@spooky-sync/core 0.0.1-canary.240 → 0.0.1-canary.241

package/dist/index.d.ts

@@ -1,14 +1,98 @@
-import { A as ServerViewMeta, B as TimingPhase, C as QueryTimings, D as RecordVersionDiff, E as RecordVersionArray, F as StorageHealthStatus, G as DatabaseEventSystem, H as UpEvent, I as StoreType, J as SyncEventSystem, K as DatabaseEventTypes, L as SyncHealth, M as Sp00kyQueryResult, N as Sp00kyQueryResultPromise, O as RegistrationTimings, P as StorageHealth, R as SyncHealthConfig, S as QueryTimeToLive, T as ReconnectConfig, U as LocalStore, V as UpdateOptions, W as SealedQuery, X as EventSystem, Y as EventDefinition, _ as QueryConfigRecord, a as MATERIALIZATION_SAMPLE_WINDOW, b as QueryStatus, c as MutationEvent, d as PhaseStat, f as PinoTransmit, g as QueryConfig, h as QueryAuthorityCallback, i as Level, j as Sp00kyConfig, k as RunOptions, l as MutationEventType, m as PreloadRefresh, n as DebounceOptions, o as MembershipOutcome, p as PreloadOptions, q as Logger$1, r as EventSubscriptionOptions, s as MutationCallback, t as ConnectionState, u as PersistenceClient, v as QueryHash, w as QueryUpdateCallback, x as QueryStatusCallback, y as QueryState, z as SyncHealthStatus } from "./types.js";
+import { A as ServerViewMeta, B as TimingPhase, C as QueryTimings, D as RecordVersionDiff, E as RecordVersionArray, F as StorageHealthStatus, G as SealedQuery, H as LocalStore, I as StoreType, K as EventDefinition, L as SyncHealth, M as Sp00kyQueryResult, N as Sp00kyQueryResultPromise, O as RegistrationTimings, P as StorageHealth, R as SyncHealthConfig, S as QueryTimeToLive, T as ReconnectConfig, U as DatabaseEventSystem, V as UpdateOptions, W as DatabaseEventTypes, _ as QueryConfigRecord, a as MATERIALIZATION_SAMPLE_WINDOW, b as QueryStatus, c as MutationEvent, d as PhaseStat, f as PinoTransmit, g as QueryConfig, h as QueryAuthorityCallback, i as Level, j as Sp00kyConfig, k as RunOptions, l as MutationEventType, m as PreloadRefresh, n as DebounceOptions, o as MembershipOutcome, p as PreloadOptions, q as EventSystem, r as EventSubscriptionOptions, s as MutationCallback, t as ConnectionState, u as PersistenceClient, v as QueryHash, w as QueryUpdateCallback, x as QueryStatusCallback, y as QueryState, z as SyncHealthStatus } from "./types.js";
+import { AccessDefinition, BackendNames, BackendRoutes, BucketNames, ColumnSchema, FinalQuery, GetTable, QueryBuilder, QueryOptions, QueryPlan, RecordId, RoutePayload, SchemaStructure, TableModel, TableNames, TypeNameToTypeMap } from "@spooky-sync/query-builder";
 import * as surrealdb0 from "surrealdb";
-import { Duration, RecordId, Surreal as Surreal$1, SurrealEvents, SurrealTransaction } from "surrealdb";
-import { AccessDefinition, BackendNames, BackendRoutes, BucketNames, ColumnSchema, FinalQuery, GetTable, QueryBuilder, QueryOptions, QueryPlan, RoutePayload, SchemaStructure, TableModel, TableNames, TypeNameToTypeMap } from "@spooky-sync/query-builder";
-import { Logger } from "pino";
+import { Duration, RecordId as RecordId$1, Surreal, SurrealEvents, SurrealTransaction } from "surrealdb";
+import { Level as Level$1, Logger } from "pino";
 import { decode, encode, isBlurhashValid } from "blurhash";
 import { LoroDoc } from "loro-crdt";
 
+//#region src/services/tabs/protocol.d.ts
+
+type TabId = string;
+type TabRole$1 = 'solo' | 'leader' | 'follower';
+/** Broker pings every tab at this cadence. */
+
+/** Matches `CacheIngestTuple` (modules/cache): exactly what `ingestMany`
+ *  consumes, so relayed batches feed follower circuits without reshaping. */
+interface IngestTuple {
+  table: string;
+  op: 'CREATE' | 'UPDATE' | 'DELETE';
+  id: string;
+  record: Record<string, unknown>;
+}
+type FollowerToLeaderMessage = {
+  type: 'sync-hello';
+  tabId: TabId;
+}
+/** The follower committed an outbox row (through the shared store) and the
+ *  leader should drain it. Idempotent; a new leader's loadFromDatabase is
+ *  the backstop for a notify lost in a failover window. */ | {
+  type: 'mutation-enqueued';
+  mutationId: string;
+} | {
+  type: 'request-poll';
+}
+/** An optimistic write this follower committed to the SHARED store and
+ *  ingested into its own circuit. The leader ingests it (no DB write, the
+ *  row is already there) and fans it out to every OTHER follower as
+ *  `ingest-relay`, so a follower's write lands in every tab in one hop
+ *  instead of after the server round-trip. */ | {
+  type: 'ingest';
+  tuples: IngestTuple[];
+};
+type LeaderToFollowerMessage = {
+  type: 'db-ready';
+  leadershipId: number;
+  bucketId: string;
+  storageHealth: StorageHealth;
+}
+/** Every ingest the leader's CacheModule committed, so follower circuits
+ *  stay live without their own fetch. seq detects gaps. */ | {
+  type: 'ingest-relay';
+  tuples: IngestTuple[];
+  leadershipId: number;
+  seq: number;
+}
+/** A `_00_list_ref` LIVE event, relayed verbatim. Each follower resolves the
+ *  queryId against its own DataModule and ignores foreign queries. */ | {
+  type: 'list-ref-change';
+  action: 'CREATE' | 'UPDATE' | 'DELETE';
+  queryId: string;
+  recordId: string;
+  version: number;
+  parent: boolean;
+}
+/** The leader's drain rolled back a mutation owned by this tab. */ | {
+  type: 'mutation-rolled-back';
+  mutationId: string;
+  recordId: string;
+  eventType: 'create' | 'update' | 'delete';
+  error: string;
+}
+/** The leader's drain pushed a mutation and deleted its outbox row from the
+ *  SHARED store. Every follower keeps the row in its overlay until its
+ *  `_00_list_ref` membership arrives. */ | {
+  type: 'mutation-settled';
+  mutationId: string;
+  recordId: string;
+  eventType: 'create' | 'update' | 'delete';
+}
+/** The leader's LIVE saw edges of these queries change; followers re-read
+ *  membership for the ones they hold. */ | {
+  type: 'membership-dirty';
+  hashes: string[];
+}
+/** The failed-writes tray changed size on the shared store. */ | {
+  type: 'failed-mutations-changed';
+  count: number;
+};
+//#endregion
+//#region src/services/logger/index.d.ts
+type Logger$1 = Logger;
+//#endregion
 //#region src/services/database/database.d.ts
 declare abstract class AbstractDatabaseService {
-  protected client: Surreal$1;
+  protected client: Surreal;
   protected logger: Logger$1;
   protected events: DatabaseEventSystem;
   /**
@@ -25,9 +109,9 @@ declare abstract class AbstractDatabaseService {
    *  load-bearing either way: `classifySyncError` keys off it. */
   protected timeoutError(_query: string): Error;
   protected abstract eventType: typeof DatabaseEventTypes.LocalQuery | typeof DatabaseEventTypes.RemoteQuery;
-  constructor(client: Surreal$1, logger: Logger$1, events: DatabaseEventSystem);
+  constructor(client: Surreal, logger: Logger$1, events: DatabaseEventSystem);
   abstract connect(): Promise<void>;
-  getClient(): Surreal$1;
+  getClient(): Surreal;
   getEvents(): DatabaseEventSystem;
   tx(): Promise<SurrealTransaction>;
   /**
@@ -65,6 +149,20 @@ declare abstract class AbstractDatabaseService {
    * SDK's pending map.
    */
   query<T extends unknown[]>(query: string, vars?: Record<string, unknown>): Promise<T>;
+  /**
+   * Like {@link query} but never rejects on a statement error: every
+   * statement answers on its own as `{ status: 'OK', result }` or
+   * `{ status: 'ERR', error }`. This is what lets a batched outbox push judge
+   * each mutation separately.
+   */
+  queryResponses(query: string, vars?: Record<string, unknown>): Promise<Array<{
+    status: 'OK';
+    result: unknown;
+  } | {
+    status: 'ERR';
+    error: string;
+  }>>;
+  private runStatement;
   execute<T>(query: SealedQuery<T>, vars?: Record<string, unknown>): Promise<T>;
   close(): Promise<void>;
 }
@@ -285,32 +383,17 @@ declare class ConnectionSupervisor {
   private wake;
 }
 //#endregion
-//#region src/modules/sync/queue/queue-down.d.ts
-type RegisterEvent = {
-  type: 'register';
-  payload: {
-    hash: string;
-  };
-};
-type SyncEvent = {
-  type: 'sync';
-  payload: {
-    hash: string;
-  };
-};
-type HeartbeatEvent = {
-  type: 'heartbeat';
-  payload: {
-    hash: string;
-  };
-};
-type CleanupEvent = {
-  type: 'cleanup';
-  payload: {
-    hash: string;
-  };
-};
-type DownEvent = RegisterEvent | SyncEvent | HeartbeatEvent | CleanupEvent;
+//#region src/services/database/local-migrator.d.ts
+declare class LocalMigrator {
+  private localDb;
+  private logger;
+  constructor(localDb: LocalStore, logger: Logger$1);
+  provision(schemaSurql: string): Promise<void>;
+  private isSchemaUpToDate;
+  private recreateDatabase;
+  private splitStatements;
+  private createHashRecord;
+}
 //#endregion
 //#region src/services/stream-processor/wasm-types.d.ts
 interface WasmStreamUpdate {
@@ -591,1482 +674,124 @@ declare class StreamProcessorService {
   private normalizeValue;
 }
 //#endregion
-//#region src/modules/cache/types.d.ts
-type RecordWithId = Record<string, any> & {
-  id: RecordId<string>;
+//#region src/modules/auth/events/index.d.ts
+declare const AuthEventTypes: {
+  readonly AuthStateChanged: "AUTH_STATE_CHANGED";
 };
-interface QueryConfig$1 {
-  queryHash: string;
-  surql: string;
-  params: Record<string, any>;
-  ttl: QueryTimeToLive | Duration;
-  lastActiveAt: Date;
-}
-interface CacheRecord {
-  table: string;
-  op: 'CREATE' | 'UPDATE' | 'DELETE';
-  record: RecordWithId;
-  version: number;
-}
+type AuthEventTypeMap = {
+  [AuthEventTypes.AuthStateChanged]: EventDefinition<typeof AuthEventTypes.AuthStateChanged, string | null>;
+};
+type AuthEventSystem = EventSystem<AuthEventTypeMap>;
+declare function createAuthEventSystem(): AuthEventSystem;
 //#endregion
-//#region src/modules/cache/index.d.ts
-/**
- * CacheModule - Centralized storage and DBSP ingestion
- *
- * Single responsibility: Handle all local storage operations and DBSP ingestion.
- * This module acts as the bridge between data operations and persistence.
- */
-/** One ingested change, in exactly the shape `ingestMany` consumes. Shared
- *  with the tabs protocol so a leader can relay its ingests to followers. */
-interface CacheIngestTuple {
-  table: string;
-  op: 'CREATE' | 'UPDATE' | 'DELETE';
-  id: string;
-  record: Record<string, unknown>;
-}
-declare class CacheModule implements StreamUpdateReceiver {
-  private local;
-  private streamProcessor;
+//#region src/modules/auth/index.d.ts
+type Prettify<T> = { [K in keyof T]: T[K] } & {};
+type MapColumnType<T extends ColumnSchema> = T['optional'] extends true ? TypeNameToTypeMap[T['type']] | undefined : TypeNameToTypeMap[T['type']];
+type ExtractAccessParams<S extends SchemaStructure, Name extends keyof S['access'], Method extends 'signIn' | 'signup'> = S['access'] extends undefined ? never : S['access'][Name] extends AccessDefinition ? Prettify<{ [K in keyof S['access'][Name][Method]['params']]: MapColumnType<S['access'][Name][Method]['params'][K]> }> : never;
+declare class AuthService<S extends SchemaStructure> {
+  private schema;
+  private remote;
+  private persistenceClient;
   private logger;
-  private streamUpdateCallback;
-  private versionLookups;
-  /** Shared-tabs leader: fan every committed ingest out to follower circuits.
-   *  Fired AFTER the local tx (the rows are already in the shared store, so a
-   *  follower only needs the circuit feed). A follower relays its own
-   *  mutations to the leader the same way, see {@link setIngestRelay}. */
-  private ingestRelay;
-  /** See {@link setIngestRelay}. */
-  private relayLocalWritesOnly;
-  constructor(local: LocalStore, streamProcessor: StreamProcessorService, streamUpdateCallback: (update: StreamUpdate) => void, logger: Logger$1);
-  /**
-   * Implements StreamUpdateReceiver interface
-   * Called directly by StreamProcessor when views change
-   */
-  onStreamUpdate(update: StreamUpdate): void;
-  /**
-   * Fan every committed ingest out to the other tabs. The leader relays
-   * everything (its sync fetches are the only copy the followers get). A
-   * follower relays with `localWritesOnly`: just the mutation path, which is
-   * the only thing it knows that the leader does not. Its sync-fetched
-   * batches are the leader's data coming back and must not be re-broadcast,
-   * or every follower registration would fan its whole working set to
-   * every tab.
-   */
-  setIngestRelay(cb: ((tuples: CacheIngestTuple[]) => void) | null, opts?: {
-    localWritesOnly?: boolean;
-  }): void;
-  /**
-   * Shared-tabs follower: feed relayed tuples into THIS tab's circuit only.
-   * The rows are already in the shared store (the leader wrote them), so no
-   * local write happens here; the normal chain then runs: SSP -> stream update
-   * -> DataModule debounce -> materializeRecords (re-reads via the port
-   * transport) -> this tab's subscriptions fire with this tab's hashes.
-   */
-  applyRelayedIngest(tuples: CacheIngestTuple[]): void;
-  lookup(recordId: string): number;
-  /**
-   * Seed the version memo from rows the circuit was primed with out of the
-   * local store, so the first post-reload sync diff does not re-download
-   * bodies the browser already has. Only rows the prime actually put into the
-   * circuit belong here: a memo entry with no circuit row would make the diff
-   * flag the id forever while nothing ever fetches it.
-   */
-  primeVersions(entries: [string, number][]): void;
-  /** Drop the version cache on a bucket switch — a stale version would make
-   *  the sync diff skip fetching a body the new bucket legitimately needs. */
-  clearVersionLookups(): void;
+  token: string | null;
+  currentUser: any | null;
+  isAuthenticated: boolean;
   /**
-   * Save a single record to local DB and ingest into DBSP
-   * Used by mutations (create/update)
+   * The record-access method name for the current session (e.g. `"account"`),
+   * derived from the token's `AC` claim. Consumed by the in-browser SSP's
+   * permission injection so `$access`-gated table predicates resolve locally,
+   * mirroring the server's `$access`. Null when logged out.
    */
-  save(cacheRecord: CacheRecord, skipDbInsert?: boolean): Promise<void>;
+  access: string | null;
+  isLoading: boolean;
+  private events;
+  get eventSystem(): AuthEventSystem;
+  constructor(schema: S, remote: RemoteDatabaseService, persistenceClient: PersistenceClient, logger: Logger$1);
+  init(): Promise<void>;
+  getAccessDefinition<Name extends keyof S['access']>(name: Name): AccessDefinition | undefined;
   /**
-   * Save multiple records in a batch
-   * More efficient than calling save() multiple times
-   * Used by sync operations
+   * Subscribe to auth state changes.
+   * callback is called immediately with current value and whenever validation status changes.
    */
-  saveBatch(records: CacheRecord[], skipDbInsert?: boolean): Promise<void>;
+  subscribe(cb: (userId: string | null) => void): () => void;
+  private notifyListeners;
   /**
-   * Delete a record from local DB and ingest deletion into DBSP
+   * Restore a session from the locally cached JWT, with NO network.
+   *
+   * This is what makes a warm boot paint instantly and what makes an offline
+   * boot possible at all: the token is in local storage, and it already carries
+   * both the access method and the `$auth.id` record id. Everything the client
+   * needs to route queries (`setCurrentUserId`) and to satisfy `$auth`-gated
+   * permission predicates in the in-browser SSP (`setSessionAuth`) is therefore
+   * available before a socket exists.
+   *
+   * The session is OPTIMISTIC: the token is unverified here. `check()` runs
+   * afterwards in the background and downgrades to a real sign-out if the
+   * server rejects it. Nothing is trusted that the server has not also seen -
+   * the local store only ever holds rows the server previously sent.
+   *
+   * Returns the restored user id, or null when there is no usable token.
    */
-  delete(table: string, id: string, skipDbDelete?: boolean, recordData?: Record<string, any>): Promise<void>;
+  restoreSessionFromToken(): Promise<string | null>;
   /**
-   * Register a query with DBSP to create a materialized view
-   * Returns the initial result array
+   * Check for existing session and validate
    */
-  registerQuery(config: QueryConfig$1): {
-    localArray: RecordVersionArray;
-    registrationTimings?: {
-      parseMs: number;
-      planMs: number;
-      snapshotMs: number;
-    };
-  };
+  check(accessToken?: string): Promise<void>;
   /**
-   * Unregister a query from DBSP
+   * Sign out and clear session
    */
-  unregisterQuery(queryHash: string): void;
+  signOut(): Promise<void>;
+  private setSession;
+  /** Fallback when the token carries no `AC` claim: if the schema defines
+   *  exactly one record-access method, assume the session used it. */
+  private defaultAccessName;
+  signUp<Name extends keyof S['access'] & string>(accessName: Name, params: ExtractAccessParams<S, Name, 'signup'>): Promise<void>;
+  signIn<Name extends keyof S['access'] & string>(accessName: Name, params: ExtractAccessParams<S, Name, 'signIn'>): Promise<void>;
 }
 //#endregion
-//#region src/modules/data/index.d.ts
-/**
- * DataModule - Unified query and mutation management
- *
- * Merges the functionality of QueryManager and MutationManager.
- * Uses CacheModule for all storage operations.
- */
-/** A `_00_window` row as read back: the id-set and whether the server vouched
- *  for it (which is what allows an empty set to count as known membership). */
-interface DurableMembership {
-  ids: RecordVersionArray;
-  confirmed: boolean;
-}
-declare class DataModule<S extends SchemaStructure> {
-  private cache;
+//#region src/modules/crdt/crdt-field.d.ts
+declare const CURSOR_COLORS: string[];
+declare function cursorColorFromName(name: string): string;
+declare class CrdtField {
+  private fieldName;
+  private doc;
+  private pushTimer;
   private local;
-  private schema;
-  private streamDebounceTime;
-  /** Tab identity baked into mutation ids (shared-tabs rollback routing);
-   *  undefined in solo mode, where mutation-id falls back to a session id. */
-  private tabId;
-  private activeQueries;
-  private pendingQueries;
-  private subscriptions;
-  private statusSubscriptions;
-  /** Observers of a query's authority (`membershipKnown`) flips, keyed like `statusSubscriptions`. */
-  private authoritySubscriptions;
-  private mutationCallbacks;
-  private debounceTimers;
-  private pendingStreamUpdates;
-  private fetchDepth;
-  /**
-   * Observers of the AGGREGATE fetch activity: how many queries are mid-fetch
-   * right now. What a "downloading" indicator in the app chrome hangs off,
-   * instead of subscribing to every query's status one by one.
-   */
-  private activitySubscriptions;
-  private logger;
-  /**
-   * Optional observer notified whenever a query's fetch status changes.
-   * Wired by Sp00kyClient to push status changes into DevTools. Kept as a
-   * settable field (rather than a constructor arg) because DevTools is
-   * constructed after DataModule.
-   */
-  onQueryStatusChange?: (hash: QueryHash, status: QueryStatus) => void;
-  /**
-   * Optional observer invoked when a still-subscribed query's TTL heartbeat
-   * fires (~90% of the TTL). Wired by Sp00kyClient to
-   * `Sp00kySync.heartbeatQuery`, which refreshes the remote `_00_query`
-   * row's `lastActiveAt` so an actively-watched query never expires. Settable
-   * field (not a constructor arg) because the sync engine is wired after
-   * DataModule is constructed — mirrors `onQueryStatusChange`.
-   */
-  onHeartbeat?: (hash: QueryHash) => void;
-  /**
-   * Fired once per episode when the server's `_00_query` row for a query we
-   * hold membership for is found missing (see `updateQueryRemoteArray`). Wired
-   * by Sp00kyClient to enqueue a `register` down-event so the SSP rebuilds the
-   * view; the client keeps rendering what it has meanwhile.
-   */
-  onViewLost?: (hash: QueryHash) => void;
-  /** DevTools observer for authority flips; mirrors `onQueryStatusChange`. */
-  onQueryAuthorityChange?: (hash: QueryHash, known: boolean) => void;
-  /**
-   * Optional hook fired by {@link deregisterQuery} when an opt-in query (e.g. a
-   * viewport-windowed list cancelling an off-screen window) loses its last
-   * subscriber. Wired by Sp00kyClient to enqueue a `cleanup` down-event, which
-   * tears the remote `_00_query` view down (releasing its `_00_list_ref` edges)
-   * instead of leaving it for the TTL sweep. The local view + state are freed in
-   * {@link finalizeDeregister} only after that remote delete, so a fast
-   * re-subscribe (scroll back) can abort/heal the teardown — see `cleanupQuery`.
-   */
-  onDeregister?: (hash: QueryHash) => void;
+  private remote;
+  private recordId;
   private sessionId;
-  private currentUserId;
-  constructor(cache: CacheModule, local: LocalStore, schema: S, logger: Logger$1, streamDebounceTime?: number);
-  init(sessionId: string): Promise<void>;
-  /**
-   * Update the session salt used in query-id hashing. Call this when the
-   * SurrealDB session changes (sign-in, sign-out, reconnect). Subsequently
-   * registered queries will get fresh, session-scoped IDs.
-   */
-  setSessionId(sessionId: string): void;
-  /** Shared-tabs: bake this tab's identity into mutation ids so a rollback of
-   *  a follower's mutation routes back to the tab that made it. */
-  setTabId(tabId: string): void;
-  /**
-   * Update the authenticated user record id. Pass `null` on sign-out.
-   * Read by `Sp00kySync.listRefTable()` so the LIVE subscription and
-   * the poll route to the same per-user `_00_list_ref_user_<id>` the
-   * SSP writes to.
-   */
-  setCurrentUserId(userId: string | null): void;
-  /** Read-only view of the authenticated user id used for per-user
-   * `_00_list_ref` routing. Other modules consult this so they pick the
-   * same table name DataModule does. */
-  getCurrentUserId(): string | null;
-  /**
-   * Register a query and return its hash for subscriptions
-   */
-  query<T extends TableNames<S>>(tableName: T, surqlString: string, params: Record<string, any>, ttl: QueryTimeToLive, plan?: QueryPlan): Promise<QueryHash>;
-  /**
-   * Subscribe to query updates
-   */
-  subscribe(queryHash: string, callback: QueryUpdateCallback, options?: {
-    immediate?: boolean;
-  }): () => void;
-  /**
-   * Subscribe to a query's fetch-status changes (idle/fetching).
-   * With `{ immediate: true }` the callback fires synchronously with the
-   * current status (defaults to `idle` if the query isn't registered yet).
-   */
-  subscribeStatus(queryHash: string, callback: QueryStatusCallback, options?: {
-    immediate?: boolean;
-  }): () => void;
-  /**
-   * Subscribe to a query's authority flips: whether server membership is known
-   * for it. With `{ immediate: true }` the callback fires synchronously with
-   * the current value (`false` for an unknown query).
-   */
-  subscribeAuthority(queryHash: string, callback: QueryAuthorityCallback, options?: {
-    immediate?: boolean;
-  }): () => void;
-  /** Whether server membership is known for `queryHash` (see `QueryConfig.membershipKnown`). */
-  isAuthoritative(queryHash: string): boolean;
-  /**
-   * The single writer of `config.membershipKnown` for a live query. Fans out
-   * to `subscribeAuthority` listeners and DevTools on a change; no-op when
-   * unchanged or the query is unknown.
-   */
-  private setMembershipKnown;
-  /**
-   * Set a query's fetch status and notify status observers (DevTools +
-   * `subscribeStatus` listeners). No-op when the status is unchanged or the
-   * query is unknown.
-   */
-  setQueryStatus(queryHash: string, status: QueryStatus): void;
-  /**
-   * Enter a fetch cycle for a query. Refcounted: registration and concurrent
-   * poll/LIVE sync rounds can overlap on the same hash, and only the OUTERMOST
-   * cycle may flip the status — 0→1 emits `fetching`, and `endFetching`'s 1→0
-   * emits `idle`. Always pair with `endFetching` in a `finally`.
-   */
-  beginFetching(queryHash: string): void;
-  /** Leave a fetch cycle started with {@link beginFetching}; emits `idle` on the last exit. */
-  endFetching(queryHash: string): void;
-  /** How many queries are mid-fetch right now (see {@link subscribeActivity}). */
-  get fetchingQueryCount(): number;
-  /**
-   * Observe the number of queries currently fetching. Fires on every change of
-   * that number (a query entering or leaving its outermost fetch cycle), and
-   * synchronously with the current value when `immediate` is set. One
-   * subscription per indicator, however many queries the page holds.
-   */
-  subscribeActivity(callback: (fetching: number) => void, options?: {
-    immediate?: boolean;
-  }): () => void;
-  private notifyActivity;
+  private unsubscribe;
+  private lastPushTime;
+  private lastCursorPushTime;
+  private loadedFromCrdt;
+  private pushRetryCount;
+  private logger;
+  private cursorsEnabled;
+  /** Remote-push debounce. Local writes happen immediately on every Loro
+   *  update; the remote UPSERT is coalesced over this window. Configured
+   *  via `Sp00kyConfig.crdtDebounceMs`, default 500. */
+  private remoteDebounceMs;
+  private _onCursorUpdate;
+  private pendingCursorUpdate;
+  /** Callback set by the editor to receive remote cursor updates.
+   *  Any cursor data that arrived before this callback was set will be replayed. */
+  set onCursorUpdate(cb: ((data: Uint8Array) => void) | null);
+  get onCursorUpdate(): ((data: Uint8Array) => void) | null;
   /**
-   * Subscribe to mutations (for sync)
+   * @param LoroDocClass the `LoroDoc` constructor, injected by the caller after
+   *   awaiting {@link loadLoro} — keeps `loro-crdt` out of this module's static
+   *   import graph so it only ships to apps that use CRDT fields.
    */
-  onMutation(callback: MutationCallback): () => void;
+  constructor(fieldName: string, cursorsEnabled: boolean, LoroDocClass: typeof LoroDoc, initialState?: Uint8Array, logger?: Logger$1 | null);
+  getDoc(): LoroDoc;
+  /** Whether the LoroDoc was loaded from saved CRDT state */
+  hasContent(): boolean;
+  startSync(local: LocalStore, remote: RemoteDatabaseService, recordId: string, sessionId: string, debounceMs: number): void;
   /**
-   * Handle stream updates from DBSP (via CacheModule)
-   */
-  onStreamUpdate(update: StreamUpdate): Promise<void>;
-  /** Coalesce `update` onto the query's trailing timer (see onStreamUpdate). */
-  private queueStreamUpdate;
-  /**
-   * Re-materialize + notify a query whose MEMBERSHIP changed without any row
-   * needing to be fetched, i.e. without the SSP stream update that normally
-   * carries the notify. That is every row this client wrote itself: the local
-   * CREATE memoized it at `_00_rv = 1`, the server publishes it at 1, so the
-   * sync engine rightly fetches nothing - and then nobody told the subscribers
-   * that `remoteArray` now holds the id. The row appeared on reload only.
-   *
-   * Routed through the same per-query debounce as a real stream update, so it
-   * cannot race one: a pending real update already materializes against the
-   * current `remoteArray` and wins. The synthetic update re-uses the circuit's
-   * last `localArray` and skips the persist/metrics that describe an ingest.
-   */
-  scheduleRematerialize(queryHash: string): void;
-  /**
-   * Process a query's pending (debounced) stream update NOW instead of on the
-   * trailing edge. Called by the sync engine before it flips a query back to
-   * `idle`, so the status change never races ahead of the rows it fetched.
-   * No-op when nothing is pending. The pending entry is removed before the
-   * await so a concurrently-firing timer can't process it twice.
-   */
-  flushPendingStreamUpdate(queryHash: string): Promise<boolean>;
-  /**
-   * Materialize a query's result rows from the local store.
-   *
-   * A query's rows are its MEMBERSHIP — the id-set the server put in
-   * `_00_list_ref` (`remoteArray`) — not "every local body that matches the
-   * WHERE". Those two disagree, and the disagreement was the bug: when a row
-   * leaves a query's window but still exists upstream, `handleRemovedRecords`
-   * keeps its local body and never re-fetches it, so a predicate re-scan finds
-   * that stale body still matching and keeps rendering the row. Selecting the
-   * id-set directly is also the only correct thing for a windowed query, where
-   * re-applying `START m` against the shared local store skips the window's own
-   * rows entirely (sparse windowing) and returns nothing.
-   *
-   * The rendered set is:
-   *
-   *     (membership ∪ (pendingWrites ∩ localArray)) − pendingDeletes
-   *
-   * The middle term keeps optimistic writes visible without re-admitting stale
-   * rows. Every local write is fed to the SSP (`cache.saveBatch` →
-   * `ingestMany`), so `localArray` answers "does this row match the predicate
-   * per LOCAL truth". A pending write that moves a row into the window is in
-   * `localArray` and shows; one that moves a row out is absent and does not; a
-   * stale body the server dropped has no pending write at all, so it stays out.
-   * `pendingDeletes` covers the reverse lag — the server still lists a row whose
-   * DELETE is sitting in our outbox.
-   *
-   * Falls back to the predicate scan only when membership has never been
-   * established (a query first run on this device), so an offline first paint
-   * still shows something.
-   */
-  private materializeRecords;
-  /**
-   * The materialization itself, without the DevTools timing wrapper. Split out so
-   * cold-start seeding can use it before a `QueryState` exists.
-   */
-  private materializeFromConfig;
-  /**
-   * The authoritative membership list to render from, or `null` when membership
-   * has never been established and the caller must fall back to a scan.
-   *
-   * A windowed query has no usable fallback — re-running its `START m` locally
-   * returns the wrong rows — so it renders from whatever id-set is on hand
-   * (SSP's included) rather than degrading to a scan. That is the pre-existing
-   * behavior for windows and is preserved.
-   */
-  private resolveMembership;
-  private readonly settledWrites;
-  private readonly settledDeletes;
-  private pendingIds;
-  private pendingIdsAt;
-  private pendingIdsInflight;
-  private static readonly PENDING_IDS_TTL_MS;
-  private pendingIdsGen;
-  private static readonly PENDING_IDS_MAX_REREADS;
-  /** Drop the cached outbox ids. Cheap; call it on anything that could change
-   *  `_00_pending_mutations`. */
-  private invalidatePendingIds;
-  /**
-   * Grace period for a settled write. Long enough to cover an SSP round trip
-   * that is running slowly (seconds, not milliseconds, when the edge path is
-   * backed up), short enough that a write the server silently dropped cannot
-   * linger misleadingly.
-   *
-   * The rejection case does NOT rely on this expiring: an application error
-   * rolls the mutation back and never reports it settled, so it vanishes at
-   * once. This deadline only bounds the case where the write succeeded and its
-   * membership never arrived at all.
-   *
-   * 30 s, up from 10 s. At 10 s every server hiccup longer than a scheduler
-   * drain plus one slow database commit showed up as the user's own chat
-   * message vanishing and coming back a minute later. 30 s covers a drain and
-   * a stalled commit end to end; a membership that takes longer than that is
-   * a server fault the admin heartbeat reports, not something to paper over.
-   */
-  private static readonly SETTLED_WRITE_GRACE_MS;
-  /**
-   * Whether any settled write or delete is still waiting for membership to
-   * catch up. The sync poll keeps its fast cadence while this is true, so a
-   * missed LIVE notification for the edge is picked up on the next poll tick
-   * rather than after the idle backoff.
-   */
-  hasSettledWritesPending(): boolean;
-  /**
-   * Report that a mutation was accepted by the server and its outbox row
-   * removed. Called only on the SUCCESS path — a rolled-back mutation must
-   * disappear immediately, which is what makes this safe.
-   */
-  noteWriteSettled(recordId: string, mutationType: string): void;
-  /** Drop entries past their deadline. */
-  private pruneSettled;
-  /** Apply the pending-write union and pending-delete subtraction, and map to
-   *  RecordIds for the engines' id-set path. */
-  private buildRenderIds;
-  private processStreamUpdate;
-  /**
-   * Compute p55/p90/p99 from a rolling window of materialization samples.
-   * Returns nulls for any percentile that has no samples yet so SurrealDB
-   * `option<float>` columns stay NONE rather than 0 before the first ingest.
-   */
-  private computeMaterializationPercentiles;
-  /** Record a per-phase timing sample (ms) on a query's rolling window. */
-  private recordPhase;
-  /** Record the remote record-fetch time (ms) for a query. Called by the sync engine. */
-  recordRemoteFetch(hash: string, ms: number): void;
-  /**
-   * Record the frontend reconcile time (ms) for a query. Called from `useQuery`
-   * via `Sp00kyClient.reportFrontendTiming` after it applies an update to its store.
-   */
-  recordFrontendTiming(hash: string, ms: number): void;
-  /**
-   * Build the per-query processing-time breakdown surfaced to the DevTools panel
-   * and the MCP. `ssp` is the WASM-ingest wall time (from `materializationSamples`);
-   * the rest come from the per-phase rolling windows + one-shot registration timings.
-   */
-  phaseTimings(q: QueryState): QueryTimings;
-  /**
-   * Get query state (for sync and devtools)
-   */
-  getQueryByHash(hash: string): QueryState | undefined;
-  /**
-   * Cold-query guard for instant-hydrate: true when the query exists, hasn't been
-   * hydrated, and has NOT yet fetched its server result (`remoteArray` empty).
-   * We gate on `remoteArray`, not local `records`: a windowed query is often
-   * partially pre-seeded from the circuit (e.g. the dashboard's 5-row preview),
-   * but it still hasn't loaded its own full window from the server — so it should
-   * still hydrate. A warm re-subscribe (remoteArray already populated) is skipped.
-   */
-  isCold(hash: string): boolean;
-  /**
-   * Walk a hydrated record's fields and append any EMBEDDED child records to
-   * `batch` (recursing for nested related fields). An embedded child is a
-   * value that is itself a record — a non-null object whose `id` is a
-   * `RecordId` — or an array of such records (one-to-many vs one-to-one). A
-   * bare `RecordId` (a foreign-key reference) or any other value is skipped,
-   * so this never mistakes a FK column for an embedded body. Children are
-   * keyed by their own `record.id.table`, versioned by `_00_rv`, and cleaned
-   * to their table's real columns (which strips the alias/related fields).
-   * `seen` dedupes within the batch.
-   */
-  private collectEmbeddedChildren;
-  /**
-   * Prepare a subquery-bearing row (preload / hydration) for the schemafull
-   * local store: replace an embedded FORWARD-relation object (`author = { id, … }`)
-   * with its RecordId so a `record<…>` field coerces, and DROP reverse-subquery
-   * ARRAYS (`comments = [ … ]`) since their rows are cached separately as their
-   * own bodies. A flat record — as the live `SELECT * FROM $ids` sync returns,
-   * with relations already RecordIds — passes through unchanged.
-   */
-  private flattenRelationsForStorage;
-  /**
-   * Instant-hydrate: ingest rows fetched one-shot from the remote (the query's own
-   * surql run directly) so the query DISPLAYS immediately, while the full realtime
-   * registration proceeds in the background. Ingests with versions (`_00_rv`) so the
-   * later `syncRecords` dedup skips re-pulling unchanged bodies, and seeds
-   * `remoteArray` so windowed queries materialize the correct window (no sparse
-   * local-circuit issue). Runs at most once per query (the `hydrated` flag).
-   */
-  applyHydration(hash: string, rows: RecordWithId[]): Promise<void>;
-  /**
-   * Build the cache batch for a set of one-shot rows and persist it to the
-   * local DB + in-browser SSP. Maps each row to a `CREATE` op on its own table
-   * and extracts EMBEDDED related children (any nesting depth) as their own
-   * records — a `.related()` query returns its children embedded, and a later
-   * correlated re-materialization needs them present as standalone rows.
-   * Shared by `applyHydration` (live registration) and `persistSnapshot`
-   * (preload).
-   */
-  private buildAndSaveCacheBatch;
-  /**
-   * Preload/prewarm: persist one-shot rows (and their embedded related children)
-   * into the local cache WITHOUT registering a query — no `activeQueries` entry,
-   * no `_00_query` view, no TTL heartbeat. The rows live in the local DB as
-   * ordinary bodies (never GC'd on their own) so a later `useQuery` seeds its
-   * first paint from them instantly, then registers a live view to freshen.
-   */
-  persistSnapshot(tableName: string, rows: RecordWithId[]): Promise<void>;
-  /**
-   * Read the durable preload freshness marker for a query hash, or null if this
-   * query was never preloaded in the current bucket. Co-located with the cached
-   * rows (per-bucket `_00_preload` table) so a bucket switch that clears the
-   * data also clears the marker — a stale marker can't claim "warm" when the
-   * rows are gone. Any read error is treated as cold.
-   */
-  getPreloadMarker(hash: string): Promise<{
-    fetchedAt: number;
-    rowCount: number;
-  } | null>;
-  /** Stamp the preload freshness marker after a successful snapshot fetch. */
-  writePreloadMarker(hash: string, rowCount: number): Promise<void>;
-  /**
-   * Read the durable membership row, or `null` if this query has never had
-   * authoritative membership on this device. Any read error is treated as
-   * "unknown" so a broken row degrades to the predicate scan rather than
-   * rendering an empty list.
-   *
-   * `confirmed` is true only for rows written after the server itself vouched
-   * for the set (a non-empty id-set, or an empty one it reported a row count of
-   * zero for, or an empty one that followed a non-empty one in the same
-   * session). Rows written before the marker existed, including the `[]` rows a
-   * pre-`ea56f50e` client mirrored from an unflushed read, read as unconfirmed.
-   */
-  getWindowMembership(key: string): Promise<DurableMembership | null>;
-  /**
-   * Persist the durable membership row. Best-effort: callers must not fail a
-   * sync round because the mirror write failed.
-   *
-   * `confirmed` says whether a cold start may trust this row even when it is
-   * empty. A confirmed empty is a real answer ("the server says this query has
-   * no rows") and stays empty across a reload; an unconfirmed empty is the
-   * retry budget's guess and falls back to the predicate scan on the next boot,
-   * exactly as every empty row did before the marker existed.
-   */
-  writeWindowMembership(key: string, ids: RecordVersionArray, confirmed: boolean): Promise<void>;
-  /**
-   * Record ids with a mutation still in the outbox, split by direction.
-   *
-   * Both halves feed {@link materializeRecords}: `writes` keeps optimistic
-   * creates/updates visible before the server has acknowledged them, and
-   * `deletes` suppresses rows the server still lists because our DELETE hasn't
-   * been processed yet. Reading `_00_pending_mutations` (rather than tracking
-   * ids in memory) is what makes both survive a reload.
-   *
-   * On failure returns empty sets: membership alone then decides, which can
-   * briefly hide an optimistic write but never resurrects a deleted row.
-   */
-  getPendingRecordIds(): Promise<{
-    writes: Set<string>;
-    deletes: Set<string>;
-  }>;
-  /** The uncached read. Also the reload path after an invalidation, so the ids
-   *  still survive a reload exactly as before. `gen` is the generation the read
-   *  was issued under; the result is cached only if it is still current. */
-  private readPendingRecordIds;
-  /** True while ≥1 live subscriber is watching this query (refcount guard). */
-  hasSubscribers(hash: string): boolean;
-  /**
-   * Opt-in eager teardown for a query whose LAST subscriber just left — used by
-   * viewport-windowed lists to cancel off-screen windows instead of leaving
-   * their remote views to expire on the TTL sweep. No-op while any subscriber
-   * remains (refcount). Only enqueues the remote cleanup here; the local WASM
-   * view + in-memory state are freed in {@link finalizeDeregister} after the
-   * remote delete completes, so a re-subscribe in between aborts/heals it.
-   *
-   * NOTE: most queries should NOT use this — the default keep-alive on
-   * unsubscribe avoids re-registration churn on navigation.
-   */
-  deregisterQuery(hash: string): void;
-  /**
-   * Final local teardown after the remote `_00_query` row was deleted: free the
-   * WASM view, heartbeat timer, debounce timer, and in-memory state. Caller
-   * (`cleanupQuery`) guarantees no subscriber remains.
-   */
-  finalizeDeregister(hash: string): void;
-  /**
-   * Get query state by id (for sync and devtools)
-   */
-  getQueryById(id: RecordId<string>): QueryState | undefined;
-  /**
-   * Get all active queries (for devtools)
-   */
-  getActiveQueries(): QueryState[];
-  getActiveQueryHashes(): QueryHash[];
-  updateQueryLocalArray(id: string, localArray: RecordVersionArray): Promise<void>;
-  updateQueryRemoteArray(hash: string, remoteArray: RecordVersionArray, opts?: {
-    /** The `_00_query` row as read in the same round trip as the edges. */
-    meta?: ServerViewMeta;
-    /**
-     * The caller verified upstream that the ids missing from `remoteArray`
-     * no longer exist (see `Sp00kySync` LIVE removal handling); an empty set
-     * is then a real answer even without a readable row.
-     */
-    verifiedRemoval?: boolean;
-  }): Promise<MembershipOutcome>;
-  /**
-   * Cancel every armed timer ahead of a local-bucket switch: stream-update
-   * debounce timers (their pending updates carry the OLD bucket's id-sets) and
-   * per-query TTL heartbeats (they'd refresh the previous user's remote
-   * `_00_query` rows under the new session). The rebind re-arms heartbeats.
-   */
-  quiesce(): void;
-  /**
-   * Re-home every active query in a freshly-opened bucket, KEEPING its hash —
-   * `useQuery` subscriptions are keyed by hash and don't re-register on auth
-   * changes, so the hooks must stay attached. Per query:
-   *   1. reset the sync arrays + hydration flag and drop the previous user's
-   *      records, notifying subscribers with the new-bucket materialization
-   *      (usually empty) so their rows leave the UI immediately;
-   *   2. recreate the `_00_query` row in the new bucket;
-   *   3. re-register the SSP view on the (fresh, post-reset) processor — this
-   *      also rebinds the view to the NEW `$auth` context;
-   *   4. restart the TTL heartbeat.
-   * Returns the hashes so the caller can enqueue remote re-registration, which
-   * refills records from the server via the normal register→sync→notify path.
-   */
-  rebindAfterBucketSwitch(): Promise<QueryHash[]>;
-  /**
-   * Called after a query's initial sync completes.
-   * Ensures subscribers are notified even if no stream updates fired (e.g. empty result set).
-   */
-  notifyQuerySynced(queryHash: string): Promise<void>;
-  run<B extends BackendNames<S>, R extends BackendRoutes<S, B>>(backend: B, path: R, data: RoutePayload<S, B, R>, options?: RunOptions): Promise<void>;
-  /**
-   * Build the outbox job record + resolve its table for a backend route.
-   *
-   * Every job is a single execution. Recurring work is declared server-side
-   * (`schedules:` in sp00ky.yml) and the scheduler creates a fresh row per cycle,
-   * so nothing here needs to know about schedules.
-   */
-  private buildJobRecord;
-  /**
-   * Create a new record
-   */
-  create<T extends Record<string, unknown>>(id: string, data: T): Promise<T>;
-  /**
-   * Update an existing record
-   */
-  update<T extends Record<string, unknown>>(table: string, id: string, data: Partial<T>, options?: UpdateOptions): Promise<T>;
-  /**
-   * Delete a record
-   */
-  delete(table: string, id: string): Promise<void>;
-  /**
-   * Rollback a failed optimistic create by deleting the record locally
-   */
-  rollbackCreate(recordId: RecordId, tableName: string): Promise<void>;
-  /**
-   * Rollback a failed optimistic update by restoring the previous record state
-   */
-  rollbackUpdate(recordId: RecordId, tableName: string, beforeRecord: Record<string, unknown>): Promise<void>;
-  /**
-   * Force a re-materialize + notify of every active query on `tableName`.
-   * Used after a DELETE landed in the local store (this tab's own, or one
-   * relayed from another tab): the SSP may not emit a view update for a
-   * DELETE ingest, and the re-materialize reads the store, which already
-   * excludes the row. Each query is isolated so one failing re-materialize
-   * can't stop the others.
-   */
-  notifyTableQueries(tableName: string): Promise<void>;
-  /**
-   * Remove a record from all active query states and notify subscribers
-   */
-  private removeRecordFromQueries;
-  private createAndRegisterQuery;
-  private createNewQuery;
-  private calculateHash;
-  /**
-   * Session-independent counterpart of {@link calculateHash}: the key for a
-   * query's durable `_00_window` membership row.
-   *
-   * Deliberately the SAME inputs minus the `session::id()` salt, so the two keys
-   * can never drift apart. The salt is right for `_00_query` (two tabs must not
-   * fight over one row) and wrong for membership, which has to be recognizable
-   * after a reload — a reload mints a new session id, and offline the salt is
-   * `''`, so a salted key can never match what the previous session wrote.
-   */
-  private calculateMembershipKey;
-  private sha256;
-  private startTTLHeartbeat;
-  /**
-   * Heartbeat every watched query NOW and re-anchor its timer.
-   *
-   * The TTL timer is the only thing keeping a view alive on the server, and
-   * browsers throttle timers in hidden tabs (Chrome aligns them to one-minute
-   * ticks after five minutes hidden, and suspends them outright on some
-   * mobile platforms). A tab that comes back after a long stretch may have
-   * missed its beat by more than the server's slack, and the sweep will have
-   * taken the row and its edges. The client does not blank on that any more
-   * (`updateQueryRemoteArray` treats a missing row as "view lost"), but the
-   * sooner it finds out, the sooner the view is rebuilt: `heartbeatQuery`
-   * re-registers a query whose row is gone. Called on `visibilitychange` (to
-   * visible) and `online`.
-   *
-   * Queries beaten within the last `minGapMs` are skipped, so a flurry of
-   * wake events costs one beat per query. There is deliberately no local
-   * expiry anywhere in this module: the TTL is the server's, and the client's
-   * only duty is to keep asserting liveness while something is watching.
-   */
-  heartbeatOnWake(minGapMs?: number): number;
-  private replaceRecordInQueries;
-}
-/**
- * Parse update options to generate push event options
- */
-//#endregion
-//#region src/services/tabs/protocol.d.ts
-type TabId = string;
-type TabRole = 'solo' | 'leader' | 'follower';
-/** Broker pings every tab at this cadence. */
-
-/** Matches `CacheIngestTuple` (modules/cache): exactly what `ingestMany`
- *  consumes, so relayed batches feed follower circuits without reshaping. */
-interface IngestTuple {
-  table: string;
-  op: 'CREATE' | 'UPDATE' | 'DELETE';
-  id: string;
-  record: Record<string, unknown>;
-}
-type FollowerToLeaderMessage = {
-  type: 'sync-hello';
-  tabId: TabId;
-}
-/** The follower committed an outbox row (through the shared store) and the
- *  leader should drain it. Idempotent; a new leader's loadFromDatabase is
- *  the backstop for a notify lost in a failover window. */ | {
-  type: 'mutation-enqueued';
-  mutationId: string;
-} | {
-  type: 'request-poll';
-}
-/** An optimistic write this follower committed to the SHARED store and
- *  ingested into its own circuit. The leader ingests it (no DB write, the
- *  row is already there) and fans it out to every OTHER follower as
- *  `ingest-relay`, so a follower's write lands in every tab in one hop
- *  instead of after the server round-trip. */ | {
-  type: 'ingest';
-  tuples: IngestTuple[];
-};
-type LeaderToFollowerMessage = {
-  type: 'db-ready';
-  leadershipId: number;
-  bucketId: string;
-  storageHealth: StorageHealth;
-}
-/** Every ingest the leader's CacheModule committed, so follower circuits
- *  stay live without their own fetch. seq detects gaps. */ | {
-  type: 'ingest-relay';
-  tuples: IngestTuple[];
-  leadershipId: number;
-  seq: number;
-}
-/** A `_00_list_ref` LIVE event, relayed verbatim. Each follower resolves the
- *  queryId against its own DataModule and ignores foreign queries. */ | {
-  type: 'list-ref-change';
-  action: 'CREATE' | 'UPDATE' | 'DELETE';
-  queryId: string;
-  recordId: string;
-  version: number;
-  parent: boolean;
-}
-/** The leader's drain rolled back a mutation owned by this tab. */ | {
-  type: 'mutation-rolled-back';
-  mutationId: string;
-  recordId: string;
-  eventType: 'create' | 'update' | 'delete';
-  error: string;
-}
-/** The leader's drain pushed a mutation and deleted its outbox row from the
- *  SHARED store. Every follower starts its settled-write grace so a row it
- *  was rendering as a pending write does not blink out before its
- *  `_00_list_ref` membership arrives. */ | {
-  type: 'mutation-settled';
-  mutationId: string;
-  recordId: string;
-  eventType: 'create' | 'update' | 'delete';
-};
-//#endregion
-//#region src/services/tabs/coordinator.d.ts
-/** Leader-side fan-out surface handed to the sync layer. The sync router
- *  (modules/sync/tab-router.ts) registers itself as the message handler. */
-declare class LeaderSyncHub {
-  readonly leadershipId: number;
-  private logger;
-  private followers;
-  private seq;
-  onFollowerMessage: ((tabId: TabId, msg: FollowerToLeaderMessage) => void) | null;
-  onFollowerDetached: ((tabId: TabId) => void) | null;
-  constructor(leadershipId: number, logger: Logger$1);
-  attach(tabId: TabId, port: MessagePort): void;
-  detach(tabId: TabId): void;
-  detachAll(): void;
-  sendTo(tabId: TabId, msg: LeaderToFollowerMessage): void;
-  broadcast(msg: LeaderToFollowerMessage, exceptTabId?: TabId): void;
-  /** Stamped ingest relay; seq lets followers detect gaps. */
-  relayIngest(tuples: IngestTuple[], exceptTabId?: TabId): void;
-  get followerCount(): number;
-  get relayedBatches(): number;
-}
-/** Follower half of the syncPort. Queues while detached (leaderless window)
- *  and flushes on rebind; a lost-in-flight mutation notify is additionally
- *  backstopped by the new leader reloading the shared outbox from the store. */
-declare class SyncForwarder {
-  private tabId;
-  private port;
-  private queued;
-  onLeaderMessage: ((msg: LeaderToFollowerMessage) => void) | null;
-  constructor(tabId: TabId);
-  rebind(port: MessagePort): void;
-  unbind(): void;
-  private post;
-  mutationEnqueued(mutationId: string): void;
-  /** An optimistic write this tab just ingested. Deliberately NOT queued while
-   *  detached: a new leader primes its circuit from the shared store, which
-   *  already holds the row, and replaying a stale tuple at it later would put
-   *  an older `_00_rv` in its version memo. */
-  ingest(tuples: IngestTuple[]): void;
-  requestPoll(): void;
-}
-//#endregion
-//#region src/modules/sync/sync.d.ts
-/**
- * Tunables for `Sp00kySync` construction.
- */
-interface Sp00kySyncOptions {
-  /**
-   * Cadence (ms) for the `_00_list_ref` poll fallback that catches
-   * cross-session UPDATEs the LIVE-permission gap drops. Non-positive
-   * values fall back to the default; see
-   * {@link resolveListRefPollInterval}.
-   */
-  refSyncIntervalMs?: number;
-  /**
-   * Enable realtime sync for unauthenticated clients against the shared
-   * `_00_list_ref_anon` table. See {@link Sp00kyConfig.enableAnonymousLiveQueries}.
-   * Defaults to `false`.
-   */
-  anonymousLiveQueries?: boolean;
-  /**
-   * Consecutive failed sync rounds before sync health flips to `degraded`.
-   * `0` disables degraded reporting. See {@link Sp00kyConfig.syncHealth}.
-   * Defaults to `3`.
-   */
-  degradeAfterConsecutiveFailures?: number;
-  /**
-   * Max time a single mutation push may take before it is treated as a network
-   * failure and retried. Guards against an RPC that never settles wedging the
-   * up-queue for the session. Defaults to 30000; `0` disables the timeout.
-   */
-  pushTimeoutMs?: number;
-  /**
-   * Max time a single down event (`register`/`sync`/`cleanup`) may take before
-   * it is treated as a network failure and retried. The mirror of
-   * {@link pushTimeoutMs} for the read side, which had no such guard: a
-   * `fn::query::register` that never settled held its slot in the down drain,
-   * and every later registration behind it, for the rest of the session.
-   * Defaults to 30000; `0` disables the timeout.
-   */
-  downTimeoutMs?: number;
-  /**
-   * Transport supervisor. Sync reads its state to report `connection` in
-   * {@link SyncHealth} so a UI can show "reconnecting…" the instant the socket
-   * drops, without waiting for the degrade threshold. Optional: omitted in
-   * tests, where `connection` then reports `connected`.
-   */
-  connectionSupervisor?: ConnectionSupervisor;
-}
-/**
- * The main synchronization engine for Sp00ky.
- * Handles the bidirectional synchronization between the local database and the remote backend.
- * Uses a queue-based architecture with 'up' (local to remote) and 'down' (remote to local) queues.
- * @template S The schema structure type.
- */
-declare class Sp00kySync<S extends SchemaStructure> {
-  private local;
-  private remote;
-  private cache;
-  private dataModule;
-  private schema;
-  private upQueue;
-  private downQueue;
-  private isInit;
-  private logger;
-  private syncEngine;
-  /** Engine-level events (e.g. `SYNC_REMOTE_DATA_INGESTED`). Distinct
-   *  from `this.events`, which carries Sp00kySync-level events like
-   *  `SYNC_QUERY_UPDATED` and `SYNC_MUTATION_ROLLED_BACK`. */
-  get engineEvents(): SyncEventSystem;
-  private scheduler;
-  /**
-   * Set by any event that means the socket we registered on is gone, so the
-   * next `connected` knows it must re-subscribe rather than treat itself as the
-   * initial connect. See {@link subscribeToReconnect}.
-   */
-  private needsResubscribe;
-  /** When the last reconnect-driven full refetch ran, for burst coalescing. */
-  private lastReconnectRefetchAt;
-  /**
-   * Minimum gap between reconnect-driven full refetches. Long enough to absorb
-   * a flapping socket (the SDK reconnect ladder starts at 1s), short enough
-   * that a genuine drop minutes later still refetches.
-   */
-  private static readonly RECONNECT_REFETCH_COOLDOWN_MS;
-  /** Poll interval while waiting for a reconnected session to re-authenticate. */
-  private static readonly AUTH_READY_RETRY_MS;
-  /** Attempts before giving up on re-auth and skipping the refetch entirely. */
-  private static readonly AUTH_READY_MAX_ATTEMPTS;
-  events: SyncEventSystem;
-  private currentUserId;
-  private tabRole;
-  private tabId;
-  private hub;
-  private forwarder;
-  private refMode;
-  private readonly anonLiveEnabled;
-  private currentLiveQueryUuid;
-  private liveQueryUnsubscribe;
-  private listRefPollTimer;
-  private listRefPollRunning;
-  private listRefPollInFlight;
-  readonly refSyncIntervalMs: number;
-  private listRefIdleStreak;
-  private listRefPolledAt;
-  private stillRemoteStreaks;
-  private lastLiveEventAt;
-  private _liveRetryCount;
-  get liveRetryCount(): number;
-  get isSyncing(): boolean;
-  get pendingMutationCount(): number;
-  subscribeToPendingMutations(cb: (count: number) => void): () => void;
-  private readonly degradeAfterFailures;
-  /** Per-push RPC deadline; see {@link withPushTimeout}. */
-  private readonly pushTimeoutMs;
-  private readonly downTimeoutMs;
-  private consecutiveSyncFailures;
-  private syncHealthStatus;
-  private lastSyncErrorKind;
-  private lastSyncErrorMessage;
-  private hasSyncedOnce;
-  private selfHealTimer;
-  private selfHealAttempts;
-  private static readonly SELF_HEAL_BASE_MS;
-  private static readonly SELF_HEAL_MAX_MS;
-  /**
-   * Transport supervisor, when one was supplied. Sync only reads state from it;
-   * it never drives reconnects itself.
-   */
-  private readonly connectionSupervisor?;
-  /**
-   * Mirror of the supervisor's state. Defaults to `connected` so a client
-   * constructed without a supervisor (tests, embedders) reports the same health
-   * shape it always has rather than a permanent false "disconnected".
-   */
-  private connectionState;
-  /** Current sync-health snapshot. */
-  get syncHealth(): SyncHealth;
-  /**
-   * Observe sync health. The callback fires immediately with the current
-   * status and again on every healthy↔degraded transition. Returns an
-   * unsubscribe. Mirrors {@link subscribeToPendingMutations}.
-   */
-  subscribeToSyncHealth(cb: (health: SyncHealth) => void): () => void;
-  private emitSyncHealth;
-  /**
-   * Mirror the supervisor's transport state into {@link SyncHealth} and emit on
-   * every change, so a UI can react to a dropped socket immediately instead of
-   * waiting for `degradeAfterFailures` failed rounds. `status` is untouched:
-   * a brief reconnect is not a degradation.
-   *
-   * No explicit unsubscribe: the supervisor is owned by the same client and
-   * drops all subscribers in its own `dispose()`, which `Sp00kyClient.close()`
-   * calls first.
-   */
-  private subscribeToConnectionState;
-  /**
-   * Fed by the scheduler once per drained sync round. Individual failures are
-   * absorbed by the queue's retry; only a run of `degradeAfterFailures`
-   * consecutive failures flips the status to `degraded`, and the next clean
-   * round flips it back. No-op when reporting is disabled (`degradeAfterFailures`
-   * is 0).
-   */
-  private recordSyncOutcome;
-  /**
-   * Begin self-heal retries (no-op if already running). Started on the
-   * healthy→degraded transition; {@link recordSyncOutcome} stops it on recovery.
-   */
-  private startSelfHeal;
-  private scheduleSelfHeal;
-  private stopSelfHeal;
-  /**
-   * Release a deregistered query's remote view immediately instead of leaving
-   * it to the TTL sweep. Off by default; see the reasoning in
-   * {@link cleanupQuery}. Kept as a field rather than deleted so the eager path
-   * can be re-enabled in a test once the subquery-body repair path exists.
-   */
-  private readonly releaseQueriesEagerly;
-  constructor(local: LocalStore, remote: RemoteDatabaseService, cache: CacheModule, dataModule: DataModule<S>, schema: S, logger: Logger$1, options?: Sp00kySyncOptions);
-  /**
-   * Initializes the synchronization system.
-   * Starts the scheduler and initiates the initial sync cycles.
-   * @throws Error if already initialized.
-   */
-  init(): Promise<void>;
-  /** Set BEFORE init(): shapes what init boots (a follower loads no outbox and
-   *  never starts LIVE; its own registration/poll paths stay untouched). */
-  setTabContext(role: 'solo' | 'leader' | 'follower', tabId: string | null): void;
-  /** In-flight {@link resumeLeaderDuties}, so a second call joins the first
-   *  instead of double-draining the outbox. */
-  private leaderDutiesInFlight;
-  /** Resolves once the in-browser circuit has been primed from the local
-   *  store. Every sync diff waits on it: diffing against an empty circuit
-   *  classifies the whole working set as missing and re-downloads it. */
-  private primeGate;
-  /** The prime we last waited on. `whenPrimed` hands out one promise per
-   *  prime, so a new identity means a new prime (boot, bucket switch) ran. */
-  private settledPrime;
-  setPrimeGate(gate: () => Promise<void>): void;
-  /**
-   * Leader WIRING only, and deliberately synchronous.
-   *
-   * The coordinator publishes the leader role and tells the broker
-   * `leader-ready` the moment the store is adopted, and the broker can mint a
-   * follower's ports on the very next tick. So the follower-message handler
-   * has to be live before this returns, or a mutation forwarded in that window
-   * is dropped. Everything that can block (outbox reload, LIVE restart) moved
-   * to {@link resumeLeaderDuties}: a promotion that waits on the network holds
-   * `leader-ready` back, and a broker whose leader never reports ready serves
-   * no follower ports and re-elects no one, which wedges the whole namespace.
-   */
-  promoteToLeader(hub: LeaderSyncHub): void;
-  /** Leader duties: drain the shared outbox, own the single list_ref LIVE,
-   *  relay LIVE events and rollbacks to followers. Idempotent for a boot-time
-   *  leader; a runtime promotion (failover) reloads the outbox, which now
-   *  holds EVERY tab's rows, and restarts LIVE under this session. Runs in the
-   *  background off the promotion path, so however long it takes (or if it
-   *  never finishes) the tab is already a working leader. */
-  resumeLeaderDuties(): Promise<void>;
-  /** Follower duties: no outbox drain, no LIVE. Mutations forward to the
-   *  leader; everything else (registration, per-query sync, poll) runs
-   *  against this tab's own remote session as usual. */
-  demoteToFollower(forwarder: SyncForwarder): void;
-  /**
-   * A pending mutation was discarded because it can never be sent.
-   *
-   * This is a lost write, so it must not stay invisible. Every failure in this
-   * chain used to be a `logger.error` an app running `logLevel: 'fatal'` never
-   * shows, which is how an outbox could sit undrained for hours with the UI
-   * reporting nothing. Surfaces as a rollback event (the mutation will never
-   * apply, which is what a subscriber needs to know) and degrades sync health.
-   */
-  private onMutationDropped;
-  /** A forwarded outbox row from a follower: load + drain it. Idempotent. */
-  enqueueForwardedMutation(mutationId: string): Promise<void>;
-  /**
-   * Tuples another tab already committed to the shared store: feed them to
-   * THIS tab's circuit (no local write). A DELETE additionally forces a
-   * re-materialize of the table's queries, exactly as the writing tab does
-   * for itself, because the SSP may not emit a view update for it.
-   */
-  private applyRelayedIngest;
-  /** A relayed `_00_list_ref` LIVE event: resolve against THIS tab's queries
-   *  and run the exact same handling the LIVE subscription would have. */
-  private applyRelayedListRefChange;
-  /** One immediate poll cycle (failover convergence). */
-  forcePollRound(): Promise<void>;
-  /**
-   * Quiesce all sync activity ahead of a local-bucket switch. After this
-   * resolves, nothing in the sync module writes to the local store: the poll
-   * loop is stopped AND its in-flight tick awaited, LIVE is killed, debounce
-   * timers are cancelled (their outbox rows are already persisted), and the
-   * scheduler has drained its in-flight queue item — including that item's
-   * outbox-row delete, which must land in the OLD bucket. Queued down-events
-   * are dropped (they reference old-bucket query rows; the post-switch rebind
-   * re-enqueues registrations). The old user's un-pushed outbox is deliberately
-   * NOT drained: the remote session already belongs to the next user.
-   */
-  prepareBucketSwitch(): Promise<void>;
-  /**
-   * Resume syncing against the freshly-opened bucket: reload the mutation
-   * outbox from ITS `_00_pending_mutations` (the new user's own un-pushed
-   * offline work) and restart the scheduler. LIVE + the list_ref poll restart
-   * via the `setCurrentUserId` call that follows in the auth listener.
-   */
-  completeBucketSwitch(): Promise<void>;
-  /**
-   * Push the authenticated user's record id from the parent client's
-   * auth subscription. Tears down the existing `_00_list_ref` LIVE (if
-   * any) and re-registers it under the new user's dedicated table so
-   * SurrealDB binds the permission rule under the post-flip auth
-   * context. Pass `null` on sign-out.
-   *
-   * The dedicated `_00_list_ref_user_<id>` table is created lazily by
-   * the SSP when the first query registration arrives, which may be
-   * concurrent with this call. We retry the LIVE registration with a
-   * short backoff so a "table not found" race resolves without
-   * surfacing as a permanent auth-loading hang.
-   */
-  setCurrentUserId(userId: string | null): Promise<void>;
-  private startListRefPoll;
-  private stopListRefPoll;
-  /**
-   * One poll cycle: refetch `_00_list_ref` for the active queries that are due,
-   * one round trip per chunk (see `planListRefPollChunks`). Returns whether ANY
-   * query's remoteArray actually changed — the scheduler uses this to drive the
-   * adaptive idle backoff.
-   *
-   * Also the ONLY health signal that runs while the page is idle. Sync health is
-   * otherwise activity-driven (mutations/registrations via the scheduler,
-   * reconnect re-registration, self-heal), so on a quiet page a stale `degraded`
-   * would linger until the next mutation and a genuine idle drop would be
-   * invisible. We fold the cycle's aggregate reachability into `recordSyncOutcome`
-   * so idle health self-recovers (and self-degrades) with no user action. A clean
-   * cycle is idempotent when already healthy (`recordSyncOutcome` early-returns at
-   * `consecutiveSyncFailures === 0`), so a healthy idle page pays nothing.
-   */
-  private pollListRefForActiveQueries;
-  /**
-   * The server's current `_00_list_ref` state for a chunk of queries in ONE
-   * round trip: primary edges, subquery-child edges and `_00_query.rowCount`.
-   * Every hash whose query still exists gets an entry (empty arrays and
-   * `rowCount: null` when nothing was readable), so a caller can tell "no
-   * edges" from "not asked". A hash is left out only when the select did not
-   * come back as an array at all — the old per-query code skipped the apply in
-   * that case too, since a non-array is not a membership set.
-   *
-   * Guarded against a batch that silently matches nothing: if the select
-   * returned no edge at all while the client holds edges for a query the
-   * server still reports rows for, the batch is not trusted and the chunk is
-   * re-read one query at a time with the single-query select. An empty set
-   * taken at face value would be recorded as the removal of every row.
-   */
-  private fetchListRefSnapshots;
-  /**
-   * Single-query form of {@link fetchListRefSnapshots}: the selects the
-   * registration path has always used, in one statement batch. `null` when
-   * the primary select did not come back as an array.
-   */
-  private fetchListRefSnapshot;
-  /**
-   * Land one poll snapshot for `queryHash`: diff the server's edges against the
-   * cached `remoteArray`, sync any added/updated rows through the SyncEngine,
-   * persist the new remoteArray and converge the subquery children. This is
-   * the same shape `createRemoteQuery` does for its initial fetch and what
-   * `handleRemoteListRefChange` does per-LIVE-event — we reuse it on a timer
-   * as a fallback for missed LIVE notifications. Returns whether membership
-   * changed.
-   */
-  private applyListRefSnapshot;
-  /**
-   * Re-read ONE query's server state now (edges + `_00_query` row) and land
-   * it through {@link applyListRefSnapshot}. The targeted form of the poll,
-   * for the moments that cannot wait for the next tick: a registration that
-   * answered `materializing`, and a LIVE removal that has to be checked
-   * against the row before it may empty a painted list.
-   */
-  private refetchListRefForQuery;
-  /** Per-query pending targeted re-reads: one timer and the ladder still to walk. */
-  private listRefRefetches;
-  /**
-   * Schedule a targeted re-read of `queryHash` after `delays[0]` ms. If the
-   * read still says the server is publishing (`materializing`), the next rung
-   * of the ladder is armed; any other outcome ends it. Re-scheduling a hash
-   * that already has a timer replaces it (latest wins), so bursts coalesce.
-   */
-  private scheduleListRefRefetch;
-  private clearListRefRefetch;
-  private clearListRefRefetches;
-  /**
-   * Resolve the current `_00_list_ref` table name for the active auth
-   * context. Public so the `createRemoteQuery` initial-fetch path can
-   * read from the right per-user table.
-   *
-   * Reads the user id from `DataModule` rather than the local mirror,
-   * because `DataModule.setCurrentUserId` runs synchronously from the
-   * auth callback (before any `await`), whereas `sync.setCurrentUserId`
-   * is async — the userQuery's initial fetch can fire between those
-   * two points and we need the correct table name immediately.
-   */
-  listRefTable(): string;
-  private killRefLiveQuery;
-  private restartRefLiveQuery;
-  /**
-   * Drop local LIVE bookkeeping without issuing a `KILL`.
-   *
-   * Called when the socket dies. The server-side subscription is scoped to that
-   * WebSocket session and died with it, so there is nothing left to kill — and
-   * by the time the reconnect handler runs, the client reports `connected`
-   * again, which would otherwise send a `KILL` for a stale uuid on the *new*
-   * session and hold up the restart queued behind it.
-   */
-  private invalidateRefLiveQuery;
-  private subscribeToReconnect;
-  /**
-   * Whether the REMOTE SESSION currently carries `$auth.id`.
-   *
-   * Not the same question as `currentUserId`, and that gap is the whole point:
-   * `currentUserId` is this client's own record of who signed in and survives a
-   * socket drop untouched, while `$auth` lives on the WebSocket session and has
-   * to be re-applied after every reconnect. Registering in the window between
-   * the two is silently destructive, because `fn::query::register` sends
-   * `<string>($auth.id OR '')` and the SSP stores that value write-once: the
-   * view's edges then route to the global `_00_list_ref` stamped `auth_id = ''`,
-   * which that table's own permission rule (`auth_id = $auth.id`) makes
-   * unreadable to the very user who registered it.
-   *
-   * Signed-out clients answer `true`: `''` is the honest identity there, not a
-   * race.
-   */
-  private remoteAuthEstablished;
-  /**
-   * Wait for the reconnected session to carry an identity again, then
-   * re-register every active query and re-bind LIVE.
-   *
-   * Giving up without registering is deliberately better than registering
-   * anyway: a registration made with no `$auth.id` produces a view its own
-   * owner cannot read, and it is write-once, so it stays that way. Skipping
-   * leaves the query unregistered and visibly loading, which the next
-   * reconnect or heartbeat retries.
-   */
-  private refetchAfterReconnect;
-  private startRefLiveQueries;
-  private handleRemoteListRefChange;
-  /** LIVE removals awaiting verification, per query, with their coalescing timer. */
-  private pendingLiveRemovals;
-  /**
-   * Hold a LIVE `_00_list_ref` DELETE for {@link LIVE_REMOVAL_COALESCE_MS},
-   * then verify the batch (see {@link flushLiveRemovals}). A sweep or a
-   * republish delivers a view's whole set as one burst, so one verification
-   * round covers it.
-   */
-  private queueLiveRemoval;
-  /**
-   * Verify a coalesced batch of LIVE removals against the upstream records.
-   * Ids that no longer exist upstream are dropped from membership (the body
-   * delete already happened inside `syncRecords`) and the query re-renders.
-   * Anything still present upstream - or a verification that could not run -
-   * is settled by a targeted re-read of the server's set for this query,
-   * where the `_00_query` row decides: gone = view lost (keep rows,
-   * re-register), `materializing` = wait, `ready` = adopt the smaller set.
-   */
-  private flushLiveRemovals;
-  private clearLiveRemovals;
-  /**
-   * Handle a LIVE change to a SUBQUERY child edge (a `_00_list_ref` row with
-   * `parent` set) for a `.related()` query. Unlike primary rows, child rows
-   * must NOT touch the query's `localArray`/`remoteArray`/`rowCount`; we only
-   * keep the child BODY fresh in the local cache so the in-browser SSP's
-   * subquery-table dependency re-materializes the parent view.
-   *
-   * CREATE/UPDATE fetch+upsert the child body. DELETE is intentionally a
-   * no-op: a child leaving this query's set must not delete a body another
-   * query may still show (see `syncSubqueryChildren` deletion-safety note);
-   * a genuine record delete propagates via the normal delete path.
-   */
-  private handleRemoteSubqueryChange;
-  /**
-   * Enqueues a 'down' event (from remote to local) for processing.
-   * @param event The DownEvent to enqueue.
-   */
-  enqueueDownEvent(event: DownEvent): void;
-  /**
-   * Bound a mutation push so it always settles.
-   *
-   * `SyncScheduler.syncUp` early-returns while `isSyncingUp` is true, and that
-   * flag only clears in the `finally` of the drain loop. A push whose RPC never
-   * settles (socket dropped mid-flight, response lost) therefore wedges the
-   * up-queue for the rest of the session: no retry, no error, no further
-   * mutation ever sent. A timeout turns that into an ordinary network failure,
-   * which `UpQueue.next` re-queues for the next trigger. The message deliberately
-   * contains "timed out" so `classifySyncError` treats it as `network` and
-   * retries rather than rolling the mutation back.
-   */
-  private withPushTimeout;
-  private processUpEvent;
-  /**
-   * A mutation the server accepted, reported once its outbox row is gone.
-   *
-   * Keeps the written row in the render set until its membership arrives.
-   * Without this the row is briefly in neither term of
-   * `(membership ∪ pendingWrites) − pendingDeletes` — the outbox delete is
-   * tied to the push, while membership waits on the SSP ingesting the row,
-   * materializing the view, writing the `_00_list_ref` edge and this client
-   * reading it back. The writer therefore watched its own comment appear,
-   * vanish, and return, while every other client showed it throughout.
-   */
-  private handleMutationSettled;
-  private handleRollback;
-  private processDownEvent;
-  private withDownTimeout;
-  private runDownEvent;
-  /**
-   * Synchronizes a specific query by hash.
-   * Compares local and remote version arrays and fetches differences.
-   * @param hash The hash of the query to sync.
-   */
-  syncQuery(hash: string): Promise<void>;
-  /**
-   * Run a sync for a single query while reflecting its fetch status. Marks the
-   * query `fetching` for the duration when the diff actually pulls records
-   * (added/updated), then resets to `idle` in a `finally` so a failed sync
-   * never leaves a query stuck `fetching`. Part A's notification coalescing
-   * means the single resulting UI update lands after this completes.
-   */
-  private runSyncForQuery;
-  /**
-   * Record ids with a pending local DELETE in the outbox (`_00_pending_mutations`).
-   * Sync must not re-fetch/re-insert these — the remote delete is async, so the
-   * server's `_00_list_ref` still lists them until it's processed, and the diff
-   * would otherwise resurrect a just-deleted record.
-   */
-  private getPendingDeleteIds;
-  /**
-   * Enqueues a list of mutations (up events) to be sent to the remote.
-   * @param mutations Array of UpEvents (create/update/delete) to enqueue.
-   */
-  enqueueMutation(mutations: UpEvent[]): Promise<void>;
-  /**
-   * Best-effort release of THIS tab's views as the page goes away.
-   *
-   * Without it a closed tab's views stay materialized on the SSP for a full
-   * TTL (10 minutes by default), because nothing else tears them down:
-   * `releaseQueriesEagerly` is off, so the TTL sweep is the only reclaim path.
-   * On a busy tenant that is a generation of live views per reload, each still
-   * being stepped by every ingest, for ten minutes after the last human left.
-   *
-   * This is NOT `releaseQueriesEagerly` re-enabled. That released views
-   * mid-session on a viewport change and tore the window out from under a live
-   * page (see `cleanupQuery`); this runs only when the page itself is going
-   * away and nothing is left to render.
-   *
-   * Safe against other tabs by construction: `fn::query::unsubscribe` drops
-   * only this session from `subscribers` and deletes the row solely when it
-   * was the last one, so a second tab of the same user keeps its view.
-   *
-   * One statement, not one per id: an unload handler gets a few milliseconds,
-   * and N round trips would not survive it. Fire-and-forget — if the frame
-   * does not make it out, the TTL sweep still reclaims exactly as before, so
-   * the worst case is today's behaviour.
-   */
-  releaseViewsOnUnload(): void;
-  private registerQuery;
-  private createRemoteQuery;
-  /**
-   * Sync the BODIES of a `.related()` query's subquery child rows into the
-   * local cache, separately from the primary window array. The SSP writes
-   * each matched child as a `_00_list_ref` edge tagged `parent`/`parent_rel`;
-   * `buildSubqueryListRefSelect` pulls those `out`+`version` pairs (any
-   * nesting depth). We diff against the in-memory `subqueryRemoteArray` and
-   * fetch added/updated bodies through the SyncEngine — which `saveBatch`s
-   * them into the local DB AND the in-browser SSP, whose subquery-table
-   * dependency then re-materializes the parent view (no explicit notify).
-   *
-   * Deletion safety: we pass `removed: []` deliberately. A child body can be
-   * shared by other queries; letting `handleRemovedRecords` delete one that
-   * merely left THIS query's child set would clobber data another query still
-   * shows. Genuine record deletes flow through the normal delete path; a
-   * lingering orphan body is invisible (the correlated WHERE stops matching).
-   *
-   * Kept off `runSyncForQuery` on purpose so child fetches never flip the
-   * query to `fetching` or skew its DevTools timings.
-   */
-  private syncSubqueryChildren;
-  /**
-   * Converge a `.related()` query's child bodies onto `fresh` (the server's
-   * current child edges). Shared by the registration path above and the poll,
-   * which reads the child edges in its batched round trip. See
-   * {@link syncSubqueryChildren} for the deletion-safety rules.
-   */
-  private applySubqueryChildren;
-  heartbeatQuery(queryHash: string): Promise<void>;
-  private cleanupQuery;
-}
-//#endregion
-//#region src/modules/auth/events/index.d.ts
-declare const AuthEventTypes: {
-  readonly AuthStateChanged: "AUTH_STATE_CHANGED";
-};
-type AuthEventTypeMap = {
-  [AuthEventTypes.AuthStateChanged]: EventDefinition<typeof AuthEventTypes.AuthStateChanged, string | null>;
-};
-type AuthEventSystem = EventSystem<AuthEventTypeMap>;
-declare function createAuthEventSystem(): AuthEventSystem;
-//#endregion
-//#region src/modules/auth/index.d.ts
-type Prettify<T> = { [K in keyof T]: T[K] } & {};
-type MapColumnType<T extends ColumnSchema> = T['optional'] extends true ? TypeNameToTypeMap[T['type']] | undefined : TypeNameToTypeMap[T['type']];
-type ExtractAccessParams<S extends SchemaStructure, Name extends keyof S['access'], Method extends 'signIn' | 'signup'> = S['access'] extends undefined ? never : S['access'][Name] extends AccessDefinition ? Prettify<{ [K in keyof S['access'][Name][Method]['params']]: MapColumnType<S['access'][Name][Method]['params'][K]> }> : never;
-declare class AuthService<S extends SchemaStructure> {
-  private schema;
-  private remote;
-  private persistenceClient;
-  private logger;
-  token: string | null;
-  currentUser: any | null;
-  isAuthenticated: boolean;
-  /**
-   * The record-access method name for the current session (e.g. `"account"`),
-   * derived from the token's `AC` claim. Consumed by the in-browser SSP's
-   * permission injection so `$access`-gated table predicates resolve locally,
-   * mirroring the server's `$access`. Null when logged out.
-   */
-  access: string | null;
-  isLoading: boolean;
-  private events;
-  get eventSystem(): AuthEventSystem;
-  constructor(schema: S, remote: RemoteDatabaseService, persistenceClient: PersistenceClient, logger: Logger$1);
-  init(): Promise<void>;
-  getAccessDefinition<Name extends keyof S['access']>(name: Name): AccessDefinition | undefined;
-  /**
-   * Subscribe to auth state changes.
-   * callback is called immediately with current value and whenever validation status changes.
-   */
-  subscribe(cb: (userId: string | null) => void): () => void;
-  private notifyListeners;
-  /**
-   * Restore a session from the locally cached JWT, with NO network.
-   *
-   * This is what makes a warm boot paint instantly and what makes an offline
-   * boot possible at all: the token is in local storage, and it already carries
-   * both the access method and the `$auth.id` record id. Everything the client
-   * needs to route queries (`setCurrentUserId`) and to satisfy `$auth`-gated
-   * permission predicates in the in-browser SSP (`setSessionAuth`) is therefore
-   * available before a socket exists.
-   *
-   * The session is OPTIMISTIC: the token is unverified here. `check()` runs
-   * afterwards in the background and downgrades to a real sign-out if the
-   * server rejects it. Nothing is trusted that the server has not also seen -
-   * the local store only ever holds rows the server previously sent.
-   *
-   * Returns the restored user id, or null when there is no usable token.
-   */
-  restoreSessionFromToken(): Promise<string | null>;
-  /**
-   * Check for existing session and validate
-   */
-  check(accessToken?: string): Promise<void>;
-  /**
-   * Sign out and clear session
-   */
-  signOut(): Promise<void>;
-  private setSession;
-  /** Fallback when the token carries no `AC` claim: if the schema defines
-   *  exactly one record-access method, assume the session used it. */
-  private defaultAccessName;
-  signUp<Name extends keyof S['access'] & string>(accessName: Name, params: ExtractAccessParams<S, Name, 'signup'>): Promise<void>;
-  signIn<Name extends keyof S['access'] & string>(accessName: Name, params: ExtractAccessParams<S, Name, 'signIn'>): Promise<void>;
-}
-//#endregion
-//#region src/modules/crdt/crdt-field.d.ts
-declare const CURSOR_COLORS: string[];
-declare function cursorColorFromName(name: string): string;
-declare class CrdtField {
-  private fieldName;
-  private doc;
-  private pushTimer;
-  private local;
-  private remote;
-  private recordId;
-  private sessionId;
-  private unsubscribe;
-  private lastPushTime;
-  private lastCursorPushTime;
-  private loadedFromCrdt;
-  private pushRetryCount;
-  private logger;
-  private cursorsEnabled;
-  /** Remote-push debounce. Local writes happen immediately on every Loro
-   *  update; the remote UPSERT is coalesced over this window. Configured
-   *  via `Sp00kyConfig.crdtDebounceMs`, default 500. */
-  private remoteDebounceMs;
-  private _onCursorUpdate;
-  private pendingCursorUpdate;
-  /** Callback set by the editor to receive remote cursor updates.
-   *  Any cursor data that arrived before this callback was set will be replayed. */
-  set onCursorUpdate(cb: ((data: Uint8Array) => void) | null);
-  get onCursorUpdate(): ((data: Uint8Array) => void) | null;
-  /**
-   * @param LoroDocClass the `LoroDoc` constructor, injected by the caller after
-   *   awaiting {@link loadLoro} — keeps `loro-crdt` out of this module's static
-   *   import graph so it only ships to apps that use CRDT fields.
-   */
-  constructor(fieldName: string, cursorsEnabled: boolean, LoroDocClass: typeof LoroDoc, initialState?: Uint8Array, logger?: Logger$1 | null);
-  getDoc(): LoroDoc;
-  /** Whether the LoroDoc was loaded from saved CRDT state */
-  hasContent(): boolean;
-  startSync(local: LocalStore, remote: RemoteDatabaseService, recordId: string, sessionId: string, debounceMs: number): void;
-  /**
-   * Stop syncing this field. Flushes one final remote push by default so the
-   * last keystrokes aren't lost. Pass `{ flush: false }` on a bucket switch —
-   * the remote session already belongs to the NEXT user, and pushing this
-   * (previous user's) snapshot under it would clobber the record remotely.
+   * Stop syncing this field. Flushes one final remote push by default so the
+   * last keystrokes aren't lost. Pass `{ flush: false }` on a bucket switch —
+   * the remote session already belongs to the NEXT user, and pushing this
+   * (previous user's) snapshot under it would clobber the record remotely.
    */
   stopSync(options?: {
     flush?: boolean;
@@ -2246,10 +971,26 @@ declare class FeatureFlagHandle {
   onClose(cb: () => void): void;
   close(): void;
 }
+/** The slice of the query engine this module drives: register a live query
+ *  locally, ask for its remote registration, subscribe to its rows. */
+interface LiveQueryPort$1 {
+  query(table: string, surql: string, params: Record<string, unknown>, ttl: QueryTimeToLive): Promise<string>;
+  subscribe(hash: string, cb: (records: Record<string, any>[]) => void, options?: {
+    immediate?: boolean;
+  }): () => void;
+}
+interface RemoteRegisterPort$1 {
+  enqueueDownEvent(event: {
+    type: 'register';
+    payload: {
+      hash: string;
+    };
+  }): void;
+}
 interface FeatureFlagModuleDeps<S extends SchemaStructure> {
-  dataModule: DataModule<S>;
-  sync: Sp00kySync<S>;
-  auth: AuthService<S>;
+  dataModule: LiveQueryPort$1;
+  sync: RemoteRegisterPort$1;
+  auth: Pick<AuthService<S>, 'subscribe'>;
   logger: Logger$1;
 }
 declare class FeatureFlagModule<S extends SchemaStructure> {
@@ -2292,60 +1033,824 @@ declare class FeatureFlagModule<S extends SchemaStructure> {
   private persistOverrides;
 }
 //#endregion
-//#region src/modules/app-release/index.d.ts
-interface AppReleaseSnapshot {
-  /** Latest announced version for the app, or undefined when no row exists. */
-  version: string | undefined;
-  /** Clients should clear SW/caches when reloading onto this version. */
-  cacheBust: boolean;
-  /** Clients should reload/update immediately instead of asking. */
-  mandatory: boolean;
-  releasedAt: string | undefined;
+//#region src/modules/app-release/index.d.ts
+interface AppReleaseSnapshot {
+  /** Latest announced version for the app, or undefined when no row exists. */
+  version: string | undefined;
+  /** Clients should clear SW/caches when reloading onto this version. */
+  cacheBust: boolean;
+  /** Clients should reload/update immediately instead of asking. */
+  mandatory: boolean;
+  releasedAt: string | undefined;
+}
+interface AppReleaseOptions {
+  ttl?: QueryTimeToLive;
+}
+declare class AppReleaseHandle {
+  readonly app: string;
+  private latest;
+  private listeners;
+  private onCloseFn;
+  private closed;
+  constructor(app: string);
+  set(snapshot: AppReleaseSnapshot): void;
+  snapshot(): AppReleaseSnapshot;
+  version(): string | undefined;
+  /** True when the announced version is semver-newer than `currentVersion`. */
+  updateAvailable(currentVersion: string): boolean;
+  subscribe(cb: (s: AppReleaseSnapshot) => void): () => void;
+  onClose(cb: () => void): void;
+  close(): void;
+}
+/** The slice of the query engine this module drives: register a live query
+ *  locally, ask for its remote registration, subscribe to its rows. */
+interface LiveQueryPort {
+  query(table: string, surql: string, params: Record<string, unknown>, ttl: QueryTimeToLive): Promise<string>;
+  subscribe(hash: string, cb: (records: Record<string, any>[]) => void, options?: {
+    immediate?: boolean;
+  }): () => void;
+}
+interface RemoteRegisterPort {
+  enqueueDownEvent(event: {
+    type: 'register';
+    payload: {
+      hash: string;
+    };
+  }): void;
+}
+interface AppReleaseModuleDeps<S extends SchemaStructure> {
+  dataModule: LiveQueryPort;
+  sync: RemoteRegisterPort;
+  auth: Pick<AuthService<S>, 'subscribe'>;
+  logger: Logger$1;
+}
+declare class AppReleaseModule<S extends SchemaStructure> {
+  private deps;
+  private logger;
+  private handles;
+  private authUnsubscribe;
+  private lastUserId;
+  private querySubscription;
+  private starting;
+  private ttl;
+  private snapshots;
+  private loaded;
+  constructor(deps: AppReleaseModuleDeps<S>);
+  init(): void;
+  release(app: string, options?: AppReleaseOptions): AppReleaseHandle;
+  closeAll(): Promise<void>;
+  private refresh;
+  private teardownQuery;
+  private ensureStarted;
+  private applyRecords;
+}
+//#endregion
+//#region src/kernel/events.d.ts
+/**
+ * Inbound events. Everything that can start a saga arrives as one of these
+ * through the runtime router: public API calls, adapter callbacks, timers,
+ * and `dispatch` effects from other sagas.
+ */
+type RuntimeEvent = {
+  type: 'EnsureRegistered';
+  requireAuth?: boolean;
+  attempt?: number;
+} | {
+  type: 'RegisterRemote';
+  hash: QueryHash;
+  retry?: boolean;
+} | {
+  type: 'SyncOutcome';
+  ok: boolean;
+  error?: unknown;
+} | {
+  type: 'AckPrune';
+} | {
+  type: 'ReadDirtyMembership';
+} | {
+  type: 'ReadMembership';
+  hashes: QueryHash[];
+} | {
+  type: 'FetchRows';
+} | {
+  type: 'Materialize';
+  hash: QueryHash;
+} | {
+  type: 'MaterializeDirty';
+} | {
+  type: 'LifecycleTick';
+} | {
+  type: 'GcTick';
+} | {
+  type: 'Drain';
+} | {
+  type: 'FlushWrite';
+  key: string;
+} | {
+  type: 'PollTick';
+} | {
+  type: 'SelfHealTick';
+} | {
+  type: 'HeartbeatNow';
+} | {
+  type: 'StartRemote';
+} | {
+  type: 'PrimeCircuit';
+} | {
+  type: 'VersionsPrimed';
+  entries: Array<readonly [string, number]>;
+} | {
+  type: 'WarmBlobs';
+} | {
+  type: 'AuthFlip';
+  userId: string | null;
+} | {
+  type: 'BucketSwitch';
+  target: string;
+} | {
+  type: 'PageHide';
+} | {
+  type: 'ConnectionChanged';
+  state: ConnectionState;
+} | {
+  type: 'StreamUpdate';
+  update: StreamUpdate;
+} | {
+  type: 'LiveStart';
+} | {
+  type: 'LiveChange';
+  hashes: QueryHash[];
+} | {
+  type: 'TabRole';
+  role: 'solo' | 'leader' | 'follower';
+} | {
+  type: 'TabMessage';
+  message: unknown;
+};
+type OutEvent = {
+  type: 'query:records';
+  hash: QueryHash;
+  records: ReadonlyArray<Record<string, unknown>>;
+} | {
+  type: 'query:status';
+  hash: QueryHash;
+  status: QueryStatus;
+} | {
+  type: 'query:authority';
+  hash: QueryHash;
+  known: boolean;
+} | {
+  type: 'query:view-lost';
+  hash: QueryHash;
+} | {
+  type: 'query:evicted';
+  hash: QueryHash;
+} | {
+  type: 'mutation:event';
+  event: unknown;
+} | {
+  type: 'mutation:settled';
+  mutationId: string;
+  recordId: string;
+  eventType: string;
+} | {
+  type: 'mutation:rolled-back';
+  mutationId: string;
+  recordId: string;
+  eventType: string;
+  error: string;
+} | {
+  type: 'tray:changed';
+  count: number;
+} | {
+  type: 'health:changed';
+  health: SyncHealth;
+} | {
+  type: 'activity:changed';
+  fetching: number;
+  pending: number;
+} | {
+  type: 'tabs:broadcast';
+  message: unknown;
+} | {
+  type: 'tabs:sendTo';
+  tabId: string;
+  message: unknown;
+} | {
+  type: 'devtools';
+  name: string;
+  data?: unknown;
+} | {
+  type: 'log';
+  level: 'debug' | 'info' | 'warn' | 'error';
+  message: string;
+  data?: unknown;
+};
+//#endregion
+//#region src/state/lifecycle.d.ts
+/**
+ * The query lifecycle as one explicit machine.
+ *
+ * `phase` answers "where do this query's rows come from":
+ * - `cold`      never resolved on this device: rows come from a local
+ *               predicate scan (or the SSP local window), bindings show a loader.
+ * - `cached`    a durable `_00_view` row was found: rows come from that id-set.
+ * - `live`      a server membership set was accepted this session.
+ * - `view-lost` the server's `_00_query` row vanished while we held
+ *               membership; rows are kept, a re-registration is under way.
+ *
+ * `remote` tracks the server-side registration, `fetchDepth` is the refcount
+ * behind `status: 'fetching'`, `notified` says whether subscribers received
+ * at least one materialization this registration.
+ */
+type QueryPhase = 'cold' | 'cached' | 'live' | 'view-lost';
+type RemotePhase = 'unregistered' | 'registering' | 'registered' | 'failed';
+interface QueryLifecycle {
+  readonly phase: QueryPhase;
+  readonly remote: RemotePhase;
+  readonly fetchDepth: number;
+  readonly notified: boolean;
+}
+//#endregion
+//#region src/kernel/effects.d.ts
+type Vars = Record<string, unknown>;
+/** What the in-browser SSP needs to build a local view. */
+interface RegisterPlan {
+  queryHash: string;
+  surql: string;
+  params: Vars;
+  ttl: string;
+  tableName: string;
+  involvedTables?: string[];
+}
+/** One statement's outcome of a multi-statement remote request. */
+type StatementResult = {
+  status: 'OK';
+  result: unknown;
+} | {
+  status: 'ERR';
+  error: string;
+};
+/** One entry of an `all` fan-out result (allSettled semantics). */
+
+/**
+ * Effects are data. A saga yields one and gets its result back on the next
+ * `next()`; the interpreter (client/runtime) is the only place they execute.
+ */
+type Effect = {
+  kind: 'local.query';
+  sql: string;
+  vars?: Vars;
+  epoch?: number;
+} | {
+  kind: 'local.select';
+  plan: QueryPlan;
+  params?: Vars;
+} | {
+  kind: 'local.execute';
+  query: SealedQuery<unknown>;
+  vars?: Vars;
+  epoch?: number;
+} | {
+  kind: 'local.getById';
+  table: string;
+  id: unknown;
+} | {
+  kind: 'local.upsert';
+  table: string;
+  id: unknown;
+  data: Record<string, unknown>;
+  mode: 'replace' | 'merge';
+} | {
+  kind: 'local.delete';
+  table: string;
+  id: unknown;
+} | {
+  kind: 'local.epoch';
+} | {
+  kind: 'remote.query';
+  sql: string;
+  vars?: Vars;
+  timeoutMs?: number;
+} | {
+  kind: 'remote.live';
+  table: string;
+} | {
+  kind: 'remote.kill';
+  uuid: string;
+} | {
+  kind: 'ssp.register';
+  plan: RegisterPlan;
+} | {
+  kind: 'ssp.unregister';
+  hash: string;
+} | {
+  kind: 'ssp.ingest';
+  records: IngestRecord[];
+} | {
+  kind: 'timer.set';
+  key: string;
+  ms: number;
+  event: RuntimeEvent;
+} | {
+  kind: 'timer.clear';
+  key: string;
+} | {
+  kind: 'state.read';
+  select: (s: ClientState) => unknown;
+} | {
+  kind: 'state.update';
+  fn: (s: ClientState) => ClientState;
+} | {
+  kind: 'state.wait';
+  until: (s: ClientState) => boolean;
+} | {
+  kind: 'now';
+} | {
+  kind: 'id';
+  scope: 'mutation' | 'salt';
+} | {
+  kind: 'hash';
+  input: string;
+} | {
+  kind: 'emit';
+  event: OutEvent;
+} | {
+  kind: 'dispatch';
+  event: RuntimeEvent;
+} | {
+  kind: 'all';
+  effects: Effect[];
+} | {
+  kind: 'service';
+  name: ServiceName;
+  args: unknown[];
+};
+/**
+ * Calls into the legacy services that are adapters, not state: auth, tabs,
+ * blobs, migrator, crdt, persistence, the SSP lifecycle, the remote socket.
+ * A saga names the call; the runtime binds it to the real service.
+ */
+interface ServiceCalls {
+  'hint.read': () => string | null;
+  'hint.write': (bucketId: string) => void;
+  'local.connect': (bucketId: string) => Promise<void>;
+  'local.switchStore': (bucketId: string) => Promise<void>;
+  'local.beginSwitch': () => () => void;
+  'local.currentBucketId': () => string;
+  'local.usesSurqlSchema': () => boolean;
+  'migrator.provision': () => Promise<void>;
+  'blobs.start': (bucketId: string) => Promise<void>;
+  'blobs.setNamespace': (bucketId: string) => Promise<void>;
+  'blobs.clear': () => Promise<void>;
+  'ssp.init': () => Promise<void>;
+  'ssp.setPermissions': () => void;
+  'ssp.setSessionAuth': (authId: string | null, access: string | null) => void;
+  'ssp.prime': (pendingIds: string[]) => Promise<void>;
+  'ssp.reset': () => Promise<void>;
+  'ssp.setPersistence': (enabled: boolean) => void;
+  'auth.restoreSession': () => Promise<string | null>;
+  'auth.init': () => Promise<void>;
+  'auth.sessionAuthId': () => string | null;
+  'auth.access': () => string | null;
+  'auth.token': () => string | null;
+  'auth.currentUser': () => Record<string, unknown> | null;
+  'remote.connect': () => Promise<void>;
+  'remote.releaseViews': (ids: unknown[]) => void;
+  'supervisor.start': () => void;
+  'tabs.start': (bucketId: string) => Promise<'solo' | 'leader' | 'follower'>;
+  'tabs.moveToBucket': (bucketId: string) => Promise<'solo' | 'leader' | 'follower'>;
+  'crdt.setSessionId': (sessionId: string) => void;
+  'crdt.closeAll': (flush: boolean) => void;
+  'persistence.set': (key: string, value: unknown) => Promise<void>;
+  'features.init': () => void;
+  'releases.init': () => void;
+  'window.attach': () => void;
+}
+type ServiceName = keyof ServiceCalls;
+/** Typed constructors. Each is one line so the saga reads like the plan. */
+//#endregion
+//#region src/kernel/saga.d.ts
+/**
+ * A saga is a generator that yields effects and receives their results. It
+ * holds no references to adapters or state, so it can be driven by the real
+ * interpreter or by `testing/run-pure` with canned results.
+ */
+type Saga<R> = Generator<Effect, R, any>;
+/**
+ * Lanes bound concurrency without a queue object per lane:
+ * - `serial`: runs strictly one at a time per key, in arrival order.
+ * - `dedupe`: a request while one run is active joins that run instead of
+ *   starting another.
+ * The bookkeeping is a pure value so the policy is unit-testable; the runtime
+ * owns the promises.
+ */
+type Lane = {
+  kind: 'serial';
+  key: string;
+} | {
+  kind: 'dedupe';
+  key: string;
+};
+interface LaneState {
+  readonly running: ReadonlySet<string>;
+  readonly waiting: ReadonlyMap<string, number>;
+}
+//#endregion
+//#region src/state/client-state.d.ts
+type Row = Record<string, unknown>;
+/** Everything a query is, minus anything that changes after registration. */
+interface QueryDefinition {
+  /** Session-salted `_00_query:<hash>` record id: the remote view id. */
+  readonly id: RecordId<string>;
+  readonly hash: QueryHash;
+  /** Unsalted `sha256({surql, params})`: key of the durable `_00_view` row. */
+  readonly viewKey: string;
+  readonly surql: string;
+  readonly params: Readonly<Record<string, unknown>>;
+  readonly plan?: QueryPlan;
+  readonly ttl: QueryTimeToLive;
+  readonly ttlMs: number;
+  readonly tableName: string;
+  readonly createdAt: number;
+}
+type ServerViewState = 'materializing' | 'ready' | null;
+interface QueryTelemetry {
+  readonly updateCount: number;
+  readonly errorCount: number;
+  readonly lastUpdatedAt: number | null;
+  readonly materializationSamples: ReadonlyArray<number>;
+  readonly lastIngestLatencyMs: number | null;
+  readonly phaseSamples: Readonly<Record<string, ReadonlyArray<number>>>;
+  readonly phaseLast: Readonly<Record<string, number | null>>;
+  readonly registrationTimings: RegistrationTimings;
+}
+interface QueryEntry {
+  readonly def: QueryDefinition;
+  readonly lifecycle: QueryLifecycle;
+  /** Server membership (ids + versions) or the durable seed. */
+  readonly remoteArray: RecordVersionArray;
+  /** The in-browser SSP view's id-set: local truth for "does this row match". */
+  readonly localArray: RecordVersionArray;
+  readonly subqueryRemoteArray: RecordVersionArray;
+  readonly records: ReadonlyArray<Row>;
+  readonly serverState: ServerViewState;
+  readonly subscribers: number;
+  readonly lastSubscriberLeftAt: number | null;
+  readonly lastHeartbeatAt: number | null;
+  readonly lastPolledAt: number | null;
+  readonly registerAttempts: number;
+  readonly telemetry: QueryTelemetry;
+}
+type OutboxStatus = 'pending' | 'acked';
+/** In-memory mirror of one `_00_pending_mutations` row plus its push progress. */
+interface OutboxItem {
+  readonly id: string;
+  readonly type: MutationEventType;
+  readonly recordId: string;
+  readonly table: string;
+  readonly status: OutboxStatus;
+  readonly ackedAt: number | null;
+  readonly attempts: number;
+}
+type TabRole = 'solo' | 'leader' | 'follower';
+/** A debounced update accumulating locally until its flush writes the outbox row. */
+interface PendingWrite {
+  readonly key: string;
+  readonly table: string;
+  readonly recordId: string;
+  readonly data: Readonly<Record<string, unknown>>;
+  readonly before: Readonly<Record<string, unknown>> | null;
+  readonly firstAt: number;
+}
+interface SyncSlice {
+  readonly health: SyncHealth;
+  readonly consecutiveFailures: number;
+  readonly hasSyncedOnce: boolean;
+  readonly selfHealAttempts: number;
+  readonly pollIdleStreak: number;
+  readonly lastReconnectRefetchAt: number | null;
+  readonly needsResubscribe: boolean;
+  readonly fetchAttempts: number;
+  readonly liveUuid: string | null;
+  readonly liveTable: string | null;
+  readonly lanes: LaneState;
+}
+interface ClientState {
+  readonly sessionId: string | null;
+  readonly userId: string | null;
+  /** The principal the current session salt was minted for. */
+  readonly saltUserId: string | null;
+  /** Latest bucket-switch target; an older switch that wakes up to a newer target skips. */
+  readonly pendingBucket: string | null;
+  readonly tabId: string;
+  readonly tabRole: TabRole;
+  readonly bucketId: string | null;
+  readonly localReady: boolean;
+  readonly primed: boolean;
+  readonly queries: ReadonlyMap<QueryHash, QueryEntry>;
+  /** Hashes whose local registration is in flight (dedupes concurrent `query()` calls). */
+  readonly registering: ReadonlySet<QueryHash>;
+  /** Re-read attempts per hash while the server reports a view as `materializing`. */
+  readonly membershipReread: ReadonlyMap<QueryHash, number>;
+  /** Local body versions (`_00_rv`) by encoded record id. */
+  readonly versions: ReadonlyMap<string, number>;
+  readonly outbox: ReadonlyArray<OutboxItem>;
+  readonly pendingWrites: ReadonlyMap<string, PendingWrite>;
+  readonly failedCount: number;
+  /** Queries whose render inputs changed since their last materialization. */
+  readonly dirty: ReadonlySet<QueryHash>;
+  /** Queries whose server membership must be re-read. */
+  readonly membershipDirty: ReadonlySet<QueryHash>;
+  readonly sync: SyncSlice;
+}
+//#endregion
+//#region src/modules/ref-tables.d.ts
+type RefMode = 'single' | 'dedicated';
+/**
+ * Sentinel user id for unauthenticated clients when anonymous live queries are
+ * enabled. Mirrors `ssp_protocol::ANON_AUTH_ID`. It carries no `user:` prefix
+ * so it can never collide with a real user id (those arrive as `user:<id>`);
+ * both sides resolve it to the shared `_00_list_ref_anon` table.
+ */
+//#endregion
+//#region src/query/env.d.ts
+/**
+ * Static configuration the sagas read. Plain data, built once by the runtime
+ * from `Sp00kyConfig`; sagas never see the config object itself.
+ */
+interface SagaEnv {
+  readonly schema: SchemaStructure;
+  readonly refMode: RefMode;
+  readonly anonLive: boolean;
+  readonly remoteTimeoutMs: number;
+  readonly pushTimeoutMs: number;
+  readonly outboxBatchSize: number;
+  readonly degradeAfter: number;
+  readonly materializeDebounceMs: number;
+  readonly pollBaseMs: number;
+  readonly defaultTtlMs: number;
 }
-interface AppReleaseOptions {
-  ttl?: QueryTimeToLive;
+//#endregion
+//#region src/mutation/rows.d.ts
+interface FailedMutationRow {
+  id: string;
+  mutationType: MutationEventType;
+  recordId: string;
+  tableName: string;
+  data?: Record<string, unknown>;
+  beforeRecord?: Record<string, unknown> | null;
+  error: {
+    message: string;
+    kind: 'application' | 'unreplayable';
+  };
+  attempts: number;
+  createdAt: number;
+  failedAt: number;
+  revert: 'full' | 'partial' | 'none';
 }
-declare class AppReleaseHandle {
-  readonly app: string;
-  private latest;
-  private listeners;
-  private onCloseFn;
-  private closed;
-  constructor(app: string);
-  set(snapshot: AppReleaseSnapshot): void;
-  snapshot(): AppReleaseSnapshot;
-  version(): string | undefined;
-  /** True when the announced version is semver-newer than `currentVersion`. */
-  updateAvailable(currentVersion: string): boolean;
-  subscribe(cb: (s: AppReleaseSnapshot) => void): () => void;
-  onClose(cb: () => void): void;
-  close(): void;
+/**
+ * Parse a record id READ BACK FROM THE STORE, stripping SurrealDB's `⟨⟩`
+ * escaping (outbox ids contain `_`, so they come back escaped).
+ */
+//#endregion
+//#region src/kernel/interpreter.d.ts
+/** The five adapters plus the pure ports, as the interpreter sees them. */
+interface Adapters {
+  local: Pick<LocalStore, 'query' | 'execute' | 'select' | 'getById' | 'upsert' | 'delete'> & {
+    readonly epoch: number;
+  };
+  remote: {
+    queryResponses(sql: string, vars?: Record<string, unknown>): Promise<StatementResult[]>;
+    /** Subscribe to `LIVE SELECT * FROM <table>`; the callback receives the changed query hashes. */
+    live(table: string, onChange: (hashes: string[]) => void): Promise<string>;
+    kill(uuid: string): Promise<void>;
+  };
+  ssp: {
+    registerQueryPlan(plan: {
+      queryHash: string;
+      surql: string;
+      params: Record<string, unknown>;
+      ttl: Duration;
+      lastActiveAt: Date;
+      localArray: [];
+      remoteArray: [];
+      meta: {
+        tableName: string;
+        involvedTables?: string[];
+      };
+    }): StreamUpdate | undefined;
+    unregisterQueryPlan(hash: string): void;
+    ingestMany(records: IngestRecord[]): unknown;
+  };
+  timers: {
+    set(key: string, ms: number, fire: () => void): void;
+    clear(key: string): void;
+  };
+  clock: {
+    now(): number;
+  };
+  ids: {
+    mutation(): string;
+    salt(): string;
+  };
+  hash(input: string): Promise<string>;
+  services: ServiceCalls;
 }
-interface AppReleaseModuleDeps<S extends SchemaStructure> {
-  dataModule: DataModule<S>;
-  sync: Sp00kySync<S>;
-  auth: AuthService<S>;
+/** What the interpreter needs from the runtime: state, waiting, emitting, dispatching. */
+//#endregion
+//#region src/client/runtime.d.ts
+interface RuntimeOptions {
+  env: SagaEnv;
+  adapters: Adapters;
   logger: Logger$1;
+  tabId: string;
+  initialState?: ClientState;
 }
-declare class AppReleaseModule<S extends SchemaStructure> {
-  private deps;
+/**
+ * The one effectful object of the engine: holds the state, runs sagas on
+ * lanes, fires timers, fans events out to subscribers and schedules
+ * materialization for dirty queries. No decision logic lives here.
+ */
+declare class Runtime {
+  private stateValue;
+  private readonly interpret;
+  private readonly env;
+  private readonly adapters;
+  private readonly logger;
+  private readonly serialLanes;
+  private readonly dedupeLanes;
+  private readonly waiters;
+  private readonly recordSubs;
+  private readonly statusSubs;
+  private readonly authoritySubs;
+  private readonly lastStatus;
+  private readonly listeners;
+  private readonly scheduledMaterialize;
+  private readonly timerKeys;
+  private lastActivity;
+  private lastHealth;
+  private disposed;
+  constructor(opts: RuntimeOptions);
+  get state(): ClientState;
+  /** Run a saga, optionally on a lane. Rejections propagate to the caller. */
+  run<R>(saga: Saga<R>, opts?: {
+    lane?: Lane;
+    signal?: AbortSignal;
+  }): Promise<R>;
+  /** Route an event to its saga. Never rejects: failures are logged. */
+  dispatch(event: RuntimeEvent): Promise<void>;
+  private setState;
+  waitFor(until: (s: ClientState) => boolean, signal?: AbortSignal): Promise<void>;
+  /** Deliver an outbound event to its subscribers and listeners. */
+  emit(event: OutEvent): void;
+  private notify;
+  private safely;
+  /** Observe outbound events by type (`'*'` for all). */
+  on(type: OutEvent['type'] | '*', cb: (event: OutEvent) => void): () => void;
+  subscribe(hash: QueryHash, cb: QueryUpdateCallback, options?: {
+    immediate?: boolean;
+  }): () => void;
+  subscribeStatus(hash: QueryHash, cb: QueryStatusCallback, options?: {
+    immediate?: boolean;
+  }): () => void;
+  subscribeAuthority(hash: QueryHash, cb: QueryAuthorityCallback, options?: {
+    immediate?: boolean;
+  }): () => void;
+  /** Apply a reducer outside a saga (facade conveniences such as timing reports). */
+  update(reducer: (s: ClientState) => ClientState): void;
+  dispose(): void;
+}
+//#endregion
+//#region src/services/tabs/coordinator.d.ts
+interface CoordinatorHooks {
+  /** Become the store owner: spawn the worker, open the pool under the given
+   *  per-leadership lock. Returns the resulting health for db-ready relays.
+   *  `resumeHeld` = keep the existing live worker (broker-restart path). */
+  adoptOwner(bucketId: string, opts: {
+    workerLockName: string;
+    allowMemoryFallback: boolean;
+    forceTakeover: boolean;
+    resumeHeld: boolean;
+  }): Promise<StorageHealth>;
+  /** Attach to a leader's worker through `dbPort`. */
+  adoptAttached(dbPort: MessagePort, snapshot: {
+    bucketId: string;
+    storageHealth: StorageHealth;
+    leadershipId: number;
+  }): Promise<void>;
+  /** We were leader and got demoted (zombie thaw / stale promotion): tear the
+   *  owned worker down so its SAH handles free up. */
+  releaseOwnership(): Promise<void>;
+  /** The leader (or its port) is gone; queue/park ops until a new role lands. */
+  onLeaderLost(reason: string): void;
+  /** Leader side: forward a follower's dbPort into the owned worker. */
+  exposeClientPort(clientId: string, port: MessagePort): Promise<void>;
+  removeClientPort(clientId: string): Promise<void>;
+  /** Sync layer role changes (implemented in the sync module). */
+  /** Synchronous leader WIRING. Must not block: the role is published and
+   *  `leader-ready` is sent right after it returns. */
+  becomeSyncLeader(hub: LeaderSyncHub): void;
+  /** The blocking half of the leader handover (outbox drain, LIVE restart),
+   *  run in the background once the tab is already a working leader. */
+  resumeSyncLeaderDuties(): Promise<void>;
+  becomeSyncFollower(forwarder: SyncForwarder): void;
+  becomeSyncSolo(): void;
+  /** Current storage health, for db-ready sent to late-joining followers. */
+  currentStorageHealth(): StorageHealth;
+}
+/** Leader-side fan-out surface handed to the sync layer. The sync router
+ *  (modules/sync/tab-router.ts) registers itself as the message handler. */
+declare class LeaderSyncHub {
+  readonly leadershipId: number;
   private logger;
-  private handles;
-  private authUnsubscribe;
-  private lastUserId;
-  private querySubscription;
-  private starting;
-  private ttl;
-  private snapshots;
-  private loaded;
-  constructor(deps: AppReleaseModuleDeps<S>);
-  init(): void;
-  release(app: string, options?: AppReleaseOptions): AppReleaseHandle;
-  closeAll(): Promise<void>;
-  private refresh;
-  private teardownQuery;
-  private ensureStarted;
-  private applyRecords;
+  private followers;
+  private seq;
+  onFollowerMessage: ((tabId: TabId, msg: FollowerToLeaderMessage) => void) | null;
+  onFollowerDetached: ((tabId: TabId) => void) | null;
+  constructor(leadershipId: number, logger: Logger$1);
+  attach(tabId: TabId, port: MessagePort): void;
+  detach(tabId: TabId): void;
+  detachAll(): void;
+  sendTo(tabId: TabId, msg: LeaderToFollowerMessage): void;
+  broadcast(msg: LeaderToFollowerMessage, exceptTabId?: TabId): void;
+  /** Stamped ingest relay; seq lets followers detect gaps. */
+  relayIngest(tuples: IngestTuple[], exceptTabId?: TabId): void;
+  get followerCount(): number;
+  get relayedBatches(): number;
+}
+/** Follower half of the syncPort. Queues while detached (leaderless window)
+ *  and flushes on rebind; a lost-in-flight mutation notify is additionally
+ *  backstopped by the new leader reloading the shared outbox from the store. */
+declare class SyncForwarder {
+  private tabId;
+  private port;
+  private queued;
+  onLeaderMessage: ((msg: LeaderToFollowerMessage) => void) | null;
+  constructor(tabId: TabId);
+  rebind(port: MessagePort): void;
+  unbind(): void;
+  private post;
+  mutationEnqueued(mutationId: string): void;
+  /** An optimistic write this tab just ingested. Deliberately NOT queued while
+   *  detached: a new leader primes its circuit from the shared store, which
+   *  already holds the row, and replaying a stale tuple at it later would put
+   *  an older `_00_rv` in its version memo. */
+  ingest(tuples: IngestTuple[]): void;
+  requestPoll(): void;
+}
+declare class TabsCoordinator {
+  private deps;
+  role: TabRole$1;
+  leadershipId: number;
+  leaderTabId: TabId | null;
+  brokerRole: 'pending' | TabRole$1;
+  /** Wall time from `become-leader` to `leader-ready` on the last promotion.
+   *  Reported in the DevTools role-change event: a slow store adopt (OPFS pool
+   *  contention after the previous leader died) shows up here as seconds. */
+  lastPromotionMs: number | null;
+  private fingerprint;
+  private bucketId;
+  private broker;
+  private hub;
+  private forwarder;
+  private roleListeners;
+  private startResolve;
+  private startReject;
+  /** Ports received before start() resolves or between roles. */
+  private promotionChain;
+  private closed;
+  constructor(deps: {
+    tabId: TabId;
+    fingerprint: string;
+    hooks: CoordinatorHooks;
+    logger: Logger$1;
+    /** Fired on pagehide while this tab leads: last-chance OPFS release. */
+    onLeaderPageHide?: () => void;
+  });
+  /** Serialize role transitions; each is small but async (worker opens). */
+  private enqueue;
+  onRoleChange(cb: (role: TabRole$1) => void): () => void;
+  private setRole;
+  /** Connect the broker and resolve once this tab has a usable store role.
+   *  Rejects when no role lands in time; the caller then boots solo. */
+  start(bucketId: string): Promise<TabRole$1>;
+  /** Bucket switch: leave the old namespace, join the new one. Resolves when
+   *  a role lands in the new namespace. */
+  moveToBucket(bucketId: string): Promise<TabRole$1>;
+  private promote;
+  private demote;
+  private tabLock;
+  private teardownLeader;
+  private teardownFollower;
+  private serveFollower;
+  private attachToLeader;
+  private handleLeaderGone;
+  private fallbackToSolo;
+  get syncHub(): LeaderSyncHub | null;
+  get syncForwarder(): SyncForwarder | null;
+  get tabId(): TabId;
+  stop(): Promise<void>;
 }
 //#endregion
 //#region src/services/blobs/blob-store.d.ts
@@ -2597,6 +2102,25 @@ declare class BlobCache {
   stats(): BlobCacheStats;
 }
 //#endregion
+//#region src/client/services.d.ts
+/** Everything the facade talks to besides the runtime. */
+interface Services<S extends SchemaStructure> {
+  logger: Logger$1;
+  local: LocalStore;
+  remote: RemoteDatabaseService;
+  connectionSupervisor: ConnectionSupervisor;
+  blobs: BlobCache;
+  persistence: PersistenceClient;
+  streamProcessor: StreamProcessorService;
+  migrator: LocalMigrator;
+  crdt: CrdtManager;
+  auth: AuthService<S>;
+  tabs: TabsCoordinator | null;
+  tabsUnsupportedReason: string | undefined;
+  tabId: string;
+}
+/** What the services need back from the runtime once it exists. */
+//#endregion
 //#region src/utils/blurhash.d.ts
 /**
  * Blurhash generation settings. `true` enables with the defaults below, `false`
@@ -2627,7 +2151,7 @@ declare function isImagePath(path: string): boolean;
  */
 declare function encodeImageToBlurhash(content: string | Uint8Array | Blob, options?: BlurhashEncodeOptions): Promise<string | null>;
 //#endregion
-//#region src/sp00ky.d.ts
+//#region src/client/bucket-handle.d.ts
 /** Coerce whatever the `.get()` RPC hands back into a Blob. */
 declare function bucketContentToBlob(content: unknown): Blob | null;
 interface BucketPutOptions {
@@ -2690,333 +2214,99 @@ declare class BucketHandle {
   rename(sourcePath: string, targetPath: string): Promise<void>;
   list(prefix?: string): Promise<string[]>;
 }
+//#endregion
+//#region src/client/sp00ky-client.d.ts
+interface Sp00kyClientDeps<S extends SchemaStructure> {
+  services?: Services<S>;
+  runtime?: Runtime;
+  env?: Partial<SagaEnv>;
+}
+/**
+ * The public client. Every method is a thin translation into a saga run, a
+ * state read, or a subscription on the runtime; the engine's behaviour lives
+ * in the sagas.
+ */
 declare class Sp00kyClient<S extends SchemaStructure> {
-  private config;
-  private local;
-  private remote;
-  private blobs;
-  private connectionSupervisor;
-  private persistenceClient;
-  private migrator;
-  private cache;
-  private dataModule;
-  private sync;
-  private devTools;
-  private crdtManager;
-  /**
-   * True once the LOCAL half of boot is done and the client can serve reads
-   * from the local store. Distinct from being connected: `syncHealth` covers
-   * reaching the server and `storageHealth` covers whether the local store is
-   * durable, but neither says "usable". Consumers gate their first paint on
-   * this, which is what makes a warm boot instant and an offline boot possible.
-   */
-  private localReady;
-  private saltUserId;
-  private featureFlags;
-  private appReleases;
-  private preloadedHashes;
-  private pendingQueryInits;
-  private logger;
-  auth: AuthService<S>;
-  streamProcessor: StreamProcessorService;
-  private tabsCoordinator;
+  private readonly config;
+  readonly auth: AuthService<S>;
+  readonly streamProcessor: StreamProcessorService;
+  private readonly services;
+  private readonly env;
+  private readonly runtime;
+  private readonly featureFlags;
+  private readonly appReleases;
+  private readonly devTools;
+  private hub;
+  private forwarder;
+  private detachWindow;
   private sharedActive;
-  /** Current shared-tabs role, or null when the feature is off/fell back. */
-  get tabRole(): TabRole | null;
-  get remoteClient(): surrealdb0.Surreal;
-  get localClient(): unknown;
-  get pendingMutationCount(): number;
-  /** Number of times the initial list_ref LIVE subscription retried on
-   *  the most recent `setCurrentUserId` call. 0 when the SSP's
-   *  pre-emptive user-table creation got there first; >0 when LIVE
-   *  registration hit a "table not found" race. Exposed so the e2e
-   *  suite can guard the pre-emptive path against regression. */
-  get liveRetryCount(): number;
-  subscribeToPendingMutations(cb: (count: number) => void): () => void;
-  /** Number of queries mid-fetch right now. See {@link subscribeToFetchActivity}. */
-  get fetchingQueryCount(): number;
-  /**
-   * Observe how many queries are fetching from the server. Fires immediately
-   * with the current count and again on every change, so one subscription can
-   * drive a "downloading" indicator for the whole app. Pair with
-   * {@link subscribeToPendingMutations} for the "uploading" half.
-   */
-  subscribeToFetchActivity(cb: (fetching: number) => void): () => void;
-  /** Current sync-health snapshot. See {@link Sp00kyConfig.syncHealth}. */
-  get syncHealth(): SyncHealth;
-  /**
-   * Observe sync health. Fires immediately with the current status and again
-   * on every healthy↔degraded transition. Returns an unsubscribe.
-   */
-  subscribeToSyncHealth(cb: (health: SyncHealth) => void): () => void;
-  /** Durability of the local cache. See {@link StorageHealth}. `'unknown'` for
-   *  engines that don't report it. */
-  get storageHealth(): StorageHealth;
-  /**
-   * Observe local-store durability. Fires immediately with the current snapshot
-   * and again on every change (at most once per bucket open in practice).
-   * Returns an unsubscribe.
-   */
-  subscribeToStorageHealth(cb: (health: StorageHealth) => void): () => void;
-  constructor(config: Sp00kyConfig<S>);
-  /** The shared-tabs role machinery, wired to this client's modules. */
-  private buildTabsCoordinator;
-  /**
-   * Setup direct callbacks instead of event subscriptions
-   */
-  private setupCallbacks;
+  constructor(config: Sp00kyConfig<S>, deps?: Sp00kyClientDeps<S>);
+  /** Adapter callbacks become runtime events; runtime events reach the legacy services. */
+  private wireAdapters;
+  private forwardToDevTools;
   init(): Promise<void>;
-  /**
-   * The network half of boot: connect, verify the restored session, and let the
-   * sync engine catch up. Runs in the background after `init()` has already
-   * resolved, so nothing here is on the paint path.
-   *
-   * Every step is best-effort. A failure leaves the client in exactly the state
-   * a warm offline boot is in - local reads working, writes queued in the
-   * outbox - and the connection supervisor keeps retrying underneath.
-   */
-  private initRemote;
-  /**
-   * Write the signed-in user's own row, as the SERVER just returned it, into
-   * the local store.
-   *
-   * `AuthService.check()` (boot verification, sign-in, an app-driven refresh)
-   * runs `SELECT * FROM ONLY $auth.id` and keeps the answer on
-   * `auth.currentUser`; nothing consumed it beyond the id. Meanwhile the app's
-   * own `user` query paints local-first from whatever body the store holds,
-   * and that body is only refreshed when the server's row version reaches
-   * this client through membership (`_00_list_ref`). While the SSP is down or
-   * bootstrapping that never happens, so a device that registered before the
-   * account was verified kept rendering a row without `email_verified` and
-   * the app parked the user on "Verify your email" over a server that said
-   * "already verified". The authoritative row was already in hand.
-   *
-   * MERGE semantics (`CacheModule.saveBatch`) keep local-only fields, and
-   * re-using the memoized version keeps the sync dedup honest: this is a
-   * field refresh, not a version claim. `notifyTableQueries` re-materializes
-   * the `user` queries so the gate flips without waiting for a stream update.
-   * Best-effort: a failure here leaves things exactly as they were.
-   */
-  private persistVerifiedUser;
-  private bucketSwitchChain;
-  private pendingBucketTarget;
-  /**
-   * Ensure the local store is this user's bucket, switching if needed. Called
-   * from the auth listener on every auth flip; concurrent calls are chained
-   * and superseded intermediates are skipped (latest target wins).
-   */
-  private ensureLocalBucket;
-  /**
-   * The bucket-switch choreography: drain → swap → rebind.
-   *
-   * Drain: sync quiesced (poll/LIVE stopped, in-flight round awaited so its
-   * outbox delete lands in the OLD bucket, debounce timers cancelled),
-   * DataModule timers cleared, CRDT fields closed WITHOUT their final flush
-   * (the remote session already belongs to the next user).
-   *
-   * Swap: gate closes so any local query issued mid-switch (sibling auth
-   * subscribers, FeatureFlagModule) waits and then runs against the NEW
-   * bucket; store swaps open-new-before-close-old; schema provisions
-   * (no-op for a returning bucket); stale `_00_query` rows are wiped (dead
-   * sessionId-salted hashes with stale arrays — record bodies stay warm);
-   * SSP resets to a fresh circuit with re-seeded permissions.
-   *
-   * Rebind: auth token re-persisted (the surrealdb persistence client wrote it
-   * into the OLD bucket's `_00_kv` before this listener ran), active queries
-   * re-homed keeping their hashes, sync resumed on the new bucket's own
-   * outbox, and every query re-registered remotely to refill from the server.
-   */
-  private doSwitchBucket;
-  /** Removes the `pagehide` listener installed in `init`; see `close`. */
-  private detachUnloadRelease;
   close(): Promise<void>;
-  /**
-   * Subscribe to a feature flag for the current user. Returns a
-   * `FeatureFlagHandle` whose `variant()`, `payload()` and `enabled()`
-   * accessors reflect the latest assignment from `_00_user_feature`,
-   * and whose `subscribe(cb)` fires whenever that assignment changes.
-   *
-   * Permissions are enforced by SurrealDB: a client can only ever see
-   * its own row, and cannot create or modify assignments.
-   */
-  feature(key: string, options?: FeatureFlagOptions): FeatureFlagHandle;
-  /**
-   * Force a feature flag to `variant` in THIS browser only; `null` clears it.
-   *
-   * Nothing is sent to the server — the `_00_user_feature` assignment is
-   * untouched, so clearing restores whatever the server says. Persisted to
-   * localStorage, survives reloads, and applies while signed out. Backs the
-   * DevTools Access tab, and is a convenient hook for tests.
-   *
-   * To change a flag for OTHER users you need admin rights (`spky admin add`)
-   * and the DevTools Access tab, or `spky flag`.
-   */
-  setFeatureOverride(key: string, variant: string | null, payload?: unknown): void;
-  /** Drop every local feature flag override set via `setFeatureOverride`. */
-  clearFeatureOverrides(): void;
-  /** The local feature flag overrides currently in effect, keyed by flag. */
-  getFeatureOverrides(): Record<string, FeatureFlagOverride>;
-  /**
-   * Observe the announced release of an app (`_00_app_release:<app>`, written
-   * by `spky deploy` / `spky release`). The handle's `snapshot()` carries the
-   * announced version plus the cache-bust/mandatory flags, and
-   * `updateAvailable(currentVersion)` compares it semver-wise against the
-   * running build. World-readable; writes are root-only.
-   */
-  appRelease(app: string, options?: AppReleaseOptions): AppReleaseHandle;
-  authenticate(token: string): Promise<surrealdb0.Tokens>;
-  /**
-   * Open a CRDT field for collaborative editing.
-   * Returns a CrdtField with a LoroDoc that can be bound to any editor.
-   * Also starts a LIVE SELECT on the parent table for real-time sync;
-   * incoming events trigger a subquery fetch of `_00_crdt` / `_00_cursor`.
-   */
-  openCrdtField(table: string, recordId: string, field: string, fallbackText?: string): Promise<CrdtField>;
-  /**
-   * Close a CRDT field when editing is done.
-   */
-  closeCrdtField(table: string, recordId: string, field: string): void;
-  deauthenticate(): Promise<void>;
+  isLocalReady(): boolean;
   query<Table extends TableNames<S>>(table: Table, options: QueryOptions<TableModel<GetTable<S, Table>>, false>, ttl?: QueryTimeToLive): QueryBuilder<S, Table, Sp00kyQueryResultPromise>;
+  private registerInput;
   private initQuery;
+  queryRaw(sql: string, params: Record<string, any>, ttl: QueryTimeToLive): Promise<string>;
   /**
-   * Background tail of {@link initQuery}: enqueue the `register` down-event,
-   * then instant-hydrate (opt-in via `config.instantHydrate`, and only when
-   * the query is cold). Never rejects — both halves catch and log, so
-   * `void`-ing the returned promise can't produce an unhandled rejection. By
-   * default (hydrate off) the register lifecycle is the single freshness path;
-   * the one-shot fetch is an optimization apps enable explicitly, and it runs
-   * regardless of preload state — cache-first delivery never depends on WHY
-   * rows are cached.
-   *
-   * Register goes first on purpose. The hydrate used to run strictly before
-   * the enqueue, so a windowed list's one-shot read (a full-table scan when
-   * the app has no matching index) held its own registration back by seconds
-   * per window. Now whichever answer lands first paints; a hydrate that
-   * arrives after the registration is dropped (`applyHydration`).
-   */
-  private finishQueryInit;
-  /**
-   * Smart, awaitable preload/prewarm into the LOCAL cache — without registering a
-   * live view (NO `_00_query`, NO subscription, NO TTL heartbeat).
-   *
-   * Cache-aware via a durable per-bucket freshness marker (`_00_preload`):
-   * - COLD (never preloaded in this bucket): fetch the query one-shot from the
-   *   remote, persist the rows (+ embedded `.related()` children), stamp the
-   *   marker — and AWAIT it. This is the "smart waiting" first load: callers can
-   *   `await db.preload(...)` to hold the UI until the data is ready.
-   * - WARM (marker present): return instantly — NEVER blocks. `refresh` decides
-   *   whether to also kick a one-time silent refetch (see {@link PreloadOptions}).
-   *   Default `onUse` does nothing; the data freshens when the real `useQuery`
-   *   mounts and registers its live view.
-   *
-   * Best-effort: any fetch failure (offline, etc.) is a no-op warn (no marker
-   * written, so it's retried next load). Deduped per session by query hash.
+   * Preload = register a query nobody subscribes to. Resolved before on this
+   * device: returns at once. Never resolved: resolves when the server's
+   * membership and every body are local. `signal` aborts the wait.
    */
   preload(finalQuery: FinalQuery<S, any, any, any, any, any>, options?: PreloadOptions): Promise<void>;
-  /**
-   * One-shot remote fetch + local persist for a preload query. Returns the row
-   * count on success, or -1 on failure (best-effort: logged, never thrown) so
-   * the caller skips stamping the freshness marker and retries next load.
-   */
-  private fetchAndPersist;
-  queryRaw(sql: string, params: Record<string, any>, ttl: QueryTimeToLive): Promise<string>;
   subscribe(queryHash: string, callback: (records: Record<string, any>[]) => void, options?: {
     immediate?: boolean;
   }): Promise<() => void>;
-  /**
-   * Opt-in eager teardown for a query whose last subscriber has gone away
-   * (e.g. a viewport-windowed list cancelling an off-screen window). No-op
-   * while any subscriber remains. Tears down the remote `_00_query` view +
-   * local WASM view instead of waiting for the TTL sweep. Default behavior
-   * (no call here) keeps the view resident for cheap re-subscription.
-   */
   deregisterQuery(queryHash: string): void;
-  /**
-   * Subscribe to a query's fetch-status changes (idle/fetching). With
-   * `{ immediate: true }` the callback fires synchronously with the current
-   * status. Powers the `useQuery` hook's `isFetching()` accessor.
-   */
   subscribeQueryStatus(queryHash: string, callback: QueryStatusCallback, options?: {
     immediate?: boolean;
   }): () => void;
-  /**
-   * Subscribe to a query's authority flips: `true` once server membership is
-   * known for it (a registration or poll landed, or a durable `_00_window`
-   * seed was read on boot), `false` when it is reset (bucket switch). With
-   * `{ immediate: true }` the callback fires synchronously with the current
-   * value. Powers the bindings' `isAuthoritative()` / cold-only `isLoading()`.
-   */
   subscribeQueryAuthority(queryHash: string, callback: QueryAuthorityCallback, options?: {
     immediate?: boolean;
   }): () => void;
-  /**
-   * Report the frontend processing time (ms) a client framework spent applying
-   * an update for a query (e.g. `useQuery`'s `reconcile()`), so DevTools/MCP can
-   * surface the "frontend" phase of the per-query timing breakdown.
-   */
   reportFrontendTiming(queryHash: string, ms: number): void;
+  create<T extends Record<string, unknown>>(id: string, data: T): Promise<T>;
+  update<T extends Record<string, unknown>>(_table: string, id: string, data: Partial<T>, options?: UpdateOptions): Promise<T>;
+  delete(_table: string, id: string): Promise<void>;
   run<B extends BackendNames<S>, R extends BackendRoutes<S, B>>(backend: B, path: R, payload: RoutePayload<S, B, R>, options?: RunOptions): Promise<void>;
-  bucket<B extends BucketNames<S>>(name: B): BucketHandle;
-  /** Cache-free handle. The blob cache reads the remote through this, so a
-   *  cache miss can't loop back into the cache. */
-  private rawBucket;
-  /** Blob cache counters for DevTools. */
-  getBlobCacheStats(): BlobCacheStats;
-  create(id: string, data: Record<string, unknown>): Promise<Record<string, unknown>>;
-  update(table: string, id: string, data: Record<string, unknown>, options?: UpdateOptions): Promise<{
-    [x: string]: /*elided*/any;
-  }>;
-  delete(table: string, id: string): Promise<void>;
-  /**
-   * Whether the local store is initialized and reads can be served. See the
-   * `localReady` field: this is deliberately independent of connectivity.
-   */
-  isLocalReady(): boolean;
+  get failedMutationCount(): number;
+  subscribeToFailedMutations(cb: (count: number) => void): () => void;
+  listFailedMutations(): Promise<FailedMutationRow[]>;
+  retryFailedMutation(mutationId: string): Promise<boolean>;
+  discardFailedMutation(mutationId: string): Promise<boolean>;
+  get tabRole(): TabRole$1 | null;
+  get remoteClient(): Surreal;
+  get localClient(): unknown;
+  get pendingMutationCount(): number;
+  /** Kept for the e2e suite; the saga core has no LIVE retry ladder. */
+  get liveRetryCount(): number;
+  subscribeToPendingMutations(cb: (count: number) => void): () => void;
+  get fetchingQueryCount(): number;
+  subscribeToFetchActivity(cb: (fetching: number) => void): () => void;
+  get syncHealth(): SyncHealth;
+  subscribeToSyncHealth(cb: (health: SyncHealth) => void): () => void;
+  get storageHealth(): StorageHealth;
+  subscribeToStorageHealth(cb: (health: StorageHealth) => void): () => void;
+  /** The engine state, read-only. For tests and DevTools. */
+  get state(): ClientState;
+  /** Feed an event into the engine. For adapters, tests and DevTools. */
+  dispatch(event: RuntimeEvent): Promise<void>;
+  authenticate(token: string): Promise<surrealdb0.Tokens>;
+  deauthenticate(): Promise<void>;
   useRemote<T>(fn: (client: Surreal) => Promise<T> | T): Promise<T>;
-  /**
-   * Run one raw SurrealQL statement on the remote through the client's own
-   * query path: the connect gate (it never runs on a socket whose namespace
-   * and token are not applied yet), the per-statement timeout and the
-   * concurrency limit. Prefer this over {@link useRemote} for one-shot reads
-   * such as counts; `useRemote` hands out the bare SDK client and raced a
-   * reconnect with "Specify a namespace to use".
-   */
   remoteQuery<T extends unknown[]>(sql: string, vars?: Record<string, unknown>): Promise<T>;
-  /**
-   * Mint the salt used for query-id hashing, so two sessions registering the
-   * same logical query get distinct `_00_query` rows.
-   *
-   * Generated LOCALLY, deliberately. This used to be `RETURN <string>session::id()`,
-   * which cost a serial round trip on the critical boot path and resolved to
-   * `''` offline. The value never needed to come from the server: the server
-   * derives its own `clientId` inside `fn::query::register` and *ignores*
-   * whatever the caller passed, and the permission rules that matter gate on
-   * `auth_id = $auth.id` rather than the session (`_00_list_ref`). Session
-   * scoping via `clientId = session::id()` was in fact removed upstream because
-   * it broke a user with two tabs open. All this value has to be is unique per
-   * browser session, which `randomUUID` gives us for free and offline.
-   */
-  /**
-   * The current principal as the `"table:id"` string the in-browser SSP wants
-   * for `$auth.id`, or null when signed out.
-   *
-   * Tolerates BOTH shapes `currentUser.id` can take, which is the point:
-   * a session restored from the cached token carries a plain string (the JWT's
-   * `ID` claim), while one verified by the server carries a RecordId. Passing
-   * the former to `encodeRecordId` reads `.table` off a string and throws
-   * during boot.
-   */
-  /**
-   * Prime the in-browser circuit from the local store. Builds the context the
-   * stream processor needs: every synced table (the app schema plus the
-   * server-written meta tables that sync down), a schema hash so a snapshot
-   * projected under another schema is not trusted, and the ids whose local
-   * `_00_rv` was bumped by an unsettled mutation.
-   */
-  private primeCircuit;
-  private sessionAuthId;
-  private mintSessionSalt;
+  feature(key: string, options?: FeatureFlagOptions): FeatureFlagHandle;
+  setFeatureOverride(key: string, variant: string | null, payload?: unknown): void;
+  clearFeatureOverrides(): void;
+  getFeatureOverrides(): Record<string, FeatureFlagOverride>;
+  appRelease(app: string, options?: AppReleaseOptions): AppReleaseHandle;
+  openCrdtField(table: string, recordId: string, field: string, fallbackText?: string): Promise<CrdtField>;
+  closeCrdtField(table: string, recordId: string, field: string): void;
+  bucket<B extends BucketNames<S>>(name: B): BucketHandle;
+  getBlobCacheStats(): BlobCacheStats;
 }
 //#endregion
 //#region src/utils/semver.d.ts
@@ -3065,4 +2355,4 @@ declare function textToHtml(text: string): string;
  */
 
 //#endregion
-export { AppReleaseHandle, AppReleaseModule, type AppReleaseOptions, type AppReleaseSnapshot, AuthEventSystem, AuthEventTypeMap, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, type BlobCacheStats, type BlobEntry, type BlobKey, type BlobReadOptions, type BlobUrlLease, type BlurhashEncodeOptions, type BlurhashSetting, BucketHandle, BucketPutOptions, BucketPutResult, CURSOR_COLORS, ConnectionState, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, DebounceOptions, EventSubscriptionOptions, FeatureFlagHandle, FeatureFlagModule, type FeatureFlagOptions, type FeatureFlagOverride, type FeatureFlagSnapshot, Level, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, MembershipOutcome, MutationCallback, MutationEvent, MutationEventType, PersistenceClient, PhaseStat, PinoTransmit, PreloadOptions, PreloadRefresh, QueryAuthorityCallback, QueryConfig, QueryConfigRecord, QueryHash, QueryState, QueryStatus, QueryStatusCallback, QueryTimeToLive, QueryTimings, QueryUpdateCallback, ReconnectConfig, RecordVersionArray, RecordVersionDiff, RegistrationTimings, RunOptions, ServerViewMeta, Sp00kyClient, Sp00kyConfig, Sp00kyQueryResult, Sp00kyQueryResultPromise, StorageHealth, StorageHealthStatus, StoreType, SyncHealth, SyncHealthConfig, SyncHealthStatus, TimingPhase, UpdateOptions, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, isBlurhashValid, isImagePath, semverGt, textToHtml };
+export { AppReleaseHandle, AppReleaseModule, type AppReleaseOptions, type AppReleaseSnapshot, AuthEventSystem, AuthEventTypeMap, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, type BlobCacheStats, type BlobEntry, type BlobKey, type BlobReadOptions, type BlobUrlLease, type BlurhashEncodeOptions, type BlurhashSetting, BucketHandle, BucketPutOptions, BucketPutResult, CURSOR_COLORS, ConnectionState, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, DebounceOptions, EventSubscriptionOptions, type FailedMutationRow as FailedMutation, FeatureFlagHandle, FeatureFlagModule, type FeatureFlagOptions, type FeatureFlagOverride, type FeatureFlagSnapshot, Level, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, MembershipOutcome, MutationCallback, MutationEvent, MutationEventType, PersistenceClient, PhaseStat, PinoTransmit, PreloadOptions, PreloadRefresh, QueryAuthorityCallback, QueryConfig, QueryConfigRecord, QueryHash, QueryState, QueryStatus, QueryStatusCallback, QueryTimeToLive, QueryTimings, QueryUpdateCallback, ReconnectConfig, RecordVersionArray, RecordVersionDiff, RegistrationTimings, RunOptions, ServerViewMeta, Sp00kyClient, Sp00kyClientDeps, Sp00kyConfig, Sp00kyQueryResult, Sp00kyQueryResultPromise, StorageHealth, StorageHealthStatus, StoreType, SyncHealth, SyncHealthConfig, SyncHealthStatus, TimingPhase, UpdateOptions, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, isBlurhashValid, isImagePath, semverGt, textToHtml };