@spooky-sync/core 0.0.1-canary.279 → 0.0.1-canary.281

package/AGENTS.md

@@ -41,6 +41,8 @@ re-materialized from state, never patched in place.
 - `CrdtManager`, `CrdtField`, `cursorColorFromName`, `CURSOR_COLORS` — Loro-CRDT integration.
 - Types: `Sp00kyConfig` (client-solid wraps it as `SyncedDbConfig`), `QueryTimeToLive`, `PersistenceClient`, `StoreType`, `UpdateOptions`, `RunOptions`, `PreloadOptions`.
 - Subpath: `@spooky-sync/core/otel` — `createOtelTransmit(endpoint)` for piping pino logs to OpenTelemetry.
+- `client.webPush` (`WebPushModule`, `db.webPush` in the Solid bindings) - Web Push on the page: `support()`, `info()`, `subscribe(opts)` (call from a click), `unsubscribe(opts)`, `sync()`, `isSubscribed()`, `update(opts)`, `devices()`, `notify(msg)`, `cancel(id)`, `test()`, `bridge()`, `onMessage(cb)`. Server calls are `fn::push::*`; typed `WebPushError`; config `webPush` in `types.ts`. Sign-out runs through `AuthService.onBeforeSignOut`.
+- Subpaths for service workers, workers and Node (no wasm, no pino, no DOM; `scripts/check-worker-entries.mjs` enforces it in `build`): `@spooky-sync/core/pure` (protocol builders), `@spooky-sync/core/live` (`createLiveFeed`, the live subscriber over the pure-JS SDK), `@spooky-sync/core/sw` (`installPushHandlers`, `getBridgedToken`). Built by the second tsdown config; chunks are prefixed `worker-`. See `docs/web-push-design.md` at the repo root.
 
 ## Common gotchas
 

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-import { $ as ORIGIN_TOKEN_KEY, A as RunOptions, B as SyncHealthStatus, C as QueryTimeToLive, D as RecordVersionArray, E as ReconnectConfig, F as StorageHealth, G as DatabaseEventTypes, H as UpdateOptions, I as StorageHealthStatus, J as EventSystem, K as SealedQuery, L as StoreType, M as Sp00kyConfig, N as Sp00kyQueryResult, O as RecordVersionDiff, P as Sp00kyQueryResultPromise, Q as ImpersonationTimers, R as SyncHealth, S as QueryStatusCallback, T as QueryUpdateCallback, U as LocalStore, V as TimingPhase, W as DatabaseEventSystem, X as ImpersonationInfo, Y as IMPERSONATION_ACCESS, Z as ImpersonationTimerHost, _ as QueryConfig, a as Level, at as sameImpersonation, b as QueryState, c as MutationCallback, d as PersistenceClient, et as SESSION_POLL_MS, f as PhaseStat, g as QueryAuthorityCallback, h as PreloadRefresh, i as InlineRow, it as renewDelayMs, j as ServerViewMeta, k as RegistrationTimings, l as MutationEvent, m as PreloadOptions, n as DebounceOptions, nt as decodeTokenClaims, o as MATERIALIZATION_SAMPLE_WINDOW, p as PinoTransmit, q as EventDefinition, r as EventSubscriptionOptions, rt as impersonationFromToken, s as MembershipOutcome, t as ConnectionState, tt as TokenClaims, u as MutationEventType, v as QueryConfigRecord, w as QueryTimings, x as QueryStatus, y as QueryHash, z as SyncHealthConfig } from "./types.js";
-import { AccessDefinition, BackendNames, BackendRoutes, BucketNames, ColumnSchema, FinalQuery, GetTable, QueryBuilder, QueryOptions, QueryPlan, RecordId, RoutePayload, SchemaStructure, TableModel, TableNames, TypeNameToTypeMap } from "@spooky-sync/query-builder";
+import { $ as WebPushSupport, A as RunOptions, At as SealedQuery, B as SyncHealthStatus, Bt as decodeTokenClaims, C as QueryTimeToLive, Ct as AuthEventSystem, D as RecordVersionArray, Dt as RemoteDatabaseService, E as ReconnectConfig, Et as createAuthEventSystem, F as StorageHealth, Ft as ImpersonationTimerHost, G as WebPushDevice, H as UpdateOptions, Ht as renewDelayMs, I as StorageHealthStatus, It as ImpersonationTimers, J as WebPushInfo, K as WebPushError, L as StoreType, Lt as ORIGIN_TOKEN_KEY, M as Sp00kyConfig, Mt as EventSystem, N as Sp00kyQueryResult, Nt as IMPERSONATION_ACCESS, O as RecordVersionDiff, Ot as Logger$1, P as Sp00kyQueryResultPromise, Pt as ImpersonationInfo, Q as WebPushSubscribeOptions, R as SyncHealth, Rt as SESSION_POLL_MS, S as QueryStatusCallback, St as SignOutHook, T as QueryUpdateCallback, Tt as AuthEventTypes, U as PUSH_ENDPOINT_KEY, Ut as sameImpersonation, V as TimingPhase, Vt as impersonationFromToken, W as WebPushConfig, X as WebPushMessageInput, Y as WebPushMessage, Z as WebPushModule, _ as QueryConfig, _t as ActiveImpersonation, a as Level, at as detectWebPushSupport, b as QueryState, bt as SIGN_OUT_HOOK_TIMEOUT_MS, c as MutationCallback, ct as PUSH_PAYLOAD_VERSION, d as PersistenceClient, dt as PushOp, et as WebPushSyncOptions, f as PhaseStat, ft as PushPayload, g as QueryAuthorityCallback, gt as isPushPayload, h as PreloadRefresh, ht as WebPushClientMessage, i as InlineRow, it as WebPushUpdateOptions, j as ServerViewMeta, jt as EventDefinition, k as RegistrationTimings, kt as LocalStore, l as MutationEvent, lt as PushNotification, m as PreloadOptions, mt as PushUrgency, n as DebounceOptions, nt as WebPushUnsubscribeOptions, o as MATERIALIZATION_SAMPLE_WINDOW, ot as BridgeSignOutMessage, p as PinoTransmit, pt as PushPayloadKind, q as WebPushErrorCode, r as EventSubscriptionOptions, rt as WebPushUnsupportedReason, s as MembershipOutcome, st as BridgeTokenMessage, t as ConnectionState, tt as WebPushSyncStatus, u as MutationEventType, ut as PushNotificationAction, v as QueryConfigRecord, vt as AuthService, w as QueryTimings, wt as AuthEventTypeMap, x as QueryStatus, xt as SignOutContext, y as QueryHash, yt as ImpersonationCandidate, z as SyncHealthConfig, zt as TokenClaims } from "./types.js";
+import { BackendNames, BackendRoutes, BucketNames, FinalQuery, GetTable, QueryBuilder, QueryOptions, QueryPlan, RecordId, RoutePayload, SchemaStructure, TableModel, TableNames } from "@spooky-sync/query-builder";
 import * as surrealdb0 from "surrealdb";
-import { Duration, RecordId as RecordId$1, Surreal, SurrealEvents, SurrealTransaction } from "surrealdb";
-import { Level as Level$1, Logger } from "pino";
+import { Duration, RecordId as RecordId$1, Surreal } from "surrealdb";
+import { Logger } from "pino";
 import { decode, encode, isBlurhashValid } from "blurhash";
 import { LoroDoc } from "loro-crdt";
 
@@ -87,188 +87,6 @@ type LeaderToFollowerMessage = {
   count: number;
 };
 //#endregion
-//#region src/services/logger/index.d.ts
-type Logger$1 = Logger;
-//#endregion
-//#region src/services/database/database.d.ts
-declare abstract class AbstractDatabaseService {
-  protected client: Surreal;
-  protected logger: Logger$1;
-  protected events: DatabaseEventSystem;
-  /**
-   * Per-query deadline in ms; `0` disables. The remote service sets it from
-   * `queryTimeoutMs` (see `RemoteDatabaseService`), the local one from
-   * `localOpTimeoutMs` (see `LocalDatabaseService`): a local query can be
-   * legitimately slow, but it must never be endless - every query waits on the
-   * previous link of {@link query}'s chain, and one that never settled wedged
-   * every later local op behind it.
-   */
-  protected queryTimeoutMs: number;
-  /** The error a deadline expiry rejects with; the local service substitutes
-   *  its typed `LocalOpTimeoutError`. "timed out" in the message is
-   *  load-bearing either way: `classifySyncError` keys off it. */
-  protected timeoutError(_query: string): Error;
-  protected abstract eventType: typeof DatabaseEventTypes.LocalQuery | typeof DatabaseEventTypes.RemoteQuery;
-  constructor(client: Surreal, logger: Logger$1, events: DatabaseEventSystem);
-  abstract connect(): Promise<void>;
-  getClient(): Surreal;
-  getEvents(): DatabaseEventSystem;
-  tx(): Promise<SurrealTransaction>;
-  /**
-   * How many statements may be in flight at once.
-   *
-   * `1` serializes every statement behind the previous one. The local engines
-   * need that: overlapping ops trip the WASM / SQLite transaction layer. The
-   * remote service raises it (`RemoteDatabaseService`): a SurrealDB socket
-   * multiplexes requests by id, and serializing them capped the client at one
-   * statement per round trip (~5/s at 170ms RTT), so the `_00_list_ref` poll
-   * alone could hold every registration behind it and one slow one-shot read
-   * stalled the whole client. The scheduler's `MAX_CONCURRENT_DOWN` only means
-   * something when this is above 1.
-   */
-  protected maxConcurrentQueries: number;
-  private inFlightQueries;
-  private queryWaiters;
-  /** FIFO slot acquisition, so `maxConcurrentQueries = 1` keeps strict order. */
-  private acquireQuerySlot;
-  private releaseQuerySlot;
-  /**
-   * Hook run right before a statement is sent, inside its slot. The remote
-   * service uses it to hold statements while a connect is in flight, so a
-   * query never runs on a socket that is open but has not had its namespace
-   * and token applied yet. The default does nothing.
-   */
-  protected beforeQuery(): Promise<void>;
-  /**
-   * Execute a statement under {@link maxConcurrentQueries}.
-   *
-   * A statement that never settles would hold its slot forever, and with a
-   * limit of 1 that blocks every later statement behind it. {@link
-   * queryTimeoutMs} bounds each one: on expiry this promise rejects and the
-   * slot is released, even though the underlying RPC is still parked in the
-   * SDK's pending map.
-   */
-  query<T extends unknown[]>(query: string, vars?: Record<string, unknown>): Promise<T>;
-  /**
-   * Like {@link query} but never rejects on a statement error: every
-   * statement answers on its own as `{ status: 'OK', result }` or
-   * `{ status: 'ERR', error }`. This is what lets a batched outbox push judge
-   * each mutation separately.
-   */
-  queryResponses(query: string, vars?: Record<string, unknown>): Promise<Array<{
-    status: 'OK';
-    result: unknown;
-  } | {
-    status: 'ERR';
-    error: string;
-  }>>;
-  private runStatement;
-  execute<T>(query: SealedQuery<T>, vars?: Record<string, unknown>): Promise<T>;
-  close(): Promise<void>;
-}
-//#endregion
-//#region src/services/database/remote.d.ts
-/** Transport events the SDK publishes, mapped 1:1 to {@link ConnectionState}. */
-type RemoteConnectionEvent = ConnectionState | 'error';
-declare class RemoteDatabaseService extends AbstractDatabaseService {
-  private config;
-  protected eventType: "DATABASE_REMOTE_QUERY";
-  private readonly reconnectConfig;
-  /**
-   * In-flight `connect()`, so concurrent callers (boot + supervisor revive +
-   * an `online` event landing at the same moment) share one attempt instead of
-   * racing two sockets. Cleared on settle, so a later call always reconnects.
-   */
-  private connecting;
-  /**
-   * The token to re-authenticate a freshly opened socket with, kept current by
-   * {@link setAuthToken}.
-   *
-   * `config.token` is fixed at construction and most apps never set it: they
-   * sign in later, which authenticates the socket that happens to be open at
-   * the time. That is enough for the SDK's OWN reconnects (it replays
-   * `version`/`use`/`authenticate` itself), but not for the supervisor's revive
-   * loop, which builds a socket from scratch. Without this the revived socket
-   * came back UNAUTHENTICATED and stayed that way for the life of the page,
-   * while the client's `currentUserId` — restored from local storage — kept
-   * reporting the user as signed in.
-   *
-   * The visible damage is silent and total: `fn::query::register` sends
-   * `<string>($auth.id OR '')`, so every view registered afterwards is stamped
-   * with an empty identity, and every `$auth.id` predicate in it resolves
-   * false. Public tables keep returning rows while everything owned by the user
-   * returns nothing, on a page that still looks signed in.
-   */
-  private authToken;
-  constructor(config: Sp00kyConfig<any>['database'], logger: Logger$1);
-  getConfig(): Sp00kyConfig<any>['database'];
-  /**
-   * Send one SurrealQL statement so that it survives the page going away.
-   *
-   * A WebSocket `send()` during `pagehide` is not guaranteed to flush — the
-   * browser may tear the socket down first, and the frame is simply lost.
-   * Measured: an unload-time release over the live socket reached the server
-   * zero times out of one. `fetch` with `keepalive` is the primitive the
-   * platform actually guarantees here, so this goes over SurrealDB's HTTP
-   * `/sql` endpoint instead of the RPC socket.
-   *
-   * Best-effort by design: no await, no retry, errors swallowed. Every caller
-   * must have a server-side fallback that makes a lost beacon a non-event.
-   */
-  beaconSql(sql: string): void;
-  /**
-   * Record the token every future connect should authenticate with, or `null`
-   * on sign-out. See {@link authToken}.
-   *
-   * Does not touch the CURRENT socket: callers authenticate that themselves
-   * (sign-in and session restore both already do). This only makes the next
-   * from-scratch connect reproduce that state.
-   */
-  setAuthToken(token: string | null): void;
-  /** Resolved reconnect tunables; the supervisor reads its own knobs here. */
-  getReconnectConfig(): Required<ReconnectConfig>;
-  /** Current transport state as reported by the SDK. */
-  getStatus(): ConnectionState;
-  /**
-   * Observe transport events. Thin passthrough so callers (the supervisor,
-   * sync, CRDT) don't have to reach through `getClient()`.
-   */
-  subscribeConnection<K extends RemoteConnectionEvent>(event: K, cb: (...payload: SurrealEvents[K]) => void): () => void;
-  /**
-   * Tear the socket down on purpose. Used by the heartbeat watchdog when a
-   * socket stops answering but never closes: `close()` makes the SDK publish
-   * `disconnected`, which is what drives the supervisor's revive loop.
-   */
-  forceClose(): Promise<void>;
-  /**
-   * Hold statements while a connect is in flight.
-   *
-   * `connect()` opens the socket, then selects the namespace/database, then
-   * authenticates - three round trips. The SDK considers the connection ready
-   * after the first, so a query queued during the other two ran on a socket
-   * with no namespace ("Specify a namespace to use") or, worse, no identity.
-   * Seen 2026-09-06 after the supervisor rebuilt a socket: a collection
-   * recount failed with exactly that error. Waiting on the in-flight connect
-   * costs nothing when no connect is running; a failed connect is not
-   * swallowed here - the query then fails on its own, as before.
-   */
-  protected beforeQuery(): Promise<void>;
-  /**
-   * Open (or re-open) the remote connection.
-   *
-   * Safe to call repeatedly: concurrent calls share the in-flight attempt, and
-   * a call after a `disconnected` builds a fresh socket. `use()` and
-   * `authenticate()` are re-applied here for the cold path; the SDK also
-   * replays them itself on its own internal reconnects.
-   */
-  connect(): Promise<void>;
-  private doConnect;
-  signin(params: any): Promise<any>;
-  signup(params: any): Promise<any>;
-  authenticate(token: string): Promise<any>;
-  invalidate(): Promise<void>;
-}
-//#endregion
 //#region src/services/database/connection-supervisor.d.ts
 /**
  * Keeps the remote WebSocket alive for the whole life of the page.
@@ -674,148 +492,6 @@ declare class StreamProcessorService {
   private normalizeValue;
 }
 //#endregion
-//#region src/modules/auth/events/index.d.ts
-declare const AuthEventTypes: {
-  readonly AuthStateChanged: "AUTH_STATE_CHANGED";
-  readonly ImpersonationChanged: "IMPERSONATION_CHANGED";
-};
-type AuthEventTypeMap = {
-  [AuthEventTypes.AuthStateChanged]: EventDefinition<typeof AuthEventTypes.AuthStateChanged, string | null>;
-  [AuthEventTypes.ImpersonationChanged]: EventDefinition<typeof AuthEventTypes.ImpersonationChanged, ImpersonationInfo | null>;
-};
-type AuthEventSystem = EventSystem<AuthEventTypeMap>;
-declare function createAuthEventSystem(): AuthEventSystem;
-//#endregion
-//#region src/modules/auth/index.d.ts
-/** What `fn::_00_impersonate::list_users` returns per row. */
-interface ImpersonationCandidate {
-  id: string;
-  is_admin: boolean;
-  [field: string]: unknown;
-}
-/** An open session, as `fn::_00_impersonate::active` lists it. */
-interface ActiveImpersonation {
-  session: string;
-  target: string;
-  admin: string;
-  reason: string;
-  started_at: unknown;
-  expires_at: unknown;
-}
-type Prettify<T> = { [K in keyof T]: T[K] } & {};
-type MapColumnType<T extends ColumnSchema> = T['optional'] extends true ? TypeNameToTypeMap[T['type']] | undefined : TypeNameToTypeMap[T['type']];
-type ExtractAccessParams<S extends SchemaStructure, Name extends keyof S['access'], Method extends 'signIn' | 'signup'> = S['access'] extends undefined ? never : S['access'][Name] extends AccessDefinition ? Prettify<{ [K in keyof S['access'][Name][Method]['params']]: MapColumnType<S['access'][Name][Method]['params'][K]> }> : never;
-declare class AuthService<S extends SchemaStructure> {
-  private schema;
-  private remote;
-  private persistenceClient;
-  private logger;
-  token: string | null;
-  currentUser: any | null;
-  isAuthenticated: boolean;
-  /**
-   * The record-access method name for the current session (e.g. `"account"`),
-   * derived from the token's `AC` claim. Consumed by the in-browser SSP's
-   * permission injection so `$access`-gated table predicates resolve locally,
-   * mirroring the server's `$access`. Null when logged out.
-   */
-  access: string | null;
-  isLoading: boolean;
-  private events;
-  /** The impersonation last announced, for change detection. */
-  private announcedImpersonation;
-  /** Target of an impersonation that just ended, until the client purges its
-   *  local bucket (see `consumeEndedImpersonation`). */
-  private endedImpersonationTarget;
-  private impersonationTimers;
-  get eventSystem(): AuthEventSystem;
-  constructor(schema: S, remote: RemoteDatabaseService, persistenceClient: PersistenceClient, logger: Logger$1);
-  init(): Promise<void>;
-  getAccessDefinition<Name extends keyof S['access']>(name: Name): AccessDefinition | undefined;
-  /**
-   * Subscribe to auth state changes.
-   * callback is called immediately with current value and whenever validation status changes.
-   */
-  subscribe(cb: (userId: string | null) => void): () => void;
-  private notifyListeners;
-  /**
-   * The impersonation the current session is, or null. Derived from the
-   * token in use, so it always describes the identity the server sees.
-   */
-  get impersonation(): ImpersonationInfo | null;
-  /** Subscribe to impersonation changes; called immediately with the current value. */
-  subscribeImpersonation(cb: (info: ImpersonationInfo | null) => void): () => void;
-  /**
-   * Act as `targetId` (a record id such as `user:abc`). Admins only, and only
-   * when the project enabled `impersonation` in sp00ky.yml: the server refuses
-   * everything else. `reason` is recorded in the audit log.
-   *
-   * The admin's session is kept aside and restored by
-   * {@link stopImpersonating}. Local data switches to the target's bucket
-   * exactly as on a sign-in, and that bucket is removed on stop.
-   */
-  impersonate(targetId: string, reason: string): Promise<ImpersonationInfo>;
-  /**
-   * Return to the admin session. Always leaves the impersonated identity,
-   * even when the server cannot be reached: the admin token is restored
-   * locally first and verified afterwards, and a rejected admin token ends in
-   * a full sign-out rather than staying on the target.
-   */
-  stopImpersonating(opts?: {
-    serverEnded?: boolean;
-  }): Promise<void>;
-  /** Re-sign the impersonation token before it expires. */
-  renewImpersonation(): Promise<void>;
-  /** Users an admin may pick from. Admin-only on the server. */
-  searchImpersonationTargets(search: string): Promise<ImpersonationCandidate[]>;
-  /** Open impersonation sessions. Admin-only on the server. */
-  listActiveImpersonations(): Promise<ActiveImpersonation[]>;
-  /**
-   * The target of an impersonation that ended, once. The bucket switch calls
-   * this after leaving a bucket so it can delete that user's local data.
-   */
-  consumeEndedImpersonation(): string | null;
-  /**
-   * Restore a session from the locally cached JWT, with NO network.
-   *
-   * This is what makes a warm boot paint instantly and what makes an offline
-   * boot possible at all: the token is in local storage, and it already carries
-   * both the access method and the `$auth.id` record id. Everything the client
-   * needs to route queries (`setCurrentUserId`) and to satisfy `$auth`-gated
-   * permission predicates in the in-browser SSP (`setSessionAuth`) is therefore
-   * available before a socket exists.
-   *
-   * The session is OPTIMISTIC: the token is unverified here. `check()` runs
-   * afterwards in the background and downgrades to a real sign-out if the
-   * server rejects it. Nothing is trusted that the server has not also seen -
-   * the local store only ever holds rows the server previously sent.
-   *
-   * Returns the restored user id, or null when there is no usable token.
-   */
-  restoreSessionFromToken(): Promise<string | null>;
-  /**
-   * Check for existing session and validate
-   */
-  check(accessToken?: string): Promise<void>;
-  /**
-   * The server refused `token`. A refused impersonation token (stopped,
-   * expired, or revoked) returns to the admin session instead of signing the
-   * admin out; anything else signs out.
-   */
-  private rejectToken;
-  /**
-   * Sign out and clear session. While impersonating this ends the
-   * impersonation and signs the admin out too.
-   */
-  signOut(): Promise<void>;
-  private setSession;
-  /** Fallback when the token carries no `AC` claim: if the schema defines
-   *  exactly one record-access method, assume the session used it. */
-  private defaultAccessName;
-  signUp<Name extends keyof S['access'] & string>(accessName: Name, params: ExtractAccessParams<S, Name, 'signup'>): Promise<void>;
-  signIn<Name extends keyof S['access'] & string>(accessName: Name, params: ExtractAccessParams<S, Name, 'signIn'>): Promise<void>;
-}
-//#endregion
 //#region src/modules/crdt/crdt-field.d.ts
 declare const CURSOR_COLORS: string[];
 declare function cursorColorFromName(name: string): string;
@@ -2314,6 +1990,8 @@ declare class Sp00kyClient<S extends SchemaStructure> {
   private readonly config;
   readonly auth: AuthService<S>;
   readonly streamProcessor: StreamProcessorService;
+  /** Web Push for this browser: subscribe, devices, self-pushes, service worker bridge. */
+  readonly webPush: WebPushModule;
   private readonly services;
   private readonly env;
   private readonly runtime;
@@ -2457,4 +2135,4 @@ declare function textToHtml(text: string): string;
  */
 
 //#endregion
-export { ActiveImpersonation, AppReleaseHandle, AppReleaseModule, type AppReleaseOptions, type AppReleaseSnapshot, AuthEventSystem, AuthEventTypeMap, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, type BlobCacheStats, type BlobEntry, type BlobKey, type BlobReadOptions, type BlobUrlLease, type BlurhashEncodeOptions, type BlurhashSetting, BucketHandle, BucketPutOptions, BucketPutResult, CURSOR_COLORS, ConnectionState, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, DebounceOptions, EventSubscriptionOptions, type FailedMutationRow as FailedMutation, FeatureFlagHandle, FeatureFlagModule, type FeatureFlagOptions, type FeatureFlagOverride, type FeatureFlagSnapshot, IMPERSONATION_ACCESS, ImpersonationCandidate, ImpersonationInfo, ImpersonationTimerHost, ImpersonationTimers, InlineRow, Level, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, MembershipOutcome, MutationCallback, MutationEvent, MutationEventType, ORIGIN_TOKEN_KEY, PersistenceClient, PhaseStat, PinoTransmit, PreloadOptions, PreloadRefresh, QueryAuthorityCallback, QueryConfig, QueryConfigRecord, QueryHash, QueryState, QueryStatus, QueryStatusCallback, QueryTimeToLive, QueryTimings, QueryUpdateCallback, ReconnectConfig, RecordVersionArray, RecordVersionDiff, RegistrationTimings, RunOptions, SESSION_POLL_MS, ServerViewMeta, Sp00kyClient, Sp00kyClientDeps, Sp00kyConfig, Sp00kyQueryResult, Sp00kyQueryResultPromise, StorageHealth, StorageHealthStatus, StoreType, SyncHealth, SyncHealthConfig, SyncHealthStatus, TimingPhase, TokenClaims, UpdateOptions, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, renewDelayMs, sameImpersonation, semverGt, textToHtml };
+export { ActiveImpersonation, AppReleaseHandle, AppReleaseModule, type AppReleaseOptions, type AppReleaseSnapshot, AuthEventSystem, AuthEventTypeMap, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, type BlobCacheStats, type BlobEntry, type BlobKey, type BlobReadOptions, type BlobUrlLease, type BlurhashEncodeOptions, type BlurhashSetting, type BridgeSignOutMessage, type BridgeTokenMessage, BucketHandle, BucketPutOptions, BucketPutResult, CURSOR_COLORS, ConnectionState, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, DebounceOptions, EventSubscriptionOptions, type FailedMutationRow as FailedMutation, FeatureFlagHandle, FeatureFlagModule, type FeatureFlagOptions, type FeatureFlagOverride, type FeatureFlagSnapshot, IMPERSONATION_ACCESS, ImpersonationCandidate, ImpersonationInfo, ImpersonationTimerHost, ImpersonationTimers, InlineRow, Level, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, MembershipOutcome, MutationCallback, MutationEvent, MutationEventType, ORIGIN_TOKEN_KEY, PUSH_ENDPOINT_KEY, PUSH_PAYLOAD_VERSION, PersistenceClient, PhaseStat, PinoTransmit, PreloadOptions, PreloadRefresh, type PushNotification, type PushNotificationAction, type PushOp, type PushPayload, type PushPayloadKind, type PushUrgency, QueryAuthorityCallback, QueryConfig, QueryConfigRecord, QueryHash, QueryState, QueryStatus, QueryStatusCallback, QueryTimeToLive, QueryTimings, QueryUpdateCallback, ReconnectConfig, RecordVersionArray, RecordVersionDiff, RegistrationTimings, RunOptions, SESSION_POLL_MS, SIGN_OUT_HOOK_TIMEOUT_MS, ServerViewMeta, SignOutContext, SignOutHook, Sp00kyClient, Sp00kyClientDeps, Sp00kyConfig, Sp00kyQueryResult, Sp00kyQueryResultPromise, StorageHealth, StorageHealthStatus, StoreType, SyncHealth, SyncHealthConfig, SyncHealthStatus, TimingPhase, TokenClaims, UpdateOptions, type WebPushClientMessage, type WebPushConfig, type WebPushDevice, WebPushError, type WebPushErrorCode, type WebPushInfo, type WebPushMessage, type WebPushMessageInput, WebPushModule, type WebPushSubscribeOptions, type WebPushSupport, type WebPushSyncOptions, type WebPushSyncStatus, type WebPushUnsubscribeOptions, type WebPushUnsupportedReason, type WebPushUpdateOptions, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, detectWebPushSupport, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, isPushPayload, renewDelayMs, sameImpersonation, semverGt, textToHtml };