@rebasepro/server 0.10.0 → 0.10.1-canary.18115ba

package/dist/index.es.js

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
-import { a as getAccessTokenExpiry, d as require_jsonwebtoken, f as __commonJSMin, h as __toESM, i as generateRefreshToken, l as verifyAccessToken, m as __require, n as generateAccessToken, o as getRefreshTokenExpiry, p as __exportAll, r as generateDownloadToken, s as hashRefreshToken, t as configureJwt, u as verifyDownloadToken } from "./jwt-B3zjddCa.js";
+import { _ as __toESM, a as generateRefreshToken, c as getRefreshTokenTtlMs, d as verifyAccessToken, f as verifyDownloadToken, g as __require, h as __exportAll, i as generateDownloadToken, l as hashRefreshToken, m as __commonJSMin, n as configureJwt, o as getAccessTokenExpiry, p as require_jsonwebtoken, r as generateAccessToken, s as getRefreshTokenExpiry, t as MAX_COOKIE_AGE_MS } from "./jwt-Dj7r7QX7.js";
 import { _ as RebaseApiError, a as policy, c as isPostgresCollectionConfig, d as REST_TO_CANONICAL, f as toCanonicalOp, g as Vector, h as GeoPoint, i as isSQLAdmin, l as CANONICAL_TO_REST, m as EntityRelation, o as getCollectionDataPath, p as EntityReference, r as getDataSourceCapabilities, s as getDeclaredSubcollections, t as DEFAULT_STORAGE_SOURCE_KEY, u as NULL_OPS, v as RebaseClientError } from "./src-CsHhSKbi.js";
 import { t as logger } from "./logger-BYU66ENZ.js";
 import { t as nativeDynamicImport } from "./dynamic-import-Dvh-K5fl.js";
@@ -13,7 +13,7 @@ import path, { join } from "path";
 import { pathToFileURL } from "url";
 import { Hono } from "hono";
 import { promisify } from "util";
-import * as crypto from "crypto";
+import * as crypto$1 from "crypto";
 import { createCipheriv, createDecipheriv, createHash as createHash$1, createHmac, randomBytes as randomBytes$1, randomUUID as randomUUID$1, scrypt, timingSafeEqual } from "crypto";
 import { bodyLimit } from "hono/body-limit";
 import { csrf } from "hono/csrf";
@@ -1007,7 +1007,7 @@ function deepClone(value) {
 function isObject$1(item) {
 	return !!item && typeof item === "object" && !Array.isArray(item);
 }
-function isPlainObject$1(obj) {
+function isPlainObject$2(obj) {
 	if (typeof obj !== "object" || obj === null || Array.isArray(obj)) return false;
 	return Object.getPrototypeOf(obj) === Object.prototype;
 }
@@ -1022,7 +1022,7 @@ function mergeDeep(target, source, ignoreUndefined = false) {
 			const outputValue = output[key];
 			if (ignoreUndefined && sourceValue === void 0) continue;
 			if (sourceValue instanceof Date) output[key] = new Date(sourceValue.getTime());
-			else if (Array.isArray(sourceValue)) if (Array.isArray(outputValue)) if (!(sourceValue.some(isPlainObject$1) || outputValue.some(isPlainObject$1))) output[key] = [...sourceValue];
+			else if (Array.isArray(sourceValue)) if (Array.isArray(outputValue)) if (!(sourceValue.some(isPlainObject$2) || outputValue.some(isPlainObject$2))) output[key] = [...sourceValue];
 			else {
 				const newArray = [];
 				const maxLength = Math.max(outputValue.length, sourceValue.length);
@@ -1032,13 +1032,13 @@ function mergeDeep(target, source, ignoreUndefined = false) {
 					if (i >= sourceValue.length) newArray[i] = targetItem;
 					else if (i >= outputValue.length) newArray[i] = sourceItem;
 					else if (sourceItem === null) newArray[i] = targetItem;
-					else if (isPlainObject$1(sourceItem) && isPlainObject$1(targetItem)) newArray[i] = mergeDeep(targetItem, sourceItem, ignoreUndefined);
+					else if (isPlainObject$2(sourceItem) && isPlainObject$2(targetItem)) newArray[i] = mergeDeep(targetItem, sourceItem, ignoreUndefined);
 					else newArray[i] = sourceItem;
 				}
 				output[key] = newArray;
 			}
 			else output[key] = [...sourceValue];
-			else if (isPlainObject$1(sourceValue)) if (isPlainObject$1(outputValue)) output[key] = mergeDeep(outputValue, sourceValue, ignoreUndefined);
+			else if (isPlainObject$2(sourceValue)) if (isPlainObject$2(outputValue)) output[key] = mergeDeep(outputValue, sourceValue, ignoreUndefined);
 			else output[key] = sourceValue;
 			else if (isObject$1(sourceValue)) output[key] = sourceValue;
 			else output[key] = sourceValue;
@@ -1051,7 +1051,7 @@ function removeFunctions(o) {
 	if (o === null) return null;
 	if (typeof o === "object") {
 		if (Array.isArray(o)) return o.map((v) => removeFunctions(v));
-		if (!isPlainObject$1(o)) return o;
+		if (!isPlainObject$2(o)) return o;
 		return Object.entries(o).filter(([_, value]) => typeof value !== "function").map(([key, value]) => {
 			if (Array.isArray(value)) return { [key]: value.map((v) => removeFunctions(v)) };
 			else if (typeof value === "object") return { [key]: removeFunctions(value) };
@@ -6114,7 +6114,7 @@ var allowsEval = /* @__PURE__*/ cached(() => {
 		return false;
 	}
 });
-function isPlainObject(o) {
+function isPlainObject$1(o) {
 	if (isObject(o) === false) return false;
 	const ctor = o.constructor;
 	if (ctor === void 0) return true;
@@ -6125,7 +6125,7 @@ function isPlainObject(o) {
 	return true;
 }
 function shallowClone(o) {
-	if (isPlainObject(o)) return { ...o };
+	if (isPlainObject$1(o)) return { ...o };
 	if (Array.isArray(o)) return [...o];
 	if (o instanceof Map) return new Map(o);
 	if (o instanceof Set) return new Set(o);
@@ -6202,7 +6202,7 @@ function omit(schema, mask) {
 	}));
 }
 function extend(schema, shape) {
-	if (!isPlainObject(shape)) throw new Error("Invalid input to extend: expected a plain object");
+	if (!isPlainObject$1(shape)) throw new Error("Invalid input to extend: expected a plain object");
 	const checks = schema._zod.def.checks;
 	if (checks && checks.length > 0) {
 		const existingShape = schema._zod.def.shape;
@@ -6218,7 +6218,7 @@ function extend(schema, shape) {
 	} }));
 }
 function safeExtend(schema, shape) {
-	if (!isPlainObject(shape)) throw new Error("Invalid input to safeExtend: expected a plain object");
+	if (!isPlainObject$1(shape)) throw new Error("Invalid input to safeExtend: expected a plain object");
 	return clone(schema, mergeDefs(schema._zod.def, { get shape() {
 		const _shape = {
 			...schema._zod.def.shape,
@@ -7569,7 +7569,7 @@ function mergeValues(a, b) {
 		valid: true,
 		data: a
 	};
-	if (isPlainObject(a) && isPlainObject(b)) {
+	if (isPlainObject$1(a) && isPlainObject$1(b)) {
 		const bKeys = Object.keys(b);
 		const sharedKeys = Object.keys(a).filter((key) => bKeys.indexOf(key) !== -1);
 		const newObj = {
@@ -9888,7 +9888,10 @@ function mountMfaRoutes(router, config, ops, parseBody, applyTransformHook) {
 		const roleIds = (await authRepo.getUserRoles(userCtx.uid)).map((r) => r.id);
 		const accessToken = generateAccessToken(userCtx.uid, roleIds, "aal2");
 		const refreshToken = generateRefreshToken();
-		await authRepo.createRefreshToken(userCtx.uid, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown");
+		await authRepo.createRefreshToken(userCtx.uid, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), c.req.header("user-agent") || "unknown", c.req.header("x-forwarded-for") || "unknown", {
+			id: randomUUID$1(),
+			startedAt: /* @__PURE__ */ new Date()
+		});
 		if (ops.onMfaVerified) ops.onMfaVerified(userCtx.uid, factor.id).catch((err) => {
 			logger.error("[AuthHooks] onMfaVerified error", { error: err instanceof Error ? err.message : err });
 		});
@@ -9959,7 +9962,8 @@ function setRefreshCookie(c, refreshToken, config) {
 	let cookie = `${settings.name}=${encodeURIComponent(refreshToken)}; Path=${settings.path}; HttpOnly; SameSite=${settings.sameSite}`;
 	if (isSecure) cookie += "; Secure";
 	if (settings.domain) cookie += `; Domain=${settings.domain}`;
-	cookie += `; Max-Age=${720 * 60 * 60}`;
+	const maxAgeSeconds = Math.floor(Math.min(getRefreshTokenTtlMs(), MAX_COOKIE_AGE_MS) / 1e3);
+	cookie += `; Max-Age=${maxAgeSeconds}`;
 	c.header("Set-Cookie", cookie, { append: true });
 }
 /**
@@ -10025,12 +10029,14 @@ function mountSessionRoutes(opts) {
 		const refreshToken = readRefreshToken(c, parseBody(logoutSchema, await c.req.json().catch(() => ({}))), config.cookieAuth);
 		if (refreshToken) {
 			const tokenHash = hashRefreshToken(refreshToken);
-			await authRepo.deleteRefreshToken(tokenHash);
+			const sessionId = (await authRepo.findRefreshTokenByHash(tokenHash).catch(() => null))?.sessionId;
+			if (sessionId && authRepo.revokeRefreshTokenSession) await authRepo.revokeRefreshTokenSession(sessionId);
+			else await authRepo.deleteRefreshToken(tokenHash);
 		}
 		clearRefreshCookie(c, config.cookieAuth);
 		const authHeader = c.req.header("authorization");
 		if (ops.afterLogout && authHeader?.startsWith("Bearer ")) {
-			const { verifyAccessToken } = await import("./jwt-B3zjddCa.js").then((n) => n.c);
+			const { verifyAccessToken } = await import("./jwt-Dj7r7QX7.js").then((n) => n.u);
 			const payload = verifyAccessToken(authHeader.substring(7));
 			if (payload) ops.afterLogout(payload.uid).catch((err) => {
 				logger.error("[AuthHooks] afterLogout error", { error: err instanceof Error ? err.message : err });
@@ -10047,12 +10053,20 @@ function mountSessionRoutes(opts) {
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		const currentRefreshToken = c.req.header("x-refresh-token");
 		const currentTokenHash = currentRefreshToken ? hashRefreshToken(currentRefreshToken) : null;
-		const mappedSessions = (await authRepo.listRefreshTokensForUser(userCtx.uid)).map((s) => ({
+		const tokens = await authRepo.listRefreshTokensForUser(userCtx.uid);
+		const bySession = /* @__PURE__ */ new Map();
+		for (const token of tokens) {
+			if (token.revoked) continue;
+			const key = token.sessionId ?? token.id;
+			const existing = bySession.get(key);
+			if (!existing || existing.createdAt < token.createdAt) bySession.set(key, token);
+		}
+		const mappedSessions = [...bySession.values()].map((s) => ({
 			id: s.id,
 			userAgent: s.userAgent,
 			ipAddress: s.ipAddress,
-			createdAt: s.createdAt,
-			isCurrentSession: currentTokenHash ? s.tokenHash === currentTokenHash : false
+			createdAt: s.sessionStartedAt ?? s.createdAt,
+			isCurrentSession: currentTokenHash ? tokens.some((t) => t.tokenHash === currentTokenHash && (t.sessionId ?? t.id) === (s.sessionId ?? s.id)) : false
 		}));
 		return c.json({ sessions: mappedSessions });
 	});
@@ -10064,6 +10078,7 @@ function mountSessionRoutes(opts) {
 		const userCtx = c.get("user");
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		await authRepo.deleteAllRefreshTokensForUser(userCtx.uid);
+		await authRepo.setTokensValidAfter?.(userCtx.uid, /* @__PURE__ */ new Date()).catch(() => void 0);
 		return c.json({
 			success: true,
 			message: "All sessions revoked successfully"
@@ -10078,7 +10093,9 @@ function mountSessionRoutes(opts) {
 		if (!userCtx) throw ApiError.unauthorized("Not authenticated");
 		const id = c.req.param("id");
 		if (!id) throw ApiError.badRequest("Session ID is required", "INVALID_INPUT");
-		await authRepo.deleteRefreshTokenById(id, userCtx.uid);
+		const target = (await authRepo.listRefreshTokensForUser(userCtx.uid).catch(() => [])).find((t) => t.id === id);
+		if (target?.sessionId && authRepo.revokeRefreshTokenSession) await authRepo.revokeRefreshTokenSession(target.sessionId);
+		else await authRepo.deleteRefreshTokenById(id, userCtx.uid);
 		return c.json({
 			success: true,
 			message: "Session revoked successfully"
@@ -10442,7 +10459,10 @@ function createAuthRoutes(config) {
 		}
 		const accessToken = generateAccessToken(uid, roleIds, "aal1", customClaims);
 		const refreshToken = generateRefreshToken();
-		await authRepo.createRefreshToken(uid, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), userAgent, ipAddress);
+		await authRepo.createRefreshToken(uid, hashRefreshToken(refreshToken), getRefreshTokenExpiry(), userAgent, ipAddress, {
+			id: randomUUID$1(),
+			startedAt: /* @__PURE__ */ new Date()
+		});
 		return {
 			roleIds,
 			accessToken,
@@ -10675,6 +10695,7 @@ function createAuthRoutes(config) {
 		await authRepo.updatePassword(storedToken.uid, passwordHash);
 		await authRepo.markPasswordResetTokenUsed(tokenHash);
 		await authRepo.deleteAllRefreshTokensForUser(storedToken.uid);
+		await authRepo.setTokensValidAfter?.(storedToken.uid, /* @__PURE__ */ new Date()).catch(() => void 0);
 		if (ops.onPasswordReset) ops.onPasswordReset(storedToken.uid).catch((err) => {
 			logger.error("[AuthHooks] onPasswordReset error", { error: err instanceof Error ? err.message : err });
 		});
@@ -10699,6 +10720,7 @@ function createAuthRoutes(config) {
 		const passwordHash = await ops.hashPassword(newPassword);
 		await authRepo.updatePassword(user.id, passwordHash);
 		await authRepo.deleteAllRefreshTokensForUser(user.id);
+		await authRepo.setTokensValidAfter?.(user.id, /* @__PURE__ */ new Date()).catch(() => void 0);
 		return c.json({
 			success: true,
 			message: "Password has been changed successfully"
@@ -10762,15 +10784,34 @@ function createAuthRoutes(config) {
 		if (!refreshToken) throw ApiError.unauthenticated("No refresh token presented", "NO_SESSION");
 		const tokenHash = hashRefreshToken(refreshToken);
 		const storedToken = await authRepo.findRefreshTokenByHash(tokenHash);
-		if (!storedToken) {
+		if (!storedToken) throw ApiError.unauthorized("Invalid refresh token", "INVALID_TOKEN");
+		if (storedToken.revoked) {
 			clearRefreshCookie(c, config.cookieAuth);
-			throw ApiError.unauthorized("Invalid refresh token", "INVALID_TOKEN");
+			throw ApiError.unauthorized("Session has been revoked", "SESSION_REVOKED");
 		}
 		if (/* @__PURE__ */ new Date() > storedToken.expiresAt) {
 			await authRepo.deleteRefreshToken(tokenHash);
 			clearRefreshCookie(c, config.cookieAuth);
 			throw ApiError.unauthorized("Refresh token expired", "TOKEN_EXPIRED");
 		}
+		const sessionStartedAt = storedToken.sessionStartedAt ?? storedToken.createdAt;
+		const tokensValidAfter = await authRepo.getTokensValidAfter?.(storedToken.uid).catch(() => null);
+		if (tokensValidAfter && sessionStartedAt < tokensValidAfter) {
+			await authRepo.deleteRefreshToken(tokenHash);
+			clearRefreshCookie(c, config.cookieAuth);
+			throw ApiError.unauthorized("Session has been revoked", "SESSION_REVOKED");
+		}
+		const reuseWindowMs = Math.max(0, config.refreshTokenReuseIntervalSeconds ?? 10) * 1e3;
+		const supersededAt = storedToken.rotatedAt ? new Date(storedToken.rotatedAt) : null;
+		if (supersededAt && Date.now() - supersededAt.getTime() > reuseWindowMs) {
+			logger.warn("[Auth] Refresh token replayed after the reuse window", {
+				uid: storedToken.uid,
+				sessionId: storedToken.sessionId,
+				supersededSecondsAgo: Math.round((Date.now() - supersededAt.getTime()) / 1e3),
+				userAgent: c.req.header("user-agent") || "unknown"
+			});
+			throw ApiError.unauthorized("Refresh token already used", "TOKEN_ALREADY_USED");
+		}
 		const roleIds = (await authRepo.getUserRoles(storedToken.uid)).map((r) => r.id);
 		const user = await authRepo.getUserById(storedToken.uid).catch((err) => {
 			logger.warn("[Auth] Could not load user during token refresh; returning tokens only", {
@@ -10792,8 +10833,16 @@ function createAuthRoutes(config) {
 		const newRefreshToken = generateRefreshToken();
 		const userAgent = c.req.header("user-agent") || "unknown";
 		const ipAddress = c.req.header("x-forwarded-for") || "unknown";
-		await authRepo.deleteRefreshToken(tokenHash);
-		await authRepo.createRefreshToken(storedToken.uid, hashRefreshToken(newRefreshToken), getRefreshTokenExpiry(), userAgent, ipAddress);
+		const session = {
+			id: storedToken.sessionId ?? storedToken.id,
+			startedAt: sessionStartedAt
+		};
+		if (!supersededAt) if (authRepo.markRefreshTokenRotated) await authRepo.markRefreshTokenRotated(tokenHash);
+		else await authRepo.deleteRefreshToken(tokenHash);
+		await authRepo.createRefreshToken(storedToken.uid, hashRefreshToken(newRefreshToken), getRefreshTokenExpiry(), userAgent, ipAddress, session);
+		authRepo.pruneRefreshTokens?.(storedToken.uid, session.id, new Date(Date.now() - reuseWindowMs)).catch((err) => {
+			logger.warn("[Auth] Refresh token prune failed", { error: err instanceof Error ? err.message : String(err) });
+		});
 		const tokensOnlyResponse = { tokens: {
 			accessToken: newAccessToken,
 			refreshToken: newRefreshToken,
@@ -15032,19 +15081,39 @@ function createAuth(transport, options) {
 	*/
 	function isFatalRefreshError(err) {
 		if (!(err instanceof RebaseApiError)) return false;
+		if (err.code === "TOKEN_ALREADY_USED") return false;
 		if (err.code === "INVALID_TOKEN" || err.code === "TOKEN_EXPIRED") return true;
 		return err.status === 401 || err.status === 403;
 	}
+	/**
+	* Drop this client's session without telling the server.
+	*
+	* `signOut()` is a user action: it POSTs /logout, which revokes the whole
+	* sign-in. That is the wrong hammer for a refresh that failed. Our token
+	* may be stale precisely because a sibling tab holds a live one, and
+	* logging out on its behalf would turn one tab's bad luck into everybody
+	* being signed out — the exact failure this work exists to remove.
+	*/
+	function abandonSessionLocally() {
+		currentSession = null;
+		clearStoredSession();
+		if (refreshTimeout) {
+			clearTimeout(refreshTimeout);
+			refreshTimeout = null;
+		}
+		transport.setToken(null);
+		emit("SIGNED_OUT", null);
+	}
 	async function attemptScheduledRefresh(attempt) {
 		try {
 			await refreshSession();
 		} catch (err) {
 			if (isFatalRefreshError(err)) {
-				signOut();
+				abandonSessionLocally();
 				return;
 			}
 			if (attempt >= MAX_REFRESH_RETRIES) {
-				signOut();
+				abandonSessionLocally();
 				return;
 			}
 			const backoff = Math.min(REFRESH_RETRY_BASE_MS * 2 ** attempt, REFRESH_RETRY_MAX_MS);
@@ -15265,9 +15334,42 @@ function createAuth(transport, options) {
 		transport.setToken(null);
 		emit("SIGNED_OUT", null);
 	}
+	/**
+	* Serialise refreshes across TABS, not just within one.
+	*
+	* The in-flight promise below covers callers inside a single JavaScript
+	* context. It does nothing about the far more common case: two tabs of the
+	* same app booting together, each firing its own /refresh with the same
+	* cookie. The server tolerates that now (superseded tokens stay usable for
+	* a grace window), but tolerating a stampede is not the same as avoiding
+	* one, and every extra rotation is another chance to end up holding a
+	* token whose response never arrived.
+	*
+	* Web Locks are best-effort on purpose. supabase-js shipped this and then
+	* spent a year fielding deadlock reports — a lock held by a crashed or
+	* frozen tab must never be able to wedge sign-in — so a lock we cannot
+	* take within the timeout is simply not taken, and the refresh proceeds
+	* unserialised, exactly as it did before.
+	*/
+	const REFRESH_LOCK_NAME = "rebase-auth-refresh";
+	const REFRESH_LOCK_TIMEOUT_MS = 5e3;
+	async function withRefreshLock(fn) {
+		const locks = globalThis.navigator?.locks;
+		if (!locks?.request) return fn();
+		const controller = new AbortController();
+		const giveUp = setTimeout(() => controller.abort(), REFRESH_LOCK_TIMEOUT_MS);
+		try {
+			return await locks.request(REFRESH_LOCK_NAME, { signal: controller.signal }, async () => fn());
+		} catch (e) {
+			if (e?.name !== "AbortError") throw e;
+			return fn();
+		} finally {
+			clearTimeout(giveUp);
+		}
+	}
 	function refreshSession() {
 		if (inFlightRefresh) return inFlightRefresh;
-		inFlightRefresh = doRefreshSession().finally(() => {
+		inFlightRefresh = withRefreshLock(() => doRefreshSession()).finally(() => {
 			inFlightRefresh = null;
 		});
 		return inFlightRefresh;
@@ -15833,6 +15935,44 @@ function createCollectionClient(transport, slug, ws) {
 			});
 			return (await transport.request(basePath + "/count" + qs, { method: "GET" })).count ?? 0;
 		},
+		observe(params, onResult, onError, options) {
+			let closed = false;
+			const emit = (result) => {
+				if (closed) return;
+				onResult({
+					...result,
+					fromCache: false,
+					hasPendingWrites: false,
+					partial: false
+				});
+			};
+			client.find(params).then(emit).catch((error) => {
+				if (!closed) onError?.(error);
+			});
+			const live = options?.realtime !== false && client.listen ? client.listen(params, emit, onError) : void 0;
+			return () => {
+				closed = true;
+				live?.();
+			};
+		},
+		observeById(id, onResult, onError, options) {
+			let closed = false;
+			const emit = (row) => {
+				if (closed) return;
+				onResult(row, {
+					fromCache: false,
+					hasPendingWrites: false
+				});
+			};
+			client.findById(id).then(emit).catch((error) => {
+				if (!closed) onError?.(error);
+			});
+			const live = options?.realtime !== false && client.listenById ? client.listenById(id, emit, onError) : void 0;
+			return () => {
+				closed = true;
+				live?.();
+			};
+		},
 		where(columnOrCondition, operator, value) {
 			const builder = new SDKQueryBuilder(client);
 			if (typeof columnOrCondition === "object") return builder.where(columnOrCondition);
@@ -17633,6 +17773,1915 @@ var RebaseRealtimeChannel = class {
 	}
 };
 /**
+* Lossless round-tripping of rows through the offline store.
+*
+* Both persistence backends move values by structured clone, which keeps
+* `Date` but flattens every class instance to a plain object. For
+* `EntityReference`/`EntityRelation` that is harmless — they carry their own
+* `__type` discriminator, so the JSON reviver can rebuild them — but
+* `GeoPoint` and `Vector` do not, and would come back out of the cache as
+* anonymous `{ latitude, longitude }` / `{ value }` bags. A row read from the
+* cache must be indistinguishable from the same row read from the network, so
+* those two are tagged on the way in and revived on the way out.
+*
+* Type tests here are structural rather than `instanceof`, because a structured
+* clone can arrive from another realm — an iframe, a worker, or the polyfill
+* the tests run against — where the constructor identity differs but the value
+* is the real thing. Only *plain* objects are walked; anything else is passed
+* through whole, so a class instance is never quietly reduced to `{}`.
+*/
+function isDate(value) {
+	return Object.prototype.toString.call(value) === "[object Date]";
+}
+/** An object literal — not a Date, RegExp, Map, or any class instance. */
+function isPlainObject(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const proto = Object.getPrototypeOf(value);
+	if (proto === null || proto === Object.prototype) return true;
+	return proto.constructor?.name === "Object";
+}
+function dehydrateValue(value) {
+	if (value === null || value === void 0) return value;
+	if (value instanceof GeoPoint) return {
+		__type: "GeoPoint",
+		latitude: value.latitude,
+		longitude: value.longitude
+	};
+	if (value instanceof Vector) return {
+		__type: "Vector",
+		value: [...value.value]
+	};
+	if (value instanceof EntityReference || value instanceof EntityRelation) return value;
+	if (Array.isArray(value)) return value.map(dehydrateValue);
+	if (isPlainObject(value)) {
+		const out = {};
+		for (const [key, inner] of Object.entries(value)) out[key] = dehydrateValue(inner);
+		return out;
+	}
+	return value;
+}
+function hydrateValue(value) {
+	if (value === null || value === void 0 || isDate(value)) return value;
+	if (Array.isArray(value)) return value.map(hydrateValue);
+	if (typeof value === "object") {
+		const revived = rebaseReviver("", value);
+		if (revived !== value) return revived;
+		if (!isPlainObject(value)) return value;
+		const out = {};
+		for (const [key, inner] of Object.entries(value)) out[key] = hydrateValue(inner);
+		return out;
+	}
+	return value;
+}
+/** Prepare a row for the store. */
+function dehydrateRow(row) {
+	return dehydrateValue(row);
+}
+/** Restore a row read back from the store. */
+function hydrateRow(row) {
+	return hydrateValue(row);
+}
+/**
+* Whether the network is worth trying, and when to try again after it wasn't.
+*
+* `navigator.onLine` is necessary but not sufficient: it reports the state of
+* the network interface, so it stays `true` behind a captive portal, on a
+* connection that resolves DNS but reaches nothing, and while the API itself
+* is down. This tracks what actually happened to requests as well, so the
+* first failure is the only one an app pays for — everything after it inside
+* the backoff window skips the doomed round trip and answers from the local
+* store immediately, which is the difference between an app that freezes when
+* the wifi drops and one that does not.
+*/
+/** The request never reached the server, so nothing was decided by it. */
+function isNetworkError(error) {
+	if (error instanceof RebaseApiError) return error.status === 0;
+	if (error instanceof TypeError) return true;
+	const name = error?.name;
+	return name === "AbortError" || name === "TimeoutError" || name === "NetworkError";
+}
+/**
+* Statuses that mean "not now" rather than "not ever": a queued write that
+* gets one of these is worth replaying, while a 400 or a 403 never will be.
+* 500 is deliberately absent — an unhandled server error is far more often a
+* bug the same payload will hit again than a blip, and retrying it forever
+* jams every write behind it.
+*/
+var RETRYABLE_STATUSES = new Set([
+	408,
+	425,
+	429,
+	502,
+	503,
+	504
+]);
+/** Is this failure worth another attempt later? */
+function isRetryableError(error) {
+	if (isNetworkError(error)) return true;
+	if (error instanceof RebaseApiError) return error.status !== void 0 && RETRYABLE_STATUSES.has(error.status);
+	return false;
+}
+var ConnectivityMonitor = class {
+	state = "online";
+	backoffMs;
+	initialBackoffMs;
+	maxBackoffMs;
+	retryAt = 0;
+	timer;
+	listeners = /* @__PURE__ */ new Set();
+	respectBackoff;
+	now;
+	setTimer;
+	clearTimer;
+	/** Called when the backoff window expires, to drive an automatic retry. */
+	onRetryDue;
+	handleOnline = () => {
+		this.retryAt = 0;
+		this.backoffMs = this.initialBackoffMs;
+		this.clearPendingTimer();
+		this.setState("online");
+		this.onRetryDue?.();
+	};
+	handleOffline = () => {
+		this.setState("offline");
+	};
+	constructor(options = {}) {
+		this.initialBackoffMs = options.initialBackoffMs ?? 1e3;
+		this.maxBackoffMs = Math.max(this.initialBackoffMs, options.maxBackoffMs ?? 6e4);
+		this.backoffMs = this.initialBackoffMs;
+		this.respectBackoff = options.respectBackoff ?? true;
+		this.now = options.now ?? (() => Date.now());
+		this.setTimer = options.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+		this.clearTimer = options.clearTimer ?? ((handle) => clearTimeout(handle));
+		if (typeof window !== "undefined" && typeof window.addEventListener === "function") {
+			window.addEventListener("online", this.handleOnline);
+			window.addEventListener("offline", this.handleOffline);
+		}
+		if (typeof navigator !== "undefined" && navigator.onLine === false) this.state = "offline";
+	}
+	/** What the app should be told: are we connected? */
+	isOnline() {
+		if (typeof navigator !== "undefined" && navigator.onLine === false) return false;
+		return this.state === "online";
+	}
+	/**
+	* Should this request even be sent? False means "answer from the local
+	* store instead" — the request would only burn a timeout to reach the same
+	* conclusion the last one already did.
+	*/
+	shouldAttempt() {
+		if (typeof navigator !== "undefined" && navigator.onLine === false) return false;
+		if (this.state === "online" || !this.respectBackoff) return true;
+		return this.now() >= this.retryAt;
+	}
+	/** A request reached the server. */
+	markSuccess() {
+		this.backoffMs = this.initialBackoffMs;
+		this.retryAt = 0;
+		this.clearPendingTimer();
+		this.setState("online");
+	}
+	/** A request did not reach the server: we are offline until proven otherwise. */
+	markFailure() {
+		this.deferRetry();
+		this.setState("offline");
+	}
+	/**
+	* Back off and try again later without claiming the connection is gone.
+	* This is what a 429 or a 503 deserves — the server answered, so the app
+	* is demonstrably online; it just should not hammer.
+	*/
+	deferRetry() {
+		const jitter = .8 + Math.random() * .4;
+		this.retryAt = this.now() + this.backoffMs * jitter;
+		const delay = Math.max(0, this.retryAt - this.now());
+		this.backoffMs = Math.min(this.maxBackoffMs, this.backoffMs * 2);
+		this.scheduleRetry(delay);
+	}
+	/** Milliseconds until the next attempt is allowed; 0 when one is allowed now. */
+	msUntilRetry() {
+		if (this.state === "online") return 0;
+		return Math.max(0, this.retryAt - this.now());
+	}
+	onChange(listener) {
+		this.listeners.add(listener);
+		return () => this.listeners.delete(listener);
+	}
+	dispose() {
+		if (typeof window !== "undefined" && typeof window.removeEventListener === "function") {
+			window.removeEventListener("online", this.handleOnline);
+			window.removeEventListener("offline", this.handleOffline);
+		}
+		this.clearPendingTimer();
+		this.listeners.clear();
+		this.onRetryDue = void 0;
+	}
+	scheduleRetry(delay) {
+		this.clearPendingTimer();
+		if (!this.onRetryDue) return;
+		this.timer = this.setTimer(() => {
+			this.timer = void 0;
+			this.onRetryDue?.();
+		}, delay);
+		this.timer.unref?.();
+	}
+	clearPendingTimer() {
+		if (this.timer !== void 0) {
+			this.clearTimer(this.timer);
+			this.timer = void 0;
+		}
+	}
+	setState(next) {
+		if (this.state === next) return;
+		this.state = next;
+		const online = this.isOnline();
+		for (const listener of this.listeners) listener(online);
+	}
+};
+/**
+* Monotonic within a tab, unique across tabs, and sortable as a plain string:
+* `<ms base36, padded>-<counter>-<random>`. The padding is what keeps
+* lexicographic order equal to chronological order, and the random suffix is
+* what stops two tabs from writing the same queue key in the same millisecond
+* — which would silently drop one of the two writes.
+*/
+var mutationCounter = 0;
+function createMutationId(now = Date.now()) {
+	return `${now.toString(36).padStart(10, "0")}-${(mutationCounter = (mutationCounter + 1) % 1679616).toString(36).padStart(4, "0")}-${Math.random().toString(36).slice(2, 10).padStart(8, "0")}`;
+}
+/**
+* In-memory store: the default outside the browser and the workhorse of the
+* test suite. Values are deep-copied on the way in and out so a caller
+* mutating a returned row cannot silently edit the "persisted" copy — the
+* IndexedDB implementation gets the same guarantee for free from structured
+* cloning, and the two must not differ in aliasing behaviour.
+*/
+var MemoryOfflineStore = class {
+	cache = /* @__PURE__ */ new Map();
+	queue = /* @__PURE__ */ new Map();
+	async getCache(key) {
+		const entry = this.cache.get(key);
+		return entry ? structuredClone(entry) : void 0;
+	}
+	async setCache(key, entry) {
+		this.cache.set(key, structuredClone(entry));
+	}
+	async setCacheMany(entries) {
+		for (const { key, entry } of entries) this.cache.set(key, structuredClone(entry));
+	}
+	async deleteCache(keys) {
+		for (const key of keys) this.cache.delete(key);
+	}
+	async listCache(prefix) {
+		const out = [];
+		for (const [key, entry] of this.cache) if (key.startsWith(prefix)) out.push({
+			key,
+			cachedAt: entry.cachedAt
+		});
+		return out;
+	}
+	async listCacheEntries(prefix) {
+		const out = [];
+		for (const [key, entry] of this.cache) if (key.startsWith(prefix)) out.push({
+			key,
+			...structuredClone(entry)
+		});
+		out.sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+		return out;
+	}
+	async enqueue(key, mutation) {
+		this.queue.set(key, structuredClone(mutation));
+	}
+	async dequeue(key) {
+		this.queue.delete(key);
+	}
+	async listQueue(prefix) {
+		return [...this.queue.entries()].filter(([key]) => key.startsWith(prefix)).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, mutation]) => structuredClone(mutation));
+	}
+	async clear(prefix) {
+		for (const key of [...this.cache.keys()]) if (key.startsWith(prefix)) this.cache.delete(key);
+		for (const key of [...this.queue.keys()]) if (key.startsWith(prefix)) this.queue.delete(key);
+	}
+};
+var IDB_NAME = "rebase-offline";
+/**
+* v2 introduced the normalized row cache and string mutation ids. A v1
+* database holds whole-response blobs under keys this version cannot read and
+* queue entries ordered by a numeric `seq` this version no longer writes, so
+* the upgrade drops both stores rather than trying to translate them. Offline
+* support had not shipped in a release when v2 landed, so nothing in the wild
+* loses a queued write to this.
+*/
+var IDB_VERSION = 2;
+var CACHE_STORE = "cache";
+var QUEUE_STORE = "queue";
+/** The exclusive upper bound of an IDBKeyRange covering every key under `prefix`. */
+function prefixRange(prefix) {
+	return IDBKeyRange.bound(prefix, prefix + "￿", false, false);
+}
+function requestToPromise(request) {
+	return new Promise((resolve, reject) => {
+		request.onsuccess = () => resolve(request.result);
+		request.onerror = () => reject(request.error ?? /* @__PURE__ */ new Error("IndexedDB request failed"));
+	});
+}
+/** Resolve when the whole transaction commits, not just when the last request returns. */
+function transactionDone(tx) {
+	return new Promise((resolve, reject) => {
+		tx.oncomplete = () => resolve();
+		tx.onabort = tx.onerror = () => reject(tx.error ?? /* @__PURE__ */ new Error("IndexedDB transaction failed"));
+	});
+}
+/**
+* IndexedDB-backed store — the browser default, so cached rows and queued
+* writes survive a reload or a browser restart. Everything lives in one
+* database with two object stores; keys are the manager's full prefixed
+* strings, so multiple users (scopes) share the database without ever
+* sharing entries.
+*/
+var IndexedDBOfflineStore = class {
+	dbPromise;
+	open() {
+		if (!this.dbPromise) this.dbPromise = new Promise((resolve, reject) => {
+			const request = indexedDB.open(IDB_NAME, IDB_VERSION);
+			request.onupgradeneeded = (event) => {
+				const db = request.result;
+				if (event.oldVersion > 0 && event.oldVersion < 2) {
+					if (db.objectStoreNames.contains(CACHE_STORE)) db.deleteObjectStore(CACHE_STORE);
+					if (db.objectStoreNames.contains(QUEUE_STORE)) db.deleteObjectStore(QUEUE_STORE);
+				}
+				if (!db.objectStoreNames.contains(CACHE_STORE)) db.createObjectStore(CACHE_STORE);
+				if (!db.objectStoreNames.contains(QUEUE_STORE)) db.createObjectStore(QUEUE_STORE);
+			};
+			request.onsuccess = () => {
+				const db = request.result;
+				db.onversionchange = () => {
+					db.close();
+					this.dbPromise = void 0;
+				};
+				resolve(db);
+			};
+			request.onerror = () => {
+				this.dbPromise = void 0;
+				reject(request.error ?? /* @__PURE__ */ new Error("Failed to open IndexedDB"));
+			};
+			request.onblocked = () => {
+				this.dbPromise = void 0;
+				reject(/* @__PURE__ */ new Error("IndexedDB upgrade blocked by another tab"));
+			};
+		});
+		return this.dbPromise;
+	}
+	async store(name, mode) {
+		return (await this.open()).transaction(name, mode).objectStore(name);
+	}
+	async getCache(key) {
+		return await requestToPromise((await this.store(CACHE_STORE, "readonly")).get(key));
+	}
+	async setCache(key, entry) {
+		await requestToPromise((await this.store(CACHE_STORE, "readwrite")).put(entry, key));
+	}
+	async setCacheMany(entries) {
+		if (entries.length === 0) return;
+		const store = await this.store(CACHE_STORE, "readwrite");
+		for (const { key, entry } of entries) store.put(entry, key);
+		await transactionDone(store.transaction);
+	}
+	async deleteCache(keys) {
+		if (keys.length === 0) return;
+		const store = await this.store(CACHE_STORE, "readwrite");
+		for (const key of keys) store.delete(key);
+		await transactionDone(store.transaction);
+	}
+	async listCache(prefix) {
+		const store = await this.store(CACHE_STORE, "readonly");
+		const [keys, entries] = await Promise.all([requestToPromise(store.getAllKeys(prefixRange(prefix))), requestToPromise(store.getAll(prefixRange(prefix)))]);
+		return keys.map((key, i) => ({
+			key: String(key),
+			cachedAt: entries[i]?.cachedAt ?? 0
+		}));
+	}
+	async listCacheEntries(prefix) {
+		const store = await this.store(CACHE_STORE, "readonly");
+		const [keys, entries] = await Promise.all([requestToPromise(store.getAllKeys(prefixRange(prefix))), requestToPromise(store.getAll(prefixRange(prefix)))]);
+		return keys.map((key, i) => {
+			const entry = entries[i];
+			return {
+				key: String(key),
+				value: entry?.value,
+				cachedAt: entry?.cachedAt ?? 0
+			};
+		});
+	}
+	async enqueue(key, mutation) {
+		await requestToPromise((await this.store(QUEUE_STORE, "readwrite")).put(mutation, key));
+	}
+	async dequeue(key) {
+		await requestToPromise((await this.store(QUEUE_STORE, "readwrite")).delete(key));
+	}
+	async listQueue(prefix) {
+		return await requestToPromise((await this.store(QUEUE_STORE, "readonly")).getAll(prefixRange(prefix)));
+	}
+	async clear(prefix) {
+		await requestToPromise((await this.store(CACHE_STORE, "readwrite")).delete(prefixRange(prefix)));
+		await requestToPromise((await this.store(QUEUE_STORE, "readwrite")).delete(prefixRange(prefix)));
+	}
+};
+/**
+* A local evaluator for `FindParams`, so cached rows can answer a query the
+* client has never sent to the server — and so a row written offline shows up
+* in every filtered list it belongs to, not just in unfiltered ones.
+*
+* This mirrors the Postgres driver's semantics rather than JavaScript's:
+*
+* - Comparing against NULL is *unknown*, not false-or-true. `status != "done"`
+*   excludes rows where `status` is null, exactly as SQL does — a JS `!==`
+*   would have included them.
+* - `ORDER BY` puts nulls last ascending and first descending, which is the
+*   Postgres default.
+* - The wire format carries no types, so values arriving as strings are
+*   compared numerically against numeric columns and as instants against
+*   date columns. `["==", "3"]` matches the number `3`, as it does server-side.
+*
+* Two things it deliberately approximates, both flagged by
+* {@link isExactlyEvaluable}: `searchString` becomes a case-insensitive
+* substring scan over the row's string fields (the server runs real full-text
+* search over the collection's configured columns), and `include` cannot be
+* evaluated at all, because the related rows live in collections this query
+* knows nothing about.
+*/
+var collator = typeof Intl !== "undefined" && typeof Intl.Collator === "function" ? new Intl.Collator(void 0, {
+	numeric: false,
+	sensitivity: "variant"
+}) : void 0;
+function isNullish(value) {
+	return value === null || value === void 0;
+}
+/**
+* Reduce a value to something comparable. Relations compare by the id they
+* point at — the column holds a foreign key, so that is what the server
+* compares too.
+*/
+function toComparable(value) {
+	if (value instanceof Date) return value.getTime();
+	if (value instanceof EntityRelation) return value.id;
+	if (value && typeof value === "object") {
+		const record = value;
+		if (typeof record.__type === "string" && "id" in record) return record.id;
+	}
+	return value;
+}
+/**
+* Three-way compare with SQL's type coercion but not its collation. Returns
+* `undefined` when the two values are not ordered relative to each other,
+* which is how NULL propagates through a comparison.
+*/
+function compareValues(a, b) {
+	const left = toComparable(a);
+	const right = toComparable(b);
+	if (isNullish(left) || isNullish(right)) return void 0;
+	if (typeof left === "boolean" || typeof right === "boolean") return (left === true || left === "true" || left === 1 ? 1 : 0) - (right === true || right === "true" || right === 1 ? 1 : 0);
+	const leftNum = typeof left === "number" ? left : numericOrNaN(left);
+	const rightNum = typeof right === "number" ? right : numericOrNaN(right);
+	if (!Number.isNaN(leftNum) && !Number.isNaN(rightNum)) return leftNum < rightNum ? -1 : leftNum > rightNum ? 1 : 0;
+	if (typeof left === "number" || typeof right === "number") {
+		const leftTime = toTime(left);
+		const rightTime = toTime(right);
+		if (leftTime !== void 0 && rightTime !== void 0) return leftTime < rightTime ? -1 : leftTime > rightTime ? 1 : 0;
+	}
+	const leftStr = String(left);
+	const rightStr = String(right);
+	if (collator) return collator.compare(leftStr, rightStr);
+	return leftStr < rightStr ? -1 : leftStr > rightStr ? 1 : 0;
+}
+function numericOrNaN(value) {
+	if (typeof value === "number") return value;
+	if (typeof value === "string" && value.trim() !== "") {
+		const n = Number(value);
+		return Number.isNaN(n) ? NaN : n;
+	}
+	if (typeof value === "bigint") return Number(value);
+	return NaN;
+}
+function toTime(value) {
+	if (typeof value === "number") return value;
+	if (typeof value === "string") {
+		const t = Date.parse(value);
+		return Number.isNaN(t) ? void 0 : t;
+	}
+}
+/** Equality with the wire's type erasure allowed for, but never across NULL. */
+function looseEquals(a, b) {
+	const left = toComparable(a);
+	const right = toComparable(b);
+	if (isNullish(left) || isNullish(right)) return isNullish(left) && isNullish(right);
+	if (left === right) return true;
+	return compareValues(left, right) === 0;
+}
+/**
+* Translate a SQL `LIKE` pattern to an anchored regular expression.
+* `%` matches any run of characters, `_` exactly one, and a backslash escapes
+* either of them.
+*/
+function likeToRegExp(pattern, caseInsensitive) {
+	let source = "^";
+	for (let i = 0; i < pattern.length; i++) {
+		const char = pattern[i];
+		if (char === "\\" && i + 1 < pattern.length) {
+			source += pattern[i + 1].replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+			i++;
+		} else if (char === "%") source += "[\\s\\S]*";
+		else if (char === "_") source += "[\\s\\S]";
+		else source += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	}
+	return new RegExp(source + "$", caseInsensitive ? "i" : "");
+}
+function asArray(value) {
+	if (Array.isArray(value)) return value;
+	if (value === void 0) return [];
+	return [value];
+}
+/** Evaluate one canonical operator against one row value. */
+function matchesOperator(rowValue, op, filterValue) {
+	switch (op) {
+		case "is-null": return isNullish(rowValue);
+		case "is-not-null": return !isNullish(rowValue);
+		case "==": return looseEquals(rowValue, filterValue);
+		case "!=":
+			if (isNullish(rowValue)) return false;
+			return !looseEquals(rowValue, filterValue);
+		case "<":
+		case "<=":
+		case ">":
+		case ">=": {
+			const cmp = compareValues(rowValue, filterValue);
+			if (cmp === void 0) return false;
+			if (op === "<") return cmp < 0;
+			if (op === "<=") return cmp <= 0;
+			if (op === ">") return cmp > 0;
+			return cmp >= 0;
+		}
+		case "in":
+			if (isNullish(rowValue)) return false;
+			return asArray(filterValue).some((v) => looseEquals(rowValue, v));
+		case "not-in":
+			if (isNullish(rowValue)) return false;
+			return !asArray(filterValue).some((v) => looseEquals(rowValue, v));
+		case "array-contains":
+			if (!Array.isArray(rowValue)) return false;
+			return rowValue.some((v) => looseEquals(v, filterValue));
+		case "array-contains-any": {
+			if (!Array.isArray(rowValue)) return false;
+			const wanted = asArray(filterValue);
+			return rowValue.some((v) => wanted.some((w) => looseEquals(v, w)));
+		}
+		case "like":
+		case "not-like":
+		case "ilike":
+		case "not-ilike": {
+			if (isNullish(rowValue)) return false;
+			const insensitive = op === "ilike" || op === "not-ilike";
+			const negated = op === "not-like" || op === "not-ilike";
+			const matched = likeToRegExp(String(filterValue), insensitive).test(String(rowValue));
+			return negated ? !matched : matched;
+		}
+		default: return true;
+	}
+}
+function isTuple(value) {
+	return Array.isArray(value) && value.length === 2 && typeof value[0] === "string" && toCanonicalOp(value[0]) !== void 0;
+}
+/** Evaluate a `where` clause: every field, and every tuple on a field, AND-ed. */
+function matchesWhere(row, where) {
+	if (!where) return true;
+	for (const [field, condition] of Object.entries(where)) {
+		if (condition === void 0) continue;
+		const tuples = isTuple(condition) ? [condition] : Array.isArray(condition) ? condition.filter(isTuple) : [];
+		for (const [rawOp, value] of tuples) {
+			const op = toCanonicalOp(rawOp) ?? rawOp;
+			if (!matchesOperator(row[field], op, value)) return false;
+		}
+	}
+	return true;
+}
+/** Evaluate a nested and/or tree. */
+function matchesLogical(row, condition) {
+	if (!condition) return true;
+	if ("type" in condition) {
+		const children = condition.conditions ?? [];
+		if (children.length === 0) return true;
+		return condition.type === "or" ? children.some((c) => matchesLogical(row, c)) : children.every((c) => matchesLogical(row, c));
+	}
+	const op = toCanonicalOp(condition.operator) ?? condition.operator;
+	return matchesOperator(row[condition.column], op, condition.value);
+}
+/**
+* Approximate the server's full-text search with a case-insensitive substring
+* scan over the row's own string fields. Narrower than the real thing (no
+* stemming, no configured search columns), and it never matches a field the
+* cached row does not carry — a local list may therefore be missing rows the
+* server would have returned, which is why {@link isExactlyEvaluable} refuses
+* to call a search query exact.
+*/
+function matchesSearch(row, searchString) {
+	if (!searchString) return true;
+	const needle = searchString.trim().toLowerCase();
+	if (!needle) return true;
+	for (const value of Object.values(row)) {
+		if (typeof value === "string" && value.toLowerCase().includes(needle)) return true;
+		if (typeof value === "number" && String(value).includes(needle)) return true;
+	}
+	return false;
+}
+/** Does this row belong in the result set for `params`, ignoring pagination? */
+function matchesParams(row, params) {
+	if (!params) return true;
+	return matchesWhere(row, params.where) && matchesLogical(row, params.logical) && matchesSearch(row, params.searchString);
+}
+/**
+* Sort in place, Postgres-style: nulls last ascending, first descending, with
+* the row id as a tiebreak so paging through an unsorted-but-equal run does
+* not shuffle rows between pages.
+*/
+function sortRows(rows, orderBy) {
+	if (!orderBy) return rows;
+	const [field, direction = "asc"] = orderBy;
+	const sign = direction === "desc" ? -1 : 1;
+	return rows.sort((a, b) => {
+		const av = a[field];
+		const bv = b[field];
+		const aNull = isNullish(toComparable(av));
+		const bNull = isNullish(toComparable(bv));
+		if (aNull || bNull) {
+			if (aNull && bNull) return tiebreak(a, b);
+			return (aNull ? 1 : -1) * (direction === "desc" ? -1 : 1);
+		}
+		const cmp = compareValues(av, bv);
+		if (cmp === void 0 || cmp === 0) return tiebreak(a, b);
+		return cmp * sign;
+	});
+}
+function tiebreak(a, b) {
+	return compareValues(a.id, b.id) ?? 0;
+}
+/** Resolve `page`/`offset`/`limit` the way the server does. */
+function resolvePagination(params) {
+	const limit = params?.limit ?? 20;
+	return {
+		limit,
+		offset: params?.page != null ? Math.max(0, (params.page - 1) * limit) : params?.offset ?? 0
+	};
+}
+/**
+* Can a locally evaluated answer to `params` be trusted to match the server's,
+* assuming the cache holds every row of the collection?
+*
+* `include` pulls in rows from other collections that this evaluator never
+* sees, and `searchString` is only approximated — both make the local answer a
+* best effort rather than an equivalent one.
+*/
+function isExactlyEvaluable(params) {
+	if (!params) return true;
+	if (params.include && params.include.length > 0) return false;
+	if (params.searchString) return false;
+	return true;
+}
+/** Run a full query — filter, sort, paginate — over a set of rows. */
+function runLocalQuery(rows, params) {
+	const matched = rows.filter((row) => matchesParams(row, params));
+	sortRows(matched, params?.orderBy);
+	const { limit, offset } = resolvePagination(params);
+	const page = matched.slice(offset, offset + limit);
+	return {
+		data: page,
+		meta: {
+			total: matched.length,
+			limit,
+			offset,
+			hasMore: offset + page.length < matched.length
+		}
+	};
+}
+function offlineError(message) {
+	return new RebaseApiError(message, {
+		status: 0,
+		code: "offline"
+	});
+}
+function generateOfflineId() {
+	if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
+	return `off-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
+var MISSING = "\0missing";
+var OfflineManager = class {
+	store;
+	maxCachedQueries;
+	maxCachedRows;
+	maxRetries;
+	onSyncError;
+	createInner;
+	inners = /* @__PURE__ */ new Map();
+	connectivity;
+	scope = "anon";
+	/** The local database: normalized rows and query snapshots per collection. */
+	collections = /* @__PURE__ */ new Map();
+	/** In-memory mirror of the current scope's queue, in replay order. */
+	queue = [];
+	queueLoad;
+	/** Serializes enqueues so concurrent writes keep the order the app made them. */
+	enqueueChain = Promise.resolve();
+	flushPromise;
+	queueListeners = /* @__PURE__ */ new Set();
+	statusListeners = /* @__PURE__ */ new Set();
+	observers = /* @__PURE__ */ new Map();
+	refreshPending = /* @__PURE__ */ new Set();
+	revCounter = 0;
+	disposed = false;
+	currentStatus = {
+		online: true,
+		syncing: false,
+		pending: 0
+	};
+	channel;
+	tabId = createMutationId();
+	api;
+	constructor(config, createInner) {
+		this.store = config.store ?? (typeof indexedDB !== "undefined" ? new IndexedDBOfflineStore() : new MemoryOfflineStore());
+		this.maxCachedQueries = config.maxCachedQueriesPerCollection ?? 50;
+		this.maxCachedRows = config.maxCachedRowsPerCollection ?? 5e3;
+		this.maxRetries = config.maxRetries ?? 5;
+		this.onSyncError = config.onSyncError;
+		this.createInner = createInner;
+		const maxBackoffMs = config.syncIntervalMs ?? 6e4;
+		this.connectivity = new ConnectivityMonitor({
+			maxBackoffMs: Math.max(1e3, maxBackoffMs),
+			respectBackoff: maxBackoffMs > 0
+		});
+		if (maxBackoffMs > 0) this.connectivity.onRetryDue = () => {
+			this.sync().catch(() => void 0);
+		};
+		this.connectivity.onChange((online) => {
+			this.patchStatus({ online });
+			if (online) this.revalidateAll();
+		});
+		this.currentStatus.online = this.connectivity.isOnline();
+		if ((config.crossTab ?? this.store instanceof IndexedDBOfflineStore) && typeof BroadcastChannel !== "undefined") try {
+			this.channel = new BroadcastChannel("rebase-offline");
+			this.channel.onmessage = (event) => this.onBroadcast(event.data);
+			this.channel.unref?.();
+		} catch {}
+		this.api = {
+			sync: () => this.sync(),
+			pending: async () => {
+				await this.ensureQueueLoaded();
+				return this.queue.map((m) => structuredClone(m));
+			},
+			status: () => ({ ...this.currentStatus }),
+			onStatusChange: (listener) => {
+				this.statusListeners.add(listener);
+				return () => this.statusListeners.delete(listener);
+			},
+			clear: async () => {
+				await this.store.clear(`${this.scope}|`);
+				this.queue = [];
+				this.resetCollections();
+				this.patchStatus({
+					pending: 0,
+					lastError: void 0
+				});
+				this.notifyQueue();
+				for (const slug of this.observers.keys()) this.notifyCollection(slug, false);
+			},
+			onQueueChange: (listener) => {
+				this.queueListeners.add(listener);
+				return () => this.queueListeners.delete(listener);
+			}
+		};
+	}
+	/**
+	* Cache and queue are partitioned per signed-in user: cached rows are
+	* RLS-filtered for the user who fetched them, and queued writes must
+	* replay under the credentials that made them — so neither may ever leak
+	* across a sign-out/sign-in on a shared browser.
+	*/
+	setScope(uid) {
+		const next = uid || "anon";
+		if (next === this.scope) return;
+		this.scope = next;
+		this.queueLoad = void 0;
+		this.queue = [];
+		this.resetCollections();
+		this.patchStatus({
+			pending: 0,
+			lastError: void 0
+		});
+		this.notifyQueue();
+		for (const slug of this.observers.keys()) this.notifyCollection(slug, false);
+		this.revalidateAll();
+		this.sync().catch(() => void 0);
+	}
+	/**
+	* Throw away every local row, for a scope change or an explicit clear.
+	*
+	* The state objects are replaced rather than emptied, so a load still in
+	* flight for the previous user fails its identity check and discards what
+	* it read instead of grafting it onto the new one. The replacements are
+	* marked ready: nothing needs loading until something asks, and observers
+	* have to be told *now* that the rows they are showing are gone.
+	*/
+	resetCollections() {
+		const slugs = [...this.collections.keys()];
+		this.collections = /* @__PURE__ */ new Map();
+		for (const slug of slugs) this.collections.set(slug, {
+			rows: /* @__PURE__ */ new Map(),
+			snapshots: /* @__PURE__ */ new Map(),
+			fresh: /* @__PURE__ */ new Set(),
+			freshRows: /* @__PURE__ */ new Set(),
+			absent: /* @__PURE__ */ new Set(),
+			ready: true
+		});
+	}
+	/** Release listeners, timers and the cross-tab channel (client.close()). */
+	dispose() {
+		this.disposed = true;
+		this.connectivity.dispose();
+		try {
+			this.channel?.close();
+		} catch {}
+		this.observers.clear();
+		this.queueListeners.clear();
+		this.statusListeners.clear();
+	}
+	wrap(slug, inner) {
+		this.inners.set(slug, inner);
+		const wrapped = {
+			find: async (params) => {
+				const state = await this.ensureCollection(slug);
+				if (this.connectivity.shouldAttempt()) try {
+					const res = await inner.find(params);
+					this.connectivity.markSuccess();
+					await this.ingest(slug, res.data ?? []);
+					const snapshot = this.recordSnapshot(slug, params, res);
+					const answer = this.answer(slug, params, snapshot);
+					this.notifyCollection(slug, false);
+					return {
+						data: answer.data,
+						meta: answer.meta
+					};
+				} catch (error) {
+					if (!isNetworkError(error)) {
+						if (isRetryableError(error) && this.hasLocalAnswer(state, slug, params)) {
+							const answer = this.answer(slug, params, this.snapshotFor(slug, params));
+							return {
+								data: answer.data,
+								meta: answer.meta
+							};
+						}
+						throw error;
+					}
+					this.connectivity.markFailure();
+				}
+				const answer = this.localFind(slug, params);
+				this.notifyCollection(slug, false);
+				return {
+					data: answer.data,
+					meta: answer.meta
+				};
+			},
+			findById: async (id) => {
+				await this.ensureCollection(slug);
+				if (this.connectivity.shouldAttempt()) try {
+					const row = await inner.findById(id);
+					this.connectivity.markSuccess();
+					if (row !== void 0) await this.ingest(slug, [row]);
+					else if (!this.hasPending(slug, id)) this.removeLocalRow(slug, id, true);
+					this.notifyCollection(slug, false);
+					return this.localRow(slug, id);
+				} catch (error) {
+					if (!isNetworkError(error)) throw error;
+					this.connectivity.markFailure();
+				}
+				const local = this.localRow(slug, id);
+				if (local !== void 0 || this.hasPending(slug, id)) return local;
+				if (this.collections.get(slug)?.absent.has(String(id))) return void 0;
+				throw offlineError(`Offline: "${slug}" row ${String(id)} is not in the local database.`);
+			},
+			create: async (data, id) => {
+				await this.ensureCollection(slug);
+				if (this.connectivity.shouldAttempt()) try {
+					const row = await inner.create(data, id);
+					this.connectivity.markSuccess();
+					await this.ingest(slug, [row]);
+					this.notifyCollection(slug);
+					this.scheduleRefresh(slug);
+					return row;
+				} catch (error) {
+					if (!isNetworkError(error)) throw error;
+					this.connectivity.markFailure();
+				}
+				const providedId = id ?? data.id;
+				const rowId = providedId ?? generateOfflineId();
+				const row = {
+					...data,
+					id: rowId
+				};
+				await this.enqueue({
+					collection: slug,
+					type: "create",
+					id: rowId,
+					data: row,
+					generatedId: providedId === void 0,
+					rollback: { rows: { [String(rowId)]: this.rawLocalRow(slug, rowId) ?? null } }
+				});
+				this.setLocalRow(slug, rowId, row);
+				this.notifyCollection(slug);
+				return row;
+			},
+			createMany: async (data, options) => {
+				await this.ensureCollection(slug);
+				if (!Array.isArray(data)) throw new TypeError("createMany expects an array of records.");
+				if (data.length === 0) return [];
+				if (this.connectivity.shouldAttempt()) try {
+					const rows = await inner.createMany(data, options);
+					this.connectivity.markSuccess();
+					await this.ingest(slug, rows);
+					this.notifyCollection(slug);
+					this.scheduleRefresh(slug);
+					return rows;
+				} catch (error) {
+					if (!isNetworkError(error)) throw error;
+					this.connectivity.markFailure();
+				}
+				const rows = data.map((r) => ({
+					...r,
+					id: r.id ?? generateOfflineId()
+				}));
+				const rollback = {};
+				for (const row of rows) {
+					const key = String(row.id);
+					rollback[key] = this.rawLocalRow(slug, row.id) ?? null;
+				}
+				await this.enqueue({
+					collection: slug,
+					type: "createMany",
+					data: rows,
+					upsert: options?.upsert,
+					rollback: { rows: rollback }
+				});
+				for (const row of rows) this.setLocalRow(slug, row.id, row);
+				this.notifyCollection(slug);
+				return rows;
+			},
+			update: async (id, data) => {
+				await this.ensureCollection(slug);
+				if (this.connectivity.shouldAttempt()) try {
+					const row = await inner.update(id, data);
+					this.connectivity.markSuccess();
+					await this.ingest(slug, [row]);
+					this.notifyCollection(slug);
+					return row;
+				} catch (error) {
+					if (!isNetworkError(error)) throw error;
+					this.connectivity.markFailure();
+				}
+				const base = this.rawLocalRow(slug, id);
+				await this.enqueue({
+					collection: slug,
+					type: "update",
+					id,
+					data,
+					rollback: { rows: { [String(id)]: base ?? null } }
+				});
+				const optimistic = {
+					...base ?? {},
+					...data,
+					id
+				};
+				this.setLocalRow(slug, id, optimistic);
+				this.notifyCollection(slug);
+				return optimistic;
+			},
+			delete: async (id) => {
+				await this.ensureCollection(slug);
+				if (this.connectivity.shouldAttempt()) try {
+					await inner.delete(id);
+					this.connectivity.markSuccess();
+					this.removeLocalRow(slug, id, true);
+					this.notifyCollection(slug);
+					this.scheduleRefresh(slug);
+					return;
+				} catch (error) {
+					if (!isNetworkError(error)) throw error;
+					this.connectivity.markFailure();
+				}
+				await this.enqueue({
+					collection: slug,
+					type: "delete",
+					id,
+					rollback: { rows: { [String(id)]: this.rawLocalRow(slug, id) ?? null } }
+				});
+				this.removeLocalRow(slug, id);
+				this.notifyCollection(slug);
+			},
+			count: async (params) => {
+				await this.ensureCollection(slug);
+				if (this.connectivity.shouldAttempt()) try {
+					const n = await inner.count(params);
+					this.connectivity.markSuccess();
+					this.writeCache(this.countKey(slug, params), n);
+					return Math.max(0, n + this.pendingDelta(slug, params));
+				} catch (error) {
+					if (!isNetworkError(error)) throw error;
+					this.connectivity.markFailure();
+				}
+				const cached = await this.readCache(this.countKey(slug, params));
+				if (cached !== void 0) return Math.max(0, cached + this.pendingDelta(slug, params));
+				const state = this.collections.get(slug);
+				if (state && state.rows.size > 0) return runLocalQuery([...state.rows.values()].map((e) => e.row), params).meta.total;
+				throw offlineError(`Offline: no cached count for "${slug}".`);
+			},
+			observe: (params, onResult, onError, options) => this.observe(slug, wrapped, inner, params, onResult, onError, options),
+			observeById: (id, onResult, onError, options) => this.observeById(slug, wrapped, inner, id, onResult, onError, options),
+			where(columnOrCondition, operator, value) {
+				const builder = new SDKQueryBuilder(wrapped);
+				if (typeof columnOrCondition === "object") return builder.where(columnOrCondition);
+				return builder.where(columnOrCondition, operator, value);
+			},
+			orderBy: (column, direction) => new SDKQueryBuilder(wrapped).orderBy(column, direction),
+			limit: (count) => new SDKQueryBuilder(wrapped).limit(count),
+			offset: (count) => new SDKQueryBuilder(wrapped).offset(count),
+			search: (searchString) => new SDKQueryBuilder(wrapped).search(searchString),
+			include: (...relations) => new SDKQueryBuilder(wrapped).include(...relations)
+		};
+		if (inner.listen) wrapped.listen = (params, onUpdate, onError) => inner.listen(params, (response) => {
+			this.ingest(slug, response.data ?? []).then(() => this.notifyCollection(slug, false));
+			onUpdate(response);
+		}, onError);
+		if (inner.listenById) wrapped.listenById = (id, onUpdate, onError) => inner.listenById(id, (row) => {
+			if (row) this.ingest(slug, [row]).then(() => this.notifyCollection(slug, false));
+			onUpdate(row);
+		}, onError);
+		return wrapped;
+	}
+	observe(slug, wrapped, inner, params, onResult, onError, options) {
+		let closed = false;
+		let unlisten;
+		const observer = {
+			slug,
+			params,
+			settled: false,
+			refresh: () => wrapped.find(params).catch(() => void 0),
+			emit: () => {
+				if (closed || !this.collections.get(slug)?.ready) return;
+				const result = this.answer(slug, params, this.snapshotFor(slug, params));
+				const signature = `${result.fromCache ? "c" : "s"}${result.hasPendingWrites ? "p" : "-"}` + this.signature(slug, result.data, result.meta.total);
+				if (observer.settled && signature === observer.signature) return;
+				observer.signature = signature;
+				observer.settled = true;
+				onResult(observer.error ? {
+					...result,
+					error: observer.error
+				} : result);
+			}
+		};
+		this.observersFor(slug).add(observer);
+		(async () => {
+			await this.ensureCollection(slug);
+			if (closed) return;
+			if (this.hasLocalAnswer(this.collections.get(slug), slug, params)) observer.emit();
+			try {
+				await wrapped.find(params);
+				observer.error = void 0;
+			} catch (error) {
+				observer.error = error;
+				if (closed) return;
+				if (!observer.settled) {
+					onError?.(error);
+					return;
+				}
+			}
+			if (!closed) observer.emit();
+		})();
+		if (options?.realtime !== false && inner.listen) unlisten = inner.listen(params, (response) => {
+			this.ingest(slug, response.data ?? []).then(() => {
+				this.recordSnapshot(slug, params, response);
+				this.notifyCollection(slug, false);
+			});
+		}, onError);
+		return () => {
+			closed = true;
+			this.observersFor(slug).delete(observer);
+			unlisten?.();
+		};
+	}
+	observeById(slug, wrapped, inner, id, onResult, onError, options) {
+		let closed = false;
+		let unlisten;
+		const observer = {
+			slug,
+			id,
+			settled: false,
+			refresh: () => wrapped.findById(id).catch(() => void 0),
+			emit: () => {
+				if (closed || !this.collections.get(slug)?.ready) return;
+				const row = this.localRow(slug, id);
+				const entry = this.collections.get(slug)?.rows.get(String(id));
+				const fromCache = !this.collections.get(slug)?.freshRows.has(String(id));
+				const hasPendingWrites = this.hasPending(slug, id);
+				const signature = `${fromCache ? "c" : "s"}${hasPendingWrites ? "p" : "-"}|` + (row === void 0 ? MISSING : `${String(id)}:${entry?.rev ?? 0}`);
+				if (observer.settled && signature === observer.signature) return;
+				observer.signature = signature;
+				observer.settled = true;
+				onResult(row, {
+					fromCache,
+					hasPendingWrites
+				});
+			}
+		};
+		this.observersFor(slug).add(observer);
+		(async () => {
+			await this.ensureCollection(slug);
+			if (closed) return;
+			if (this.localRow(slug, id) !== void 0) observer.emit();
+			try {
+				await wrapped.findById(id);
+			} catch (error) {
+				if (closed) return;
+				if (!observer.settled) {
+					onError?.(error);
+					return;
+				}
+			}
+			if (!closed) observer.emit();
+		})();
+		if (options?.realtime !== false && inner.listenById) unlisten = inner.listenById(id, (row) => {
+			if (!row) {
+				if (!this.hasPending(slug, id)) this.removeLocalRow(slug, id, true);
+				this.notifyCollection(slug, false);
+				return;
+			}
+			this.ingest(slug, [row]).then(() => this.notifyCollection(slug, false));
+		}, onError);
+		return () => {
+			closed = true;
+			this.observersFor(slug).delete(observer);
+			unlisten?.();
+		};
+	}
+	observersFor(slug) {
+		let set = this.observers.get(slug);
+		if (!set) {
+			set = /* @__PURE__ */ new Set();
+			this.observers.set(slug, set);
+		}
+		return set;
+	}
+	/** Cheap change detection: which rows, in what order, at which revision. */
+	signature(slug, rows, total) {
+		const state = this.collections.get(slug);
+		return `${total}|${rows.map((row) => {
+			const key = String(row.id);
+			return `${key}:${state?.rows.get(key)?.rev ?? 0}`;
+		}).join(",")}`;
+	}
+	notifyCollection(slug, broadcast = true) {
+		const set = this.observers.get(slug);
+		if (set) for (const observer of [...set]) observer.emit();
+		if (broadcast) this.broadcast({
+			type: "rows",
+			slugs: [slug]
+		});
+	}
+	/** Connectivity came back (or the user changed): re-read everything live. */
+	revalidateAll() {
+		for (const slug of this.observers.keys()) {
+			this.notifyCollection(slug, false);
+			this.scheduleRefresh(slug);
+		}
+	}
+	collectionState(slug) {
+		let state = this.collections.get(slug);
+		if (!state) {
+			state = {
+				rows: /* @__PURE__ */ new Map(),
+				snapshots: /* @__PURE__ */ new Map(),
+				fresh: /* @__PURE__ */ new Set(),
+				freshRows: /* @__PURE__ */ new Set(),
+				absent: /* @__PURE__ */ new Set(),
+				ready: false
+			};
+			this.collections.set(slug, state);
+		}
+		return state;
+	}
+	ensureCollection(slug) {
+		const state = this.collectionState(slug);
+		if (!state.loaded) {
+			const scope = this.scope;
+			state.loaded = (async () => {
+				await this.ensureQueueLoaded();
+				const [rows, snapshots, absent] = await Promise.all([
+					this.store.listCacheEntries(`${scope}|row|${slug}|`).catch(() => []),
+					this.store.listCacheEntries(`${scope}|q|${slug}|`).catch(() => []),
+					this.store.listCache(`${scope}|abs|${slug}|`).catch(() => [])
+				]);
+				if (this.scope !== scope || this.collections.get(slug) !== state) return;
+				for (const entry of rows) {
+					const row = entry.value;
+					if (!row || row.id === void 0 || row.id === null) continue;
+					state.rows.set(String(row.id), {
+						row: hydrateRow(row),
+						cachedAt: entry.cachedAt,
+						rev: ++this.revCounter
+					});
+				}
+				for (const entry of snapshots) {
+					const key = entry.key.slice(`${scope}|q|${slug}|`.length);
+					if (entry.value) state.snapshots.set(key, entry.value);
+				}
+				for (const entry of absent) state.absent.add(entry.key.slice(`${scope}|abs|${slug}|`.length));
+			})().catch(() => void 0).finally(() => {
+				state.ready = true;
+			});
+		}
+		return state.loaded.then(() => state);
+	}
+	snapshotFor(slug, params) {
+		return this.collections.get(slug)?.snapshots.get(buildQueryString(params));
+	}
+	hasLocalAnswer(state, slug, params) {
+		if (!state) return false;
+		return state.snapshots.has(buildQueryString(params)) || state.rows.size > 0;
+	}
+	/**
+	* Answer a query from the local database.
+	*
+	* With a snapshot, the server's own page — its ids, order and total — is
+	* the skeleton, and the local rows fill it in: rows deleted locally drop
+	* out, rows edited locally show the edit, and rows *created* locally join
+	* the first page if they match. Without one, the query is evaluated
+	* outright over every cached row, which is the best that can be done for a
+	* query the server has never answered here.
+	*/
+	answer(slug, params, snapshot) {
+		const state = this.collections.get(slug);
+		const exact = isExactlyEvaluable(params);
+		const fromCache = !state?.fresh.has(buildQueryString(params));
+		if (!state) return {
+			data: [],
+			meta: {
+				total: 0,
+				limit: params?.limit ?? 20,
+				offset: params?.offset ?? 0,
+				hasMore: false
+			},
+			fromCache: true,
+			hasPendingWrites: false,
+			partial: true
+		};
+		if (!snapshot) {
+			const local = runLocalQuery([...state.rows.values()].map((e) => e.row), params);
+			return {
+				...local,
+				fromCache,
+				hasPendingWrites: local.data.some((row) => this.hasPending(slug, row.id)),
+				partial: true
+			};
+		}
+		const rows = [];
+		const seen = /* @__PURE__ */ new Set();
+		/** Rows the server counted that we know are no longer in the result. */
+		let removed = 0;
+		for (const id of snapshot.ids) {
+			const key = String(id);
+			const entry = state.rows.get(key);
+			if (!entry) {
+				if (state.absent.has(key) || this.hasPending(slug, key)) removed++;
+				continue;
+			}
+			if (exact && this.hasPending(slug, key) && !matchesParams(entry.row, params)) {
+				removed++;
+				continue;
+			}
+			rows.push(entry.row);
+			seen.add(key);
+		}
+		let added = 0;
+		const offset = snapshot.offset ?? 0;
+		if (exact && offset === 0) {
+			for (const [key, entry] of state.rows) {
+				if (seen.has(key) || !this.hasPending(slug, key)) continue;
+				if (!this.isLocallyCreated(slug, key)) continue;
+				if (!matchesParams(entry.row, params)) continue;
+				rows.push(entry.row);
+				added++;
+			}
+			if (added > 0 && params?.orderBy) sortRows(rows, params.orderBy);
+		}
+		return {
+			data: rows,
+			meta: {
+				total: Math.max(rows.length, snapshot.total - removed + added),
+				limit: snapshot.limit,
+				offset,
+				hasMore: snapshot.hasMore
+			},
+			fromCache,
+			hasPendingWrites: rows.some((row) => this.hasPending(slug, row.id)),
+			partial: !exact
+		};
+	}
+	localFind(slug, params) {
+		const state = this.collections.get(slug);
+		const snapshot = this.snapshotFor(slug, params);
+		state?.fresh.delete(buildQueryString(params));
+		if (!snapshot && (!state || state.rows.size === 0)) throw offlineError(`Offline: no cached data for "${slug}".`);
+		const answer = this.answer(slug, params, snapshot);
+		return snapshot ? answer : {
+			...answer,
+			partial: true
+		};
+	}
+	rawLocalRow(slug, id) {
+		const entry = this.collections.get(slug)?.rows.get(String(id));
+		return entry ? { ...entry.row } : void 0;
+	}
+	localRow(slug, id) {
+		return this.collections.get(slug)?.rows.get(String(id))?.row;
+	}
+	setLocalRow(slug, id, row) {
+		const state = this.collectionState(slug);
+		const key = String(id);
+		const cachedAt = Date.now();
+		state.rows.set(key, {
+			row: { ...row },
+			cachedAt,
+			rev: ++this.revCounter
+		});
+		state.freshRows.delete(key);
+		this.forgetTombstone(slug, key);
+		this.writeCache(this.rowKey(slug, key), dehydrateRow(row), cachedAt);
+		this.evictRows(slug);
+	}
+	/**
+	* Drop a row and, when the server is the one saying it is gone, remember
+	* that. "I looked it up and it does not exist" is real knowledge: without
+	* it, opening a deleted row while offline would report a missing local
+	* database instead of a missing row.
+	*/
+	removeLocalRow(slug, id, known = false) {
+		const state = this.collectionState(slug);
+		const key = String(id);
+		const existed = state.rows.delete(key);
+		if (known) {
+			state.absent.add(key);
+			state.freshRows.add(key);
+			this.writeCache(this.absentKey(slug, key), true);
+		} else state.freshRows.delete(key);
+		if (existed) this.deleteCache([this.rowKey(slug, key)]);
+	}
+	forgetTombstone(slug, key) {
+		if (!this.collectionState(slug).absent.delete(key)) return;
+		this.deleteCache([this.absentKey(slug, key)]);
+	}
+	/**
+	* Merge server rows into the local database. A row with unsynced local
+	* writes keeps them: the server's copy is the base the queued mutations
+	* are re-applied to, not a replacement for what the user did.
+	*
+	* Rows that came back unchanged keep their identity and revision, so a
+	* refetch that changed nothing does not re-render every live query that
+	* touches them — or rewrite them all to disk.
+	*/
+	async ingest(slug, rows) {
+		if (rows.length === 0) return;
+		const state = await this.ensureCollection(slug);
+		const cachedAt = Date.now();
+		const writes = [];
+		const deletes = [];
+		for (const raw of rows) {
+			if (!raw || raw.id === void 0 || raw.id === null) continue;
+			const key = String(raw.id);
+			const merged = this.hasPending(slug, key) ? this.applyPendingToRow(slug, key, { ...raw }) : { ...raw };
+			if (merged === void 0) {
+				state.rows.delete(key);
+				deletes.push(this.rowKey(slug, key));
+				continue;
+			}
+			this.forgetTombstone(slug, key);
+			state.freshRows.add(key);
+			const existing = state.rows.get(key);
+			if (existing && JSON.stringify(existing.row) === JSON.stringify(merged)) {
+				existing.cachedAt = cachedAt;
+				continue;
+			}
+			state.rows.set(key, {
+				row: merged,
+				cachedAt,
+				rev: ++this.revCounter
+			});
+			writes.push({
+				key: this.rowKey(slug, key),
+				entry: {
+					value: dehydrateRow(merged),
+					cachedAt
+				}
+			});
+		}
+		if (writes.length > 0) this.store.setCacheMany(writes).catch(() => void 0);
+		if (deletes.length > 0) this.deleteCache(deletes);
+		this.evictRows(slug);
+	}
+	/**
+	* Fold the queued mutations for one row over a base, newest last.
+	* `afterMutationId` skips everything up to and including that mutation,
+	* which is how a just-replayed write avoids being applied on top of the
+	* server's response to it.
+	*/
+	applyPendingToRow(slug, idKey, base, afterMutationId) {
+		let row = base;
+		let skipping = afterMutationId !== void 0;
+		for (const op of this.queue) {
+			if (skipping) {
+				if (op.mutationId === afterMutationId) skipping = false;
+				continue;
+			}
+			if (op.collection !== slug) continue;
+			if (op.type === "createMany") {
+				const match = op.data?.find((r) => String(r.id) === idKey);
+				if (match) row = { ...match };
+				continue;
+			}
+			if (op.id === void 0 || String(op.id) !== idKey) continue;
+			if (op.type === "create") row = { ...op.data };
+			else if (op.type === "update") row = {
+				...row ?? {},
+				...op.data,
+				id: op.id
+			};
+			else if (op.type === "delete") row = void 0;
+		}
+		return row;
+	}
+	recordSnapshot(slug, params, result) {
+		const meta = result.meta ?? {
+			total: result.data?.length ?? 0,
+			limit: 20,
+			offset: 0,
+			hasMore: false
+		};
+		const snapshot = {
+			ids: (result.data ?? []).map((row) => row.id).filter((id) => id !== void 0),
+			total: meta.total ?? result.data?.length ?? 0,
+			limit: meta.limit ?? params?.limit ?? 20,
+			offset: meta.offset ?? params?.offset ?? 0,
+			hasMore: meta.hasMore ?? false
+		};
+		const state = this.collectionState(slug);
+		const key = buildQueryString(params);
+		state.snapshots.set(key, snapshot);
+		state.fresh.add(key);
+		this.writeCache(`${this.scope}|q|${slug}|${key}`, snapshot);
+		this.evictSnapshots(slug);
+		return snapshot;
+	}
+	/**
+	* A write changed which rows belong in a list, and only the server can say
+	* how — a row it generated is in no cached page, and the totals moved.
+	* Re-run every live query on the collection; queries nobody is watching
+	* are corrected by their next `find`.
+	*
+	* Coalesced per microtask so a burst of writes costs one round trip, and
+	* skipped entirely while offline, where the local database is already the
+	* best answer available.
+	*/
+	scheduleRefresh(slug) {
+		if (this.refreshPending.has(slug)) return;
+		const observers = this.observers.get(slug);
+		if (!observers || observers.size === 0) return;
+		this.refreshPending.add(slug);
+		Promise.resolve().then(() => {
+			this.refreshPending.delete(slug);
+			if (this.disposed || !this.connectivity.shouldAttempt()) return;
+			for (const observer of [...this.observers.get(slug) ?? []]) observer.refresh();
+		});
+	}
+	evictRows(slug) {
+		const state = this.collections.get(slug);
+		if (!state || state.rows.size <= this.maxCachedRows) return;
+		const evictable = [...state.rows.entries()].filter(([key]) => !this.hasPending(slug, key)).sort((a, b) => a[1].cachedAt - b[1].cachedAt);
+		const excess = state.rows.size - this.maxCachedRows;
+		const doomed = evictable.slice(0, excess);
+		for (const [key] of doomed) state.rows.delete(key);
+		if (doomed.length > 0) this.deleteCache(doomed.map(([key]) => this.rowKey(slug, key)));
+		if (state.absent.size > this.maxCachedRows) {
+			const stale = [...state.absent].slice(0, state.absent.size - this.maxCachedRows);
+			for (const key of stale) state.absent.delete(key);
+			this.deleteCache(stale.map((key) => this.absentKey(slug, key)));
+		}
+	}
+	evictSnapshots(slug) {
+		const state = this.collections.get(slug);
+		if (!state || state.snapshots.size <= this.maxCachedQueries) return;
+		const excess = state.snapshots.size - this.maxCachedQueries;
+		const doomed = [...state.snapshots.keys()].slice(0, excess);
+		for (const key of doomed) state.snapshots.delete(key);
+		this.deleteCache(doomed.map((key) => `${this.scope}|q|${slug}|${key}`));
+	}
+	ensureQueueLoaded() {
+		if (!this.queueLoad) {
+			const scope = this.scope;
+			this.queueLoad = this.store.listQueue(`${scope}|`).then((queue) => {
+				if (this.scope !== scope) return;
+				this.queue = queue;
+				this.patchStatus({ pending: queue.length });
+				this.notifyQueue();
+			}).catch(() => void 0);
+		}
+		return this.queueLoad;
+	}
+	enqueue(mutation) {
+		const result = this.enqueueChain.then(async () => {
+			await this.ensureQueueLoaded();
+			if (mutation.type === "update") {
+				const tail = this.queue[this.queue.length - 1];
+				if (tail && tail.collection === mutation.collection && (tail.type === "create" || tail.type === "update") && tail.id === mutation.id) {
+					tail.data = {
+						...tail.data,
+						...mutation.data,
+						id: tail.id
+					};
+					await this.store.enqueue(this.queueKey(tail), tail);
+					return;
+				}
+			}
+			if (mutation.type === "delete") {
+				if (this.queue.some((m) => m.collection === mutation.collection && m.type === "create" && m.id === mutation.id && m.generatedId === true)) {
+					const doomed = this.queue.filter((m) => m.collection === mutation.collection && m.id === mutation.id && (m.type === "create" || m.type === "update"));
+					for (const op of doomed) await this.store.dequeue(this.queueKey(op));
+					this.queue = this.queue.filter((m) => !doomed.includes(m));
+					this.afterQueueChange();
+					return;
+				}
+			}
+			const full = {
+				...mutation,
+				mutationId: createMutationId(),
+				queuedAt: Date.now()
+			};
+			await this.store.enqueue(this.queueKey(full), full);
+			this.queue.push(full);
+			this.afterQueueChange();
+		});
+		this.enqueueChain = result.catch(() => void 0);
+		return result;
+	}
+	hasPending(slug, id) {
+		const key = String(id);
+		return this.queue.some((op) => {
+			if (op.collection !== slug) return false;
+			if (op.type === "createMany") return op.data?.some((r) => String(r.id) === key) ?? false;
+			return op.id !== void 0 && String(op.id) === key;
+		});
+	}
+	/** Is this row one the server has never been told about? */
+	isLocallyCreated(slug, idKey) {
+		return this.queue.some((op) => {
+			if (op.collection !== slug) return false;
+			if (op.type === "create") return op.id !== void 0 && String(op.id) === idKey;
+			if (op.type === "createMany") return op.data?.some((r) => String(r.id) === idKey) ?? false;
+			return false;
+		});
+	}
+	/** How many rows the queue adds to (or removes from) a server-side count. */
+	pendingDelta(slug, params) {
+		if (!isExactlyEvaluable(params)) return 0;
+		let delta = 0;
+		for (const op of this.queue) {
+			if (op.collection !== slug) continue;
+			if (op.type === "create") {
+				if (matchesParams(op.data, params)) delta++;
+			} else if (op.type === "createMany") {
+				for (const row of op.data ?? []) if (matchesParams(row, params)) delta++;
+			} else if (op.type === "delete") {
+				const before = op.rollback?.rows?.[String(op.id)];
+				if (before && matchesParams(before, params)) delta--;
+			}
+		}
+		return delta;
+	}
+	sync() {
+		if (this.flushPromise) return this.flushPromise;
+		this.flushPromise = this.withLock(() => this.flush()).finally(() => {
+			this.flushPromise = void 0;
+		});
+		return this.flushPromise;
+	}
+	async flush() {
+		await this.ensureQueueLoaded();
+		await this.reloadQueue();
+		if (this.queue.length === 0) return {
+			flushed: 0,
+			remaining: 0
+		};
+		this.patchStatus({ syncing: true });
+		const touched = /* @__PURE__ */ new Set();
+		const queuedAtStart = this.queue.length;
+		let flushed = 0;
+		try {
+			while (this.queue.length > 0 && !this.disposed) {
+				const op = this.queue[0];
+				touched.add(op.collection);
+				try {
+					await this.replay(op);
+				} catch (error) {
+					if (isNetworkError(error)) {
+						this.connectivity.markFailure();
+						break;
+					}
+					op.attempts = (op.attempts ?? 0) + 1;
+					op.lastError = error?.message ?? String(error);
+					if (isRetryableError(error) && op.attempts < this.maxRetries) {
+						await this.store.enqueue(this.queueKey(op), op).catch(() => void 0);
+						this.connectivity.deferRetry();
+						this.patchStatus({ lastError: op.lastError });
+						break;
+					}
+					await this.rejectMutation(op, error);
+					continue;
+				}
+				this.connectivity.markSuccess();
+				await this.drop(op);
+				flushed++;
+			}
+		} finally {
+			this.patchStatus({ syncing: false });
+		}
+		if (this.queue.length !== queuedAtStart) {
+			for (const slug of touched) {
+				this.notifyCollection(slug);
+				this.scheduleRefresh(slug);
+			}
+			this.broadcast({ type: "queue" });
+		}
+		if (this.queue.length === 0) this.patchStatus({ lastSyncedAt: Date.now() });
+		return {
+			flushed,
+			remaining: this.queue.length
+		};
+	}
+	async replay(op) {
+		const inner = this.innerFor(op.collection);
+		if (op.type === "create") {
+			const row = await inner.create(op.data);
+			await this.adoptServerRow(op, op.id, row);
+		} else if (op.type === "createMany") {
+			const queued = op.data ?? [];
+			const rows = await inner.createMany(queued, op.upsert ? { upsert: true } : void 0);
+			for (let i = 0; i < rows.length; i++) await this.adoptServerRow(op, queued[i]?.id, rows[i]);
+		} else if (op.type === "update") {
+			const row = await inner.update(op.id, op.data);
+			await this.ingestReplaced(op, op.id, row);
+		} else if (op.type === "delete") {
+			await inner.delete(op.id);
+			this.removeLocalRow(op.collection, op.id, true);
+		}
+	}
+	/**
+	* Take the server's version of a row the client created offline.
+	*
+	* The server may have assigned a different id — a serial column ignores
+	* the id we invented — in which case every local trace of the temporary id
+	* has to move with it, including queued writes that were made against it
+	* before it was ever sent.
+	*/
+	async adoptServerRow(op, localId, row) {
+		if (!row) return;
+		const slug = op.collection;
+		const serverId = row.id;
+		if (localId !== void 0 && serverId !== void 0 && String(serverId) !== String(localId)) {
+			const oldKey = String(localId);
+			this.removeLocalRow(slug, localId);
+			for (const queued of this.queue) {
+				if (queued.collection !== slug) continue;
+				let dirty = false;
+				if (queued.id !== void 0 && String(queued.id) === oldKey) {
+					queued.id = serverId;
+					if (queued.data && !Array.isArray(queued.data)) queued.data.id = serverId;
+					dirty = true;
+				}
+				const rollbackRows = queued.rollback?.rows;
+				if (rollbackRows && oldKey in rollbackRows) {
+					rollbackRows[String(serverId)] = rollbackRows[oldKey];
+					delete rollbackRows[oldKey];
+					dirty = true;
+				}
+				if (dirty) await this.store.enqueue(this.queueKey(queued), queued).catch(() => void 0);
+			}
+		}
+		await this.ingestReplaced(op, serverId ?? localId, row);
+	}
+	/**
+	* Write a server row over the local one, ignoring the mutation that just
+	* produced it — re-applying that would put the pre-server values back on
+	* top of the server's answer — but keeping every write queued *after* it.
+	* Those are still unsent, and dropping them here would make the row snap
+	* back to the server's version in front of the user, only to change again
+	* when they replay a moment later.
+	*/
+	async ingestReplaced(op, id, row) {
+		const slug = op.collection;
+		const state = await this.ensureCollection(slug);
+		const key = String(id);
+		const merged = this.applyPendingToRow(slug, key, { ...row }, op.mutationId);
+		if (merged === void 0) {
+			this.removeLocalRow(slug, key);
+			return;
+		}
+		const cachedAt = Date.now();
+		state.rows.set(key, {
+			row: merged,
+			cachedAt,
+			rev: ++this.revCounter
+		});
+		if (this.applyPendingToRow(slug, key, void 0, op.mutationId) === void 0) state.freshRows.add(key);
+		this.writeCache(this.rowKey(slug, key), dehydrateRow(merged), cachedAt);
+	}
+	/**
+	* The server refused a mutation. Put back what it changed, and discard the
+	* queued writes that were built on top of it: an edit to a row whose
+	* creation was rejected can only fail the same way, and applying it would
+	* leave the local database claiming a row the server does not have.
+	*
+	* The cascade stops the moment a later write stops *depending* on the
+	* rejected one. An `update` reads the row it edits, so it is doomed with
+	* it; a `create` overwrites the row outright and a `delete` needs nothing
+	* of it, so both stand on their own and are kept — dropping them would
+	* silently lose writes the server would have accepted.
+	*/
+	async rejectMutation(op, error) {
+		const ids = new Set(Object.keys(op.rollback?.rows ?? {}));
+		if (op.id !== void 0) ids.add(String(op.id));
+		const doomed = [op];
+		const orphaned = new Set(ids);
+		const position = this.queue.indexOf(op);
+		for (const later of this.queue.slice(position + 1)) {
+			if (later.collection !== op.collection) continue;
+			const hit = this.idsOf(later).filter((id) => orphaned.has(id));
+			if (hit.length === 0) continue;
+			if (later.type === "update") doomed.push(later);
+			else for (const id of hit) orphaned.delete(id);
+		}
+		for (const dropped of doomed) await this.drop(dropped);
+		for (const [idKey, previous] of Object.entries(op.rollback?.rows ?? {})) {
+			const restored = this.applyPendingToRow(op.collection, idKey, previous ?? void 0);
+			if (restored === void 0) this.removeLocalRow(op.collection, idKey);
+			else this.setLocalRow(op.collection, idKey, restored);
+		}
+		this.patchStatus({ lastError: error.message });
+		this.notifyCollection(op.collection);
+		this.scheduleRefresh(op.collection);
+		for (const dropped of doomed) this.onSyncError?.(error, dropped);
+	}
+	/** Every row id a mutation writes to. */
+	idsOf(op) {
+		if (op.type === "createMany") return (op.data ?? []).map((r) => String(r.id));
+		return op.id === void 0 ? [] : [String(op.id)];
+	}
+	async drop(op) {
+		await this.store.dequeue(this.queueKey(op)).catch(() => void 0);
+		this.queue = this.queue.filter((m) => m.mutationId !== op.mutationId);
+		this.afterQueueChange(false);
+	}
+	/** Replay uses unwrapped clients: a failure must never re-enqueue itself. */
+	innerFor(slug) {
+		let inner = this.inners.get(slug);
+		if (!inner) {
+			inner = this.createInner(slug);
+			this.inners.set(slug, inner);
+		}
+		return inner;
+	}
+	async withLock(fn) {
+		const locks = globalThis.navigator?.locks;
+		if (!locks?.request) return fn();
+		try {
+			return await locks.request(`rebase-offline-sync:${this.scope}`, fn);
+		} catch {
+			return fn();
+		}
+	}
+	broadcast(message) {
+		if (!this.channel) return;
+		try {
+			this.channel.postMessage({
+				...message,
+				scope: this.scope,
+				sender: this.tabId
+			});
+		} catch {}
+	}
+	onBroadcast(message) {
+		if (this.disposed || !message || typeof message !== "object") return;
+		const msg = message;
+		if (msg.sender === this.tabId || msg.scope !== this.scope) return;
+		if (msg.type === "rows") for (const slug of msg.slugs ?? []) this.reloadCollection(slug);
+		else if (msg.type === "queue") this.reloadQueue();
+	}
+	/** Re-read one collection from the store, replacing what is in memory. */
+	async reloadCollection(slug) {
+		const state = this.collections.get(slug);
+		if (!state?.loaded) return;
+		await this.reloadQueue();
+		const scope = this.scope;
+		const [rows, snapshots, absent] = await Promise.all([
+			this.store.listCacheEntries(`${scope}|row|${slug}|`).catch(() => []),
+			this.store.listCacheEntries(`${scope}|q|${slug}|`).catch(() => []),
+			this.store.listCache(`${scope}|abs|${slug}|`).catch(() => [])
+		]);
+		if (this.scope !== scope || this.collections.get(slug) !== state) return;
+		const next = /* @__PURE__ */ new Map();
+		for (const entry of rows) {
+			const row = entry.value;
+			if (!row || row.id === void 0 || row.id === null) continue;
+			const key = String(row.id);
+			const existing = state.rows.get(key);
+			const hydrated = hydrateRow(row);
+			const unchanged = existing && JSON.stringify(existing.row) === JSON.stringify(hydrated);
+			next.set(key, {
+				row: hydrated,
+				cachedAt: entry.cachedAt,
+				rev: unchanged ? existing.rev : ++this.revCounter
+			});
+		}
+		state.rows = next;
+		state.snapshots = /* @__PURE__ */ new Map();
+		for (const entry of snapshots) {
+			const key = entry.key.slice(`${scope}|q|${slug}|`.length);
+			if (entry.value) state.snapshots.set(key, entry.value);
+		}
+		state.absent = new Set(absent.map((entry) => entry.key.slice(`${scope}|abs|${slug}|`.length)));
+		this.notifyCollection(slug, false);
+	}
+	async reloadQueue() {
+		const scope = this.scope;
+		const queue = await this.store.listQueue(`${scope}|`).catch(() => void 0);
+		if (!queue || this.scope !== scope) return;
+		this.queue = queue;
+		this.afterQueueChange(false);
+	}
+	afterQueueChange(broadcast = true) {
+		this.patchStatus({ pending: this.queue.length });
+		this.notifyQueue();
+		if (broadcast) this.broadcast({ type: "queue" });
+	}
+	notifyQueue() {
+		for (const listener of this.queueListeners) listener(this.queue.length);
+	}
+	patchStatus(patch) {
+		let changed = false;
+		for (const [key, value] of Object.entries(patch)) if (this.currentStatus[key] !== value) {
+			this.currentStatus[key] = value;
+			changed = true;
+		}
+		if (!changed) return;
+		const snapshot = { ...this.currentStatus };
+		for (const listener of this.statusListeners) listener(snapshot);
+	}
+	countKey(slug, params) {
+		return `${this.scope}|count|${slug}|${buildQueryString(params)}`;
+	}
+	rowKey(slug, id) {
+		return `${this.scope}|row|${slug}|${String(id)}`;
+	}
+	absentKey(slug, id) {
+		return `${this.scope}|abs|${slug}|${String(id)}`;
+	}
+	queueKey(mutation) {
+		return `${this.scope}|${mutation.mutationId}`;
+	}
+	async readCache(key) {
+		try {
+			return (await this.store.getCache(key))?.value;
+		} catch {
+			return;
+		}
+	}
+	async writeCache(key, value, cachedAt = Date.now()) {
+		try {
+			await this.store.setCache(key, {
+				value,
+				cachedAt
+			});
+		} catch {}
+	}
+	async deleteCache(keys) {
+		try {
+			await this.store.deleteCache(keys);
+		} catch {}
+	}
+};
+/**
 * Derive a WebSocket URL from an HTTP base URL.
 * `http://` → `ws://`, `https://` → `wss://`.
 */
@@ -17755,10 +19804,20 @@ function createRebaseClient(options) {
 			if (diffs <= 1) return key;
 		}
 	}
+	const offlineManager = options.offline ? new OfflineManager(typeof options.offline === "object" ? options.offline : {}, (slug) => createCollectionClient(transport, slug)) : void 0;
+	if (offlineManager) {
+		offlineManager.setScope(auth.getSession()?.user?.uid);
+		auth.onAuthStateChange((event, session) => {
+			offlineManager.setScope(event === "SIGNED_OUT" ? void 0 : session?.user?.uid);
+		});
+	}
 	const collectionClients = /* @__PURE__ */ new Map();
 	let untypedWarned = false;
 	function collection(slug) {
-		if (!collectionClients.has(slug)) collectionClients.set(slug, createCollectionClient(transport, slug, ws));
+		if (!collectionClients.has(slug)) {
+			const inner = createCollectionClient(transport, slug, ws);
+			collectionClients.set(slug, offlineManager ? offlineManager.wrap(slug, inner) : inner);
+		}
 		return collectionClients.get(slug);
 	}
 	const dataProxy = new Proxy({ collection }, { get(_target, prop) {
@@ -17822,6 +19881,7 @@ channel: (name, options) => {
 			for (const channel of realtimeChannels.values()) channel.leave();
 			realtimeChannels.clear();
 			ws?.disconnect(true);
+			offlineManager?.dispose();
 		},
 		setToken: transport.setToken,
 		setAuthTokenGetter: transport.setAuthTokenGetter,
@@ -17837,7 +19897,8 @@ channel: (name, options) => {
 			});
 			return res.data ?? res;
 		},
-		data: dataProxy
+		data: dataProxy,
+		...offlineManager ? { offline: offlineManager.api } : {}
 	};
 }
 //#endregion
@@ -19779,7 +21840,7 @@ var authJwt = () => {
 * avoids the need for hardcoded dev secrets.
 */
 function generateSecret(bytes = 48) {
-	return crypto.randomBytes(bytes).toString("hex");
+	return crypto$1.randomBytes(bytes).toString("hex");
 }
 /**
 * Zod coercion helper: transforms `"true"` → `true`, everything else → `false`.
@@ -19837,7 +21898,7 @@ var rebaseEnvSchema = object({
 	ADMIN_CONNECTION_STRING: string().url().optional(),
 	JWT_SECRET: string().min(32, "JWT_SECRET must be at least 32 characters long"),
 	JWT_ACCESS_EXPIRES_IN: string().default("1h"),
-	JWT_REFRESH_EXPIRES_IN: string().default("30d"),
+	JWT_REFRESH_EXPIRES_IN: string().default("400d"),
 	GOOGLE_CLIENT_ID: string().optional(),
 	GOOGLE_CLIENT_SECRET: string().optional(),
 	REBASE_SERVICE_KEY: string().optional(),