds.delete(oldest);
+		}
+	}
+	/**
 	* Observe refusals about this channel.
 	*
 	* `CHANNEL_FORBIDDEN` when an authorizer refuses a join, a broadcast or a
@@ -4250,7 +4394,7 @@ var RebaseRealtimeChannel = class {
 				for (const entry of entries) {
 					if (entry.seq <= this.lastSeq) continue;
 					this.lastSeq = entry.seq;
-					if (ownId !== void 0 && entry.senderId === ownId) continue;
+					if (ownId !== void 0 && (entry.senderId === ownId || entry.senderId !== void 0 && this.ownSenderIds.has(entry.senderId))) continue;
 					this.deliver({
 						event: entry.event,
 						payload: entry.payload,
@@ -4399,7 +4543,7 @@ var LazyOfflineManager = class {
 	keepsLastUser;
 	constructor(config, createInner) {
 		this.keepsLastUser = config.keepLastUser === true;
-		import("./offline-BrqCRgih.js").then(({ OfflineManager: Engine }) => {
+		import("./offline-AvuEcg7u.js").then(({ OfflineManager: Engine }) => {
 			const engine = new Engine(config, createInner);
 			this.engine = engine;
 			const queued = this.queued;
@@ -4474,6 +4618,9 @@ var LazyOfflineManager = class {
 	setScope(uid, options) {
 		this.run((engine) => engine.setScope(uid, options)).catch(() => void 0);
 	}
+	onReachedUnconfirmed(listener) {
+		return this.subscribe((engine) => engine.onReachedUnconfirmed(listener));
+	}
 	async resumeLastUser() {
 		await await this.run((engine) => engine.resumeLastUser());
 	}
@@ -4631,7 +4778,8 @@ function createRebaseClient(options) {
 			websocketUrl: resolvedWsUrl,
 			getAuthToken: () => transport.resolveToken(),
 			onUnauthorized: () => onUnauthorized(),
-			impersonate: options.impersonate
+			impersonate: options.impersonate,
+			debug: options.debug
 		});
 		let realtimeUid = auth.getSession()?.user?.uid ?? null;
 		auth.onAuthStateChange((event, session) => {
@@ -4708,15 +4856,19 @@ function createRebaseClient(options) {
 		});
 		if (offlineManager.keepsLastUser) {
 			let confirming = false;
-			offlineManager.api.onStatusChange((status) => {
-				if (!status.online || !status.unverifiedUser || confirming || auth.getSession()) return;
+			const confirm = () => {
+				if (confirming || auth.getSession()) return;
 				confirming = true;
 				auth.refreshSession().catch((error) => {
 					if (error instanceof RebaseApiError && error.status !== void 0 && error.status >= 400 && error.status < 500 && !auth.getSession()) offlineManager.setScope(void 0);
 				}).finally(() => {
 					confirming = false;
 				});
+			};
+			offlineManager.api.onStatusChange((status) => {
+				if (status.online && status.unverifiedUser) confirm();
 			});
+			offlineManager.onReachedUnconfirmed(confirm);
 		}
 	}
 	/**
@@ -4777,11 +4929,12 @@ function createRebaseClient(options) {
 					}
 				});
 			}
+			const slug = toSnakeCase(prop);
 			if (!untypedWarned) {
 				untypedWarned = true;
-				console.warn(`[Rebase] Untyped data access detected (client.data.${prop}). Collection names are resolved via snake_case conversion, which may cause silent 404s at request time. Pass a \`collections\` dictionary to createRebaseClient() or use the generated SDK for type-safe access.`);
+				console.warn(`[Rebase] Untyped data access detected: client.data.${prop} was sent to /data/${slug}, its name in snake_case, because this client has no \`collections\` dictionary. A collection whose slug is not that (a kebab-case slug, a renamed accessor) answers 404. With generated types, pass \`collections: collectionsDictionary\` (from generated/sdk/database.types) to createRebaseClient(); a typed client needs it. Otherwise use client.data.collection("<slug>").`);
 			}
-			return collection(toSnakeCase(prop));
+			return collection(slug);
 		},
 		has(_target, prop) {
 			if (prop === "collection") return true;
@@ -4848,6 +5001,28 @@ channel: (name, options) => {
 			onUnauthorized = handler;
 		},
 		resolveToken: transport.resolveToken,
+		simulate: (simulation) => {
+			const derived = createRebaseClient({
+				baseUrl: options.baseUrl,
+				apiPath: options.apiPath,
+				fetch: options.fetch,
+				collections: options.collections,
+				schemaVersion: options.schemaVersion,
+				headers: {
+					...options.headers ?? {},
+					...simulationHeaders(simulation)
+				},
+				realtime: false,
+				auth: {
+					storage: createMemoryStorage(),
+					persistSession: false,
+					autoRefresh: false
+				}
+			});
+			derived.setAuthTokenGetter(() => transport.resolveToken());
+			derived.setOnUnauthorized(() => onUnauthorized());
+			return derived;
+		},
 		baseUrl: transport.baseUrl,
 		apiPath: transport.apiPath,
 		collection,