@spooky-sync/core 0.0.1-canary.33 → 0.0.1-canary.331

package/dist/index.d.ts

@@ -1,74 +1,218 @@
-import { C as Logger$1, S as UpdateOptions, T as EventSystem, _ as RunOptions, a as MutationEvent, b as Sp00kyQueryResultPromise, c as PinoTransmit, d as QueryHash, f as QueryState, g as RecordVersionDiff, h as RecordVersionArray, i as MutationCallback, l as QueryConfig, m as QueryUpdateCallback, n as EventSubscriptionOptions, o as MutationEventType, p as QueryTimeToLive, r as Level, s as PersistenceClient, t as DebounceOptions, u as QueryConfigRecord, v as Sp00kyConfig, w as EventDefinition, x as StoreType, y as Sp00kyQueryResult } from "./types.js";
+import { $ as WebPushSubscribeOptions, A as RunOptions, At as Logger$1, B as SyncHealthStatus, Bt as SESSION_POLL_MS, C as QueryTimeToLive, Ct as SignOutHook, D as RecordVersionArray, Dt as createAuthEventSystem, E as ReconnectConfig, Et as AuthEventTypes, F as StorageHealth, Ft as IMPERSONATION_ACCESS, G as WebPushConfig, Gt as sameImpersonation, H as UpdateOptions, Ht as decodeTokenClaims, I as StorageHealthStatus, It as ImpersonationInfo, J as WebPushErrorCode, K as WebPushDevice, L as StoreType, Lt as ImpersonationTimerHost, M as Sp00kyConfig, Mt as SealedQuery, N as Sp00kyQueryResult, Nt as EventDefinition, O as RecordVersionDiff, Ot as RemoteDatabaseService, P as Sp00kyQueryResultPromise, Pt as EventSystem, Q as WebPushModule, R as SyncHealth, Rt as ImpersonationTimers, S as QueryStatusCallback, St as SignOutContext, T as QueryUpdateCallback, Tt as AuthEventTypeMap, U as PUSH_ENDPOINT_KEY, Ut as impersonationFromToken, V as TimingPhase, Vt as TokenClaims, W as PushDeviceKind, Wt as renewDelayMs, X as WebPushMessage, Y as WebPushInfo, Z as WebPushMessageInput, _ as QueryConfig, _t as isPushPayload, a as Level, at as WebPushUpdateOptions, b as QueryState, bt as ImpersonationCandidate, c as MutationCallback, ct as BridgeTokenMessage, d as PersistenceClient, dt as PushNotificationAction, et as WebPushSupport, f as PhaseStat, ft as PushOp, g as QueryAuthorityCallback, gt as WebPushClientMessage, h as PreloadRefresh, ht as PushUrgency, i as InlineRow, it as WebPushUnsupportedReason, j as ServerViewMeta, jt as LocalStore, k as RegistrationTimings, kt as LogTap, l as MutationEvent, lt as PUSH_PAYLOAD_VERSION, m as PreloadOptions, mt as PushPayloadKind, n as DebounceOptions, nt as WebPushSyncStatus, o as MATERIALIZATION_SAMPLE_WINDOW, ot as detectWebPushSupport, p as PinoTransmit, pt as PushPayload, q as WebPushError, r as EventSubscriptionOptions, rt as WebPushUnsubscribeOptions, s as MembershipOutcome, st as BridgeSignOutMessage, t as ConnectionState, tt as WebPushSyncOptions, u as MutationEventType, ut as PushNotification, v as QueryConfigRecord, vt as ActiveImpersonation, w as QueryTimings, wt as AuthEventSystem, x as QueryStatus, xt as SIGN_OUT_HOOK_TIMEOUT_MS, y as QueryHash, yt as AuthService, z as SyncHealthConfig, zt as ORIGIN_TOKEN_KEY } from "./types.js";
+import { BackendNames, BackendRoutes, BucketNames, FinalQuery, GetTable, QueryBuilder, QueryOptions, QueryPlan, RecordId, RoutePayload, SchemaStructure, TableModel, TableNames } from "@spooky-sync/query-builder";
 import * as surrealdb0 from "surrealdb";
-import { Duration, RecordId, Surreal, SurrealTransaction } from "surrealdb";
-import { AccessDefinition, BackendNames, BackendRoutes, BucketNames, ColumnSchema, GetTable, QueryBuilder, QueryOptions, RoutePayload, SchemaStructure, TableModel, TableNames, TypeNameToTypeMap } from "@spooky-sync/query-builder";
+import { Duration, RecordId as RecordId$1, Surreal } from "surrealdb";
 import { Logger } from "pino";
+import { decode, encode, isBlurhashValid } from "blurhash";
+import { LoroDoc } from "loro-crdt";
 
-//#region src/services/database/events/index.d.ts
-declare const DatabaseEventTypes: {
-  readonly LocalQuery: "DATABASE_LOCAL_QUERY";
-  readonly RemoteQuery: "DATABASE_REMOTE_QUERY";
-};
-interface DatabaseQueryEventPayload {
-  query: string;
-  vars?: Record<string, unknown>;
-  duration: number;
-  success: boolean;
-  error?: string;
-  timestamp: number;
-}
-type DatabaseEventTypeMap = {
-  [DatabaseEventTypes.LocalQuery]: EventDefinition<typeof DatabaseEventTypes.LocalQuery, DatabaseQueryEventPayload>;
-  [DatabaseEventTypes.RemoteQuery]: EventDefinition<typeof DatabaseEventTypes.RemoteQuery, DatabaseQueryEventPayload>;
+//#region src/services/tabs/protocol.d.ts
+
+type TabId = string;
+type TabRole$1 = 'solo' | 'leader' | 'follower';
+/** Broker pings every tab at this cadence. */
+
+/** Matches `CacheIngestTuple` (modules/cache): exactly what `ingestMany`
+ *  consumes, so relayed batches feed follower circuits without reshaping. */
+interface IngestTuple {
+  table: string;
+  op: 'CREATE' | 'UPDATE' | 'DELETE';
+  id: string;
+  record: Record<string, unknown>;
+}
+type FollowerToLeaderMessage = {
+  type: 'sync-hello';
+  tabId: TabId;
+}
+/** The follower committed an outbox row (through the shared store) and the
+ *  leader should drain it. Idempotent; a new leader's loadFromDatabase is
+ *  the backstop for a notify lost in a failover window. */ | {
+  type: 'mutation-enqueued';
+  mutationId: string;
+} | {
+  type: 'request-poll';
+}
+/** An optimistic write this follower committed to the SHARED store and
+ *  ingested into its own circuit. The leader ingests it (no DB write, the
+ *  row is already there) and fans it out to every OTHER follower as
+ *  `ingest-relay`, so a follower's write lands in every tab in one hop
+ *  instead of after the server round-trip. */ | {
+  type: 'ingest';
+  tuples: IngestTuple[];
 };
-type DatabaseEventSystem = EventSystem<DatabaseEventTypeMap>;
-//#endregion
-//#region src/utils/surql.d.ts
-interface SealedQuery<T = void> {
-  readonly sql: string;
-  readonly extract: (results: unknown[]) => T;
+type LeaderToFollowerMessage = {
+  type: 'db-ready';
+  leadershipId: number;
+  bucketId: string;
+  storageHealth: StorageHealth;
 }
-//#endregion
-//#region src/services/database/database.d.ts
-declare abstract class AbstractDatabaseService {
-  protected client: Surreal;
-  protected logger: Logger$1;
-  protected events: DatabaseEventSystem;
-  protected abstract eventType: typeof DatabaseEventTypes.LocalQuery | typeof DatabaseEventTypes.RemoteQuery;
-  constructor(client: Surreal, logger: Logger$1, events: DatabaseEventSystem);
-  abstract connect(): Promise<void>;
-  getClient(): Surreal;
-  getEvents(): DatabaseEventSystem;
-  tx(): Promise<SurrealTransaction>;
-  private queryQueue;
-  /**
-   * Execute a query with serialized execution to prevent WASM transaction issues.
-   */
-  query<T extends unknown[]>(query: string, vars?: Record<string, unknown>): Promise<T>;
-  execute<T>(query: SealedQuery<T>, vars?: Record<string, unknown>): Promise<T>;
-  close(): Promise<void>;
+/** Every ingest the leader's CacheModule committed, so follower circuits
+ *  stay live without their own fetch. seq detects gaps. */ | {
+  type: 'ingest-relay';
+  tuples: IngestTuple[];
+  leadershipId: number;
+  seq: number;
+}
+/** A `_00_list_ref` LIVE event, relayed verbatim. Each follower resolves the
+ *  queryId against its own DataModule and ignores foreign queries. */ | {
+  type: 'list-ref-change';
+  action: 'CREATE' | 'UPDATE' | 'DELETE';
+  queryId: string;
+  recordId: string;
+  version: number;
+  parent: boolean;
 }
+/** The leader's drain rolled back a mutation owned by this tab. */ | {
+  type: 'mutation-rolled-back';
+  mutationId: string;
+  recordId: string;
+  eventType: 'create' | 'update' | 'delete';
+  error: string;
+}
+/** The leader's drain pushed a mutation and deleted its outbox row from the
+ *  SHARED store. Every follower keeps the row in its overlay until its
+ *  `_00_list_ref` membership arrives. */ | {
+  type: 'mutation-settled';
+  mutationId: string;
+  recordId: string;
+  eventType: 'create' | 'update' | 'delete';
+}
+/** The leader's LIVE saw edges of these queries change; followers re-read
+ *  membership for the ones they hold. */ | {
+  type: 'membership-dirty';
+  hashes: string[];
+}
+/** The failed-writes tray changed size on the shared store. */ | {
+  type: 'failed-mutations-changed';
+  count: number;
+};
 //#endregion
-//#region src/services/database/local.d.ts
-declare class LocalDatabaseService extends AbstractDatabaseService {
-  private config;
-  protected eventType: "DATABASE_LOCAL_QUERY";
-  constructor(config: Sp00kyConfig<any>['database'], logger: Logger$1);
-  getConfig(): Sp00kyConfig<any>['database'];
-  connect(): Promise<void>;
+//#region src/services/database/connection-supervisor.d.ts
+/**
+ * Keeps the remote WebSocket alive for the whole life of the page.
+ *
+ * The SurrealDB SDK reconnects on its own after a socket `close`, but that
+ * covers only one of three ways the connection dies:
+ *
+ * 1. **Socket closes, SDK recovers.** Handled entirely by the SDK. This
+ *    supervisor only observes it (to report `reconnecting` upward).
+ * 2. **Socket closes, SDK gives up.** With `attempts: -1` this shouldn't happen
+ *    from exhaustion — but the SDK also terminates the engine permanently when
+ *    its post-reconnect handshake throws (it re-runs `version()`, `use()`,
+ *    `authenticate()` on every reconnect and closes the engine on any error).
+ *    One transient hiccup there would otherwise kill the page's connection for
+ *    good. The revive loop re-opens from scratch.
+ * 3. **Socket never closes at all.** A half-open connection: the peer is gone
+ *    (NAT timeout, wifi switch, laptop sleep) but no FIN ever arrives, so
+ *    `readyState` stays OPEN and the SDK's own 30s ping — fire-and-forget, no
+ *    response deadline — never notices. Nothing ever fires a `close` event, so
+ *    nothing ever triggers a reconnect. The heartbeat detects this and forces
+ *    the teardown that case 2's loop then repairs.
+ *
+ * Plus wake triggers: coming back `online` or un-hiding the tab probes
+ * immediately rather than waiting out a backoff that was scheduled while the
+ * network was known-down.
+ */
+declare class ConnectionSupervisor {
+  private readonly remote;
+  private readonly logger;
+  private readonly config;
+  private state;
+  private subscribers;
+  private started;
+  private disposed;
+  private heartbeatTimer;
+  private heartbeatInFlight;
+  /** Consecutive failed probes. See {@link FAILURES_BEFORE_TEARDOWN}. */
+  private heartbeatFailures;
+  private reviveTimer;
+  private reviveAttempts;
+  /** Timestamp of the last wake-triggered probe, for rate limiting. */
+  private lastWakeProbeAt;
+  private reviving;
+  /**
+   * Set while the browser reports itself offline. Retrying a socket against a
+   * down interface only burns backoff, so the loop parks until `online` fires.
+   */
+  private suspended;
+  private teardown;
+  private static readonly REVIVE_BASE_MS;
+  /**
+   * How many consecutive heartbeat failures it takes to tear the socket down.
+   *
+   * The probe rides the same serialized queue as every other RPC (deliberately
+   * — see {@link beat}), which means it cannot distinguish a WEDGED queue from
+   * a merely BUSY one. A single slow window (a large sync burst, one heavy
+   * app query) used to be enough to force-close a perfectly healthy socket,
+   * and the resulting reconnect re-registered every active query about a
+   * second later. That self-inflicted teardown manufactured the very reconnect
+   * storms this class exists to survive. A genuinely dead socket still fails
+   * every probe, so it is torn down one interval later than before.
+   */
+  private static readonly FAILURES_BEFORE_TEARDOWN;
+  /** Retry delay after an inconclusive (first) heartbeat failure. */
+  private static readonly HEARTBEAT_RETRY_MS;
+  /** Floor between probes triggered by wake events (tab focus, pageshow). */
+  private static readonly WAKE_PROBE_MIN_INTERVAL_MS;
+  constructor(remote: RemoteDatabaseService, logger: Logger$1, config?: Required<ReconnectConfig>);
+  /** Latest observed transport state. */
+  get connection(): ConnectionState;
+  /**
+   * Observe transport state. Fires immediately with the current value and again
+   * on every change. Returns an unsubscribe.
+   */
+  subscribe(cb: (state: ConnectionState) => void): () => void;
+  /**
+   * Begin supervising. Call once, after the initial {@link
+   * RemoteDatabaseService.connect}. Idempotent.
+   */
+  start(): void;
+  /** Stop all timers and listeners. Safe to call more than once. */
+  dispose(): void;
+  private setState;
+  private clearReviveTimer;
+  /**
+   * Queue the next `connect()` attempt on exponential backoff, capped at
+   * `superviseRetryDelayMaxMs`. Never gives up — the page is expected to
+   * outlive any outage.
+   */
+  private scheduleRevive;
+  private revive;
+  private stopHeartbeat;
+  private startHeartbeat;
+  /**
+   * Probe the server end-to-end. Deliberately goes through
+   * `remote.query` — the same serialized queue every other remote call uses —
+   * so a queue wedged behind a stuck RPC also fails the heartbeat instead of
+   * being invisible to it.
+   */
+  private beat;
+  /**
+   * A restored network or an un-hidden tab is the strongest available hint that
+   * a reconnect will now succeed, so probe immediately instead of waiting out a
+   * backoff scheduled under worse conditions.
+   */
+  private installWakeTriggers;
+  /**
+   * Reset the backoff and act on whichever problem is present: reconnect if the
+   * socket is gone, otherwise probe it (it may be half-open — which is exactly
+   * what a sleep/wake cycle produces).
+   */
+  private wake;
 }
 //#endregion
-//#region src/services/database/remote.d.ts
-declare class RemoteDatabaseService extends AbstractDatabaseService {
-  private config;
-  protected eventType: "DATABASE_REMOTE_QUERY";
-  constructor(config: Sp00kyConfig<any>['database'], logger: Logger$1);
-  getConfig(): Sp00kyConfig<any>['database'];
-  connect(): Promise<void>;
-  signin(params: any): Promise<any>;
-  signup(params: any): Promise<any>;
-  authenticate(token: string): Promise<any>;
-  invalidate(): Promise<void>;
+//#region src/services/database/local-migrator.d.ts
+declare class LocalMigrator {
+  private localDb;
+  private logger;
+  constructor(localDb: LocalStore, logger: Logger$1);
+  provision(schemaSurql: string): Promise<void>;
+  private readKeptRows;
+  private restoreKeptRows;
+  private isSchemaUpToDate;
+  private recreateDatabase;
+  private splitStatements;
+  private createHashRecord;
 }
 //#endregion
 //#region src/services/stream-processor/wasm-types.d.ts
@@ -76,6 +220,12 @@ interface WasmStreamUpdate {
   query_id: string;
   result_hash: string;
   result_data: RecordVersionArray;
+  timing_store_apply_ms?: number;
+  timing_circuit_step_ms?: number;
+  timing_transform_ms?: number;
+  timing_parse_ms?: number;
+  timing_plan_ms?: number;
+  timing_snapshot_ms?: number;
 }
 //#endregion
 //#region src/services/stream-processor/index.d.ts
@@ -96,6 +246,33 @@ interface StreamUpdate {
   queryHash: string;
   localArray: RecordVersionArray;
   op?: 'CREATE' | 'UPDATE' | 'DELETE';
+  /**
+   * Client-internal: not from the circuit. A membership-only change that
+   * needed no fetch is re-materialized through this same path so it cannot
+   * race a real update (DataModule.scheduleRematerialize). Carries the last
+   * known `localArray`; consumers that describe an INGEST (persist, metrics,
+   * devtools events) skip it.
+   */
+  synthetic?: boolean;
+  /**
+   * End-to-end ingest latency for the WASM call that produced this update,
+   * in milliseconds. Populated by StreamProcessorService.ingest. Undefined
+   * for the initial register_view snapshot.
+   */
+  materializationTimeMs?: number;
+  /** SSP internal sub-phase timings (ms) for this ingest, from the WASM binding. */
+  storeApplyMs?: number;
+  circuitStepMs?: number;
+  transformMs?: number;
+  /**
+   * One-shot registration timings (ms). Only set on the StreamUpdate returned
+   * by `registerQueryPlan` (the register_view snapshot), not on ingest updates.
+   */
+  registration?: {
+    parseMs: number;
+    planMs: number;
+    snapshotMs: number;
+  };
 }
 type StreamProcessorEvents = {
   stream_update: EventDefinition<'stream_update', StreamUpdate[]>;
@@ -107,34 +284,208 @@ type StreamProcessorEvents = {
 interface StreamUpdateReceiver {
   onStreamUpdate(update: StreamUpdate): void;
 }
+/** One row change in the shape `ingestMany` consumes. */
+interface IngestRecord {
+  table: string;
+  /** `MERGE` overlays the given fields on the stored row (projection widening). */
+  op: 'CREATE' | 'UPDATE' | 'DELETE' | 'MERGE';
+  id: string;
+  record: any;
+}
+/**
+ * What the boot-time prime needs from the client: which tables to walk, how
+ * to recognise a snapshot written under a different schema, and which rows'
+ * local `_00_rv` must not be reported as the server's.
+ */
+interface CircuitPrimeContext {
+  tables: string[];
+  schemaHash: string;
+  /** Encoded ids with an unsettled local mutation (their `_00_rv` was bumped
+   *  locally and may exceed the server's next version). */
+  pendingIds: Set<string>;
+  /** Each table's client column set (`columnFingerprints`). An engine that
+   *  keeps bodies across schema changes resets the versions of a table whose
+   *  set changed before they are read, so its rows are fetched again whole. */
+  columnFingerprints?: Record<string, string>;
+  /** Receives every `(id, rv)` the prime put into the circuit, per table, so
+   *  the sync layer can skip re-downloading bodies it already has. */
+  onVersions?: (table: string, entries: [string, number][]) => void;
+}
+/** Storage key of the circuit snapshot inside the local store. */
+
 declare class StreamProcessorService {
   events: EventSystem<StreamProcessorEvents>;
   private db;
-  private persistenceClient;
   private logger;
   private processor;
   private isInitialized;
   private receivers;
-  constructor(events: EventSystem<StreamProcessorEvents>, db: LocalDatabaseService, persistenceClient: PersistenceClient, logger: Logger);
+  private batching;
+  private batchBuffer;
+  private sessionAuth;
+  private stateGeneration;
+  private persistState;
+  private persistCircuit;
+  private checkpointMs;
+  private checkpointTimer;
+  private snapshotDirty;
+  private dirtyRows;
+  private hideHandler;
+  private checkpointInFlight;
+  private projection;
+  private primed;
+  private schemaHash;
+  private widenQueue;
+  private widenPending;
+  constructor(events: EventSystem<StreamProcessorEvents>, db: LocalStore, logger: Logger);
   /**
    * Add a receiver for stream updates.
    * Multiple receivers can be registered (DataManager, DevTools, etc.)
    */
   addReceiver(receiver: StreamUpdateReceiver): void;
   private notifyUpdates;
+  private dispatchUpdates;
+  /**
+   * Ingest a batch of record changes, firing one coalesced `StreamUpdate` per
+   * affected query once every record has been ingested. Use this whenever
+   * multiple records land at once (sync fetching N rows, the boot prime).
+   *
+   * The batch is fed to the wasm side in chunks of {@link INGEST_CHUNK}: one
+   * circuit step per chunk (a step walks every registered view, so per-record
+   * ingest paid that fixed cost N times), but never the whole batch at once,
+   * because the wasm side has to hold every parsed row of a call at the same
+   * time and wasm32 dlmalloc never returns that peak.
+   *
+   * Returns the records that were ingested. A chunk that fails is reported
+   * and skipped, not retried (a retry would double-apply whatever the failed
+   * step already committed), and the remaining chunks still run.
+   */
+  ingestMany(records: IngestRecord[]): IngestRecord[];
+  /**
+   * Open a coalescing window. While open, the per-record stream updates
+   * emitted by `ingest` are buffered (one entry per queryHash) instead of
+   * dispatched. Always paired with `flushCoalescing()` in a try/finally by
+   * `ingestMany` so the window always closes — otherwise the processor stays
+   * stuck buffering forever.
+   *
+   * No-op if a window is already open (nested batches aren't expected here).
+   */
+  private beginCoalescing;
+  /**
+   * Close the coalescing window and flush: dispatch one coalesced
+   * `StreamUpdate` per buffered queryHash, then persist processor state once
+   * for the whole batch (instead of once per ingest).
+   */
+  private flushCoalescing;
   /**
    * Initialize the WASM module and processor.
    * This must be called before using other methods.
    */
   init(): Promise<void>;
-  loadState(): Promise<void>;
-  saveState(): Promise<void>;
+  /**
+   * Drop the current WASM processor and start a fresh, empty circuit. Used on
+   * local-bucket switches: the old circuit holds the previous user's rows AND
+   * views registered with the previous `$auth` context, so neither may survive.
+   * Deliberately loads nothing: the snapshot in the store being swapped away
+   * from belongs to the previous bucket; the caller primes the new bucket's
+   * circuit (`primeFromLocal`) once its store is open, and the DataModule
+   * rebind re-registers every live view against this fresh processor. Caller
+   * must re-seed `setPermissions` afterwards (a fresh circuit default-denies
+   * every table).
+   */
+  reset(): Promise<void>;
+  /**
+   * Release the wasm circuit and stop checkpointing. Call when the client is
+   * torn down; a recreated client (provider remount, HMR) would otherwise stack
+   * one full circuit per instance.
+   */
+  dispose(): void;
+  /**
+   * Explicitly run the wasm-bindgen destructor. Guarded: stale wasm builds may
+   * not expose `free`, and a double free must not take the app down.
+   */
+  private freeProcessor;
+  /** Toggle circuit-state persistence (shared-tabs follower/leader role). */
+  setPersistenceEnabled(enabled: boolean): void;
+  /**
+   * Snapshot persistence (`persistCircuit`). When on, the circuit's store is
+   * written to the local store on a checkpoint interval and when the page
+   * goes hidden, and restored by {@link primeFromLocal} on the next boot.
+   */
+  configureCircuitPersistence(enabled: boolean, checkpointMs?: number): void;
+  /**
+   * Field projection (`circuitProjection`, default on). Takes effect on the
+   * next processor (`init`/`reset`) and on rows written after that.
+   */
+  configureProjection(enabled: boolean): void;
+  private applyProjection;
+  /** Resolves once the boot-time prime has finished (or was skipped). */
+  whenPrimed(): Promise<void>;
+  /**
+   * Fill the circuit from the LOCAL store, in the background.
+   *
+   * With a usable snapshot: install it under whatever views have registered
+   * meanwhile (`load_store_state` re-primes them), then `reconcile` each table
+   * against the store's `(id, rv)` list so rows deleted since the checkpoint
+   * are stepped out and only rows added or changed since are read back and
+   * ingested. Without one: read every row and ingest it, chunked.
+   *
+   * Either way the circuit ends up equal to the local store without touching
+   * the network, so the first sync diff is a real delta rather than "fetch
+   * everything". The returned promise never rejects; `whenPrimed` gates on it.
+   */
+  primeFromLocal(ctx: CircuitPrimeContext): Promise<void>;
+  private runPrime;
+  /** Publish wasm updates produced outside an ingest (restore, reconcile). */
+  private dispatchWasmUpdates;
+  /**
+   * Record that the circuit changed by `rows` rows. Cheap; the snapshot is
+   * deferred to the checkpoint timer and skipped entirely when `persistCircuit`
+   * is off.
+   */
+  private markSnapshotDirty;
+  private startCheckpoints;
+  /** Stop checkpointing and drop the visibility listeners. */
+  stopCheckpoints(): void;
+  /**
+   * Write the circuit's store to the local store as a snapshot. Compacts the
+   * row arena first when dead bytes outweigh live ones. Serialised: a second
+   * call while one is in flight joins it. No-op unless persistence is on, this
+   * tab owns the store, and the engine can hold a snapshot.
+   */
+  checkpoint(reason?: string): Promise<void>;
+  private runCheckpoint;
+  /**
+   * Projection widening: a newly registered view evaluates fields that rows
+   * already in the circuit were stored without. Merge just those fields in,
+   * table by table, from the local store. The view registered against what
+   * was present and converges as the merges step through.
+   */
+  private scheduleWiden;
+  private runWiden;
+  /**
+   * Seed per-table `select` permission predicates ({ [table]: whereText }).
+   * Must run after the processor exists and before any `register_view`, else
+   * non-`_00_` tables are default-denied and registration fails.
+   */
+  setPermissions(permissions: Record<string, string>): void;
+  /**
+   * Set the current session's auth identity for permission injection,
+   * mirroring the server's `fn::query::register`
+   * (`object::extend(params, { auth: { id: $auth.id }, access: $access })`).
+   * Stored as strings (empty when logged out) and applied to every
+   * `register_view` in {@link registerQueryPlan}. Must be set before a
+   * `$auth`-gated query registers (and re-set on auth state changes), or the
+   * in-browser SSP's `permission_inject` rejects it with
+   * "requires $auth but registration params lack it".
+   */
+  setSessionAuth(authId: string | null, access: string | null): void;
   /**
    * Ingest a record change into the processor.
    * Emits 'stream_update' event if materialized views are affected.
    * @param isOptimistic true = local mutation (increment versions), false = remote sync (keep versions)
    */
-  ingest(table: string, op: 'CREATE' | 'UPDATE' | 'DELETE', id: string, record: any): WasmStreamUpdate[];
+  ingest(table: string, op: IngestRecord['op'], id: string, record: any): WasmStreamUpdate[];
   /**
    * Register a new query plan.
    * Emits 'stream_update' with the initial result.
@@ -147,60 +498,1541 @@ declare class StreamProcessorService {
   private normalizeValue;
 }
 //#endregion
-//#region src/modules/auth/events/index.d.ts
-declare const AuthEventTypes: {
-  readonly AuthStateChanged: "AUTH_STATE_CHANGED";
-};
-type AuthEventTypeMap = {
-  [AuthEventTypes.AuthStateChanged]: EventDefinition<typeof AuthEventTypes.AuthStateChanged, string | null>;
-};
-type AuthEventSystem = EventSystem<AuthEventTypeMap>;
-declare function createAuthEventSystem(): AuthEventSystem;
+//#region src/utils/index.d.ts
+declare function fileToUint8Array(file: File | Blob): Promise<Uint8Array>;
+/**
+ * Convert plain text to simple HTML paragraphs.
+ * Useful for seeding a rich-text editor (e.g. TipTap/ProseMirror) with fallback content.
+ */
+declare function textToHtml(text: string): string;
+/**
+ * Helper for retrying DB operations with exponential backoff
+ */
+//#endregion
+//#region src/modules/crdt/mirror.d.ts
+/**
+ * The plain text a `@crdt` field shows as its column value, rendered the same
+ * way the SSP fold renders it (`packages/ssp-node/src/crdt/mirror.rs`).
+ */
+type CrdtKind = 'text' | 'prosemirror';
 //#endregion
-//#region src/modules/auth/index.d.ts
-type Prettify<T> = { [K in keyof T]: T[K] } & {};
-type MapColumnType<T extends ColumnSchema> = T['optional'] extends true ? TypeNameToTypeMap[T['type']] | undefined : TypeNameToTypeMap[T['type']];
-type ExtractAccessParams<S extends SchemaStructure, Name extends keyof S['access'], Method extends 'signIn' | 'signup'> = S['access'] extends undefined ? never : S['access'][Name] extends AccessDefinition ? Prettify<{ [K in keyof S['access'][Name][Method]['params']]: MapColumnType<S['access'][Name][Method]['params'][K]> }> : never;
-declare class AuthService<S extends SchemaStructure> {
+//#region src/modules/crdt/crdt-field.d.ts
+declare const CURSOR_COLORS: string[];
+declare function cursorColorFromName(name: string): string;
+/** What a field handle needs from the manager that owns its session. */
+interface CrdtFieldHost {
+  pushPresence(state: Uint8Array): void;
+}
+/**
+ * An open collaborative field: the Loro document an editor binds to. Edits
+ * made on it are sent as the client's own edit-log rows; other clients' rows
+ * are imported into it as they arrive. Every open of the same field in one tab
+ * shares this document.
+ */
+declare class CrdtField {
+  readonly table: string;
+  readonly recordId: string;
+  readonly fieldName: string;
+  readonly kind: CrdtKind;
+  readonly cursorsEnabled: boolean;
+  private readonly doc;
+  private readonly host;
+  private _onCursorUpdate;
+  private pendingCursorUpdate;
+  private loaded;
+  private loadedListeners;
+  constructor(table: string, recordId: string, fieldName: string, kind: CrdtKind, cursorsEnabled: boolean, doc: LoroDoc, host: CrdtFieldHost);
+  getDoc(): LoroDoc;
+  /** Whether the document holds anything yet (local state or edits). */
+  hasContent(): boolean;
+  /**
+   * Whether the document is known: this device had it, it was handed a draft,
+   * or the server answered (with content, or that it has none yet). Until then
+   * an empty document means "not loaded", not "empty": show the column's text
+   * instead, and do not bind an editor (an editor binding an empty document
+   * creates structure that competes with the real one).
+   */
+  isLoaded(): boolean;
+  /** Runs `cb` once the field is loaded (at once if it already is). Returns
+   *  an unsubscribe. */
+  onLoaded(cb: () => void): () => void;
+  /** @internal The manager calls this when the document became known. */
+  markLoaded(): void;
+  /** Publish this session's presence (an `EphemeralStore` encoding, e.g. the
+   *  editor's cursor). No-op unless the field is `@cursor`. */
+  pushCursorState(encoded: Uint8Array): void;
+  /** Called with every other session's presence blob. A blob that arrives
+   *  before the editor sets this is replayed when it does. */
+  set onCursorUpdate(cb: ((data: Uint8Array) => void) | null);
+  get onCursorUpdate(): ((data: Uint8Array) => void) | null;
+  /** @internal Deliver one remote presence blob. */
+  deliverPresence(data: Uint8Array): void;
+}
+//#endregion
+//#region src/modules/crdt/index.d.ts
+/**
+ * Collaborative (`@crdt`) fields.
+ *
+ * Each open field is a Loro document. The client never sends the document,
+ * only its own edits: every batch of local edits becomes one row of the
+ * generated `<table>__crdt_log` table, written through the ordinary outbox
+ * (so it survives offline, reloads and retries), and every client receives
+ * the other rows through an ordinary query and merges them. Nobody writes the
+ * canonical state but the SSP, which folds the log into `_00_crdt_doc` and the
+ * parent field's plain text (see `packages/ssp-node/src/crdt`).
+ *
+ * A row is imported only if it passes the acceptance rule the fold applies
+ * (`./acceptance`), so this tab and the server always hold the same ops.
+ *
+ * Edits carry this tab's Loro peer id, claimed for the signed-in user in
+ * `_00_crdt_peer` before the first row is sent; the database refuses a row
+ * whose peer its author does not own. A tab picks a fresh peer per session.
+ * Offline, edits stay local (and in the local snapshot) until the claim and
+ * the outbox can go through.
+ */
+/** A followed query: stop following it, and know when the server answered. */
+interface Watch {
+  stop: () => void;
+  /** Resolves once the server's membership for the query is known and its
+   *  rows have landed locally (never rejects; may never resolve offline). */
+  settled: Promise<void>;
+}
+/** The runtime pieces the manager needs from the client facade. */
+interface CrdtPorts {
+  /** Register a query on `table` filtered by `where` and follow its rows. */
+  watch(table: string, where: Record<string, unknown>, onRows: (rows: Record<string, unknown>[]) => void): Promise<Watch>;
+  /** Optimistic create through the outbox. */
+  create(id: string, data: Record<string, unknown>): Promise<unknown>;
+}
+declare class CrdtManager {
   private schema;
+  private local;
   private remote;
-  private persistenceClient;
+  private debounceMs;
+  private sessions;
+  private opening;
+  /** Closes still saving their field's local state, by session key. */
+  private saving;
+  private ports;
   private logger;
-  token: string | null;
-  currentUser: any | null;
-  isAuthenticated: boolean;
-  isLoading: boolean;
-  private events;
-  get eventSystem(): AuthEventSystem;
-  constructor(schema: S, remote: RemoteDatabaseService, persistenceClient: PersistenceClient, logger: Logger$1);
-  init(): Promise<void>;
-  getAccessDefinition<Name extends keyof S['access']>(name: Name): AccessDefinition | undefined;
+  private peer;
+  /** The current peer's claim: settled once the database holds it for us. */
+  private claim;
+  private claimRetry;
+  private connectionUnsubscribes;
+  constructor(schema: SchemaStructure, local: LocalStore, remote: RemoteDatabaseService, logger: Logger$1, debounceMs?: number);
+  /** Hand over the runtime ports. Called once by the client facade. */
+  attach(ports: CrdtPorts): void;
+  /**
+   * A new signed-in identity (boot, sign-in, sign-out): edits from here on
+   * belong to it, under a peer it claims. Edits already made stay with the
+   * peer they were made under.
+   */
+  setSessionId(_salt: string): void;
+  dispose(): void;
+  /**
+   * Open a collaborative field. Every open of the same field shares one
+   * document; close each open with {@link close}.
+   *
+   * `draft` (from {@link createDraft}) hands over edits made before the record
+   * existed: they are merged in and sent like this tab's own.
+   */
+  open(table: string, recordId: string, field: string, draft?: CrdtField): Promise<CrdtField>;
+  /**
+   * A detached document for a field of a record that does not exist yet (a
+   * "new thread" form). Nothing is sent; pass it to {@link open} once the
+   * record is created and its edits become the record's first ones.
+   */
+  createDraft(table: string, field: string): Promise<CrdtField>;
+  private adopt;
+  /** Close one open. The last close of a field resolves once its unsent
+   *  edits are in the outbox, or once they are saved on the device when the
+   *  server does not answer in time (offline: at once). */
+  close(table: string, recordId: string, field: string): Promise<void>;
+  /** Close every field. `flush: false` (a bucket switch) drops unsent edits
+   *  from this session's memory; they stay in the local snapshot of the
+   *  bucket they belong to. */
+  closeAll(options?: {
+    flush?: boolean;
+  }): void;
+  private fieldSpec;
+  private start;
+  private stop;
+  /**
+   * Wait for server-bound `work`, at most {@link SERVER_WAIT_MS}, and not at
+   * all while disconnected: a remote call made then queues behind the
+   * reconnect for up to the query timeout, and an offline "new thread" form
+   * must not hang on it. The work itself goes on either way.
+   */
+  private serverWait;
+  private ingest;
+  /** Mark the field loaded once its content arrived, or the server answered
+   *  both reads (the published document and the log) with nothing. */
+  private checkLoaded;
+  private tryImport;
+  private refetchCanonical;
+  private scheduleVerify;
+  /**
+   * After a fold: compare this device's document with the one the server
+   * published, at the version the server published. Missing ops (rows this
+   * device never got before they were folded away) are repaired by merging
+   * the published snapshot in. The same ops giving a different state cannot
+   * be merged away; that is logged.
+   */
+  private verify;
+  private scheduleFlush;
+  private flush;
+  /** Send every own peer's ops that are not in the outbox yet, one row per
+   *  peer. Only the peer's own ops travel (`updates-in-range`): a plain
+   *  `from: version` export would carry ops imported from others too, and
+   *  the acceptance rule refuses such a row. */
+  private sendOwnEdits;
+  private retryLater;
+  /** Claim this session's peer once; a failure (offline, signed out) is retried. */
+  private ensureClaimed;
+  private claimPeer;
+  private localId;
+  private readLocal;
+  private schedulePersist;
+  /** Save the merged document. Another tab may have saved too: merge with
+   *  its snapshot rather than overwrite it, and keep the further of the two
+   *  outbox marks per peer. */
+  private persist;
+  private pushPresence;
+  /** Presence is the latest state only: no outbox, no offline queue. */
+  private sendPresence;
+  /** Remove this session's cursor when the field closes; the server's TTL
+   *  sweep covers a tab that never gets here. */
+  private dropPresence;
+  private ingestPresence;
+}
+//#endregion
+//#region src/modules/feature-flag/index.d.ts
+interface FeatureFlagSnapshot {
+  variant: string | undefined;
+  payload: unknown | undefined;
+}
+interface FeatureFlagOptions {
+  fallback?: string;
+  ttl?: QueryTimeToLive;
+}
+/**
+ * A locally forced variant. Applies to THIS browser only and is never sent to
+ * the server — the assignment in `_00_user_feature` is untouched, so clearing
+ * the override restores whatever the server says.
+ */
+interface FeatureFlagOverride {
+  variant: string;
+  payload?: unknown;
+}
+declare class FeatureFlagHandle {
+  readonly key: string;
+  readonly fallback: string | undefined;
+  private latest;
+  private listeners;
+  private unsubscribeFn;
+  private onCloseFn;
+  private closed;
+  constructor(key: string, fallback: string | undefined);
+  attach(unsubscribe: () => void): void;
+  detach(): void;
+  set(snapshot: FeatureFlagSnapshot): void;
+  variant(): string | undefined;
+  payload<T = unknown>(): T | undefined;
+  enabled(): boolean;
+  subscribe(cb: (s: FeatureFlagSnapshot) => void): () => void;
+  onClose(cb: () => void): void;
+  close(): void;
+}
+/** The slice of the query engine this module drives: register a live query
+ *  locally, ask for its remote registration, subscribe to its rows. */
+interface LiveQueryPort$1 {
+  query(table: string, surql: string, params: Record<string, unknown>, ttl: QueryTimeToLive): Promise<string>;
+  subscribe(hash: string, cb: (records: Record<string, any>[]) => void, options?: {
+    immediate?: boolean;
+  }): () => void;
+}
+interface RemoteRegisterPort$1 {
+  enqueueDownEvent(event: {
+    type: 'register';
+    payload: {
+      hash: string;
+    };
+  }): void;
+}
+interface FeatureFlagModuleDeps<S extends SchemaStructure> {
+  dataModule: LiveQueryPort$1;
+  sync: RemoteRegisterPort$1;
+  auth: Pick<AuthService<S>, 'subscribe'>;
+  logger: Logger$1;
+}
+declare class FeatureFlagModule<S extends SchemaStructure> {
+  private deps;
+  private logger;
+  private handles;
+  private authUnsubscribe;
+  private lastUserId;
+  private querySubscription;
+  private starting;
+  private ttl;
+  private snapshots;
+  private loaded;
+  private overrides;
+  constructor(deps: FeatureFlagModuleDeps<S>);
+  init(): void;
+  feature(key: string, options?: FeatureFlagOptions): FeatureFlagHandle;
+  closeAll(): Promise<void>;
+  /** Auth changed: drop the old user's query/snapshots and re-observe. */
+  private refresh;
+  private teardownQuery;
+  /** Start the single shared live query (idempotent; no-op with no handles). */
+  private ensureStarted;
+  /** Live query result → per-key snapshots → push to every active handle. */
+  private applyRecords;
+  /**
+   * Force `key` to `variant` in THIS browser. Pass `null` to clear.
+   *
+   * Nothing is written to the server: the `_00_user_feature` assignment is
+   * untouched, so clearing restores whatever the server says. Persisted to
+   * localStorage on the page origin, so it survives a reload.
+   */
+  setLocalOverride(key: string, variant: string | null, payload?: unknown): void;
+  clearLocalOverrides(): void;
+  getLocalOverrides(): Record<string, FeatureFlagOverride>;
+  /** The assignment for `key`, with any local override taking precedence. */
+  private resolve;
+  private pushAll;
+  private loadOverrides;
+  private persistOverrides;
+}
+//#endregion
+//#region src/modules/app-release/index.d.ts
+interface AppReleaseSnapshot {
+  /** Latest announced version for the app, or undefined when no row exists. */
+  version: string | undefined;
+  /** Clients should clear SW/caches when reloading onto this version. */
+  cacheBust: boolean;
+  /** Clients should reload/update immediately instead of asking. */
+  mandatory: boolean;
+  releasedAt: string | undefined;
+}
+interface AppReleaseOptions {
+  ttl?: QueryTimeToLive;
+}
+declare class AppReleaseHandle {
+  readonly app: string;
+  private latest;
+  private listeners;
+  private onCloseFn;
+  private closed;
+  constructor(app: string);
+  set(snapshot: AppReleaseSnapshot): void;
+  snapshot(): AppReleaseSnapshot;
+  version(): string | undefined;
+  /** True when the announced version is semver-newer than `currentVersion`. */
+  updateAvailable(currentVersion: string): boolean;
+  subscribe(cb: (s: AppReleaseSnapshot) => void): () => void;
+  onClose(cb: () => void): void;
+  close(): void;
+}
+/** The slice of the query engine this module drives: register a live query
+ *  locally, ask for its remote registration, subscribe to its rows. */
+interface LiveQueryPort {
+  query(table: string, surql: string, params: Record<string, unknown>, ttl: QueryTimeToLive): Promise<string>;
+  subscribe(hash: string, cb: (records: Record<string, any>[]) => void, options?: {
+    immediate?: boolean;
+  }): () => void;
+}
+interface RemoteRegisterPort {
+  enqueueDownEvent(event: {
+    type: 'register';
+    payload: {
+      hash: string;
+    };
+  }): void;
+}
+interface AppReleaseModuleDeps<S extends SchemaStructure> {
+  dataModule: LiveQueryPort;
+  sync: RemoteRegisterPort;
+  auth: Pick<AuthService<S>, 'subscribe'>;
+  logger: Logger$1;
+}
+declare class AppReleaseModule<S extends SchemaStructure> {
+  private deps;
+  private logger;
+  private handles;
+  private authUnsubscribe;
+  private lastUserId;
+  private querySubscription;
+  private starting;
+  private ttl;
+  private snapshots;
+  private loaded;
+  constructor(deps: AppReleaseModuleDeps<S>);
+  init(): void;
+  release(app: string, options?: AppReleaseOptions): AppReleaseHandle;
+  closeAll(): Promise<void>;
+  private refresh;
+  private teardownQuery;
+  private ensureStarted;
+  private applyRecords;
+}
+//#endregion
+//#region src/kernel/events.d.ts
+/**
+ * Inbound events. Everything that can start a saga arrives as one of these
+ * through the runtime router: public API calls, adapter callbacks, timers,
+ * and `dispatch` effects from other sagas.
+ */
+type RuntimeEvent = {
+  type: 'EnsureRegistered';
+  requireAuth?: boolean;
+  attempt?: number;
+} | {
+  type: 'RegisterRemote';
+  hash: QueryHash;
+  retry?: boolean;
+} | {
+  type: 'SyncOutcome';
+  ok: boolean;
+  error?: unknown;
+} | {
+  type: 'AckPrune';
+} | {
+  type: 'ReadDirtyMembership';
+} | {
+  type: 'RecoverLostView';
+  hash: QueryHash;
+} | {
+  type: 'ReadMembership';
+  hashes: QueryHash[];
+} | {
+  type: 'FetchRows';
+} | {
+  type: 'Materialize';
+  hash: QueryHash;
+} | {
+  type: 'MaterializeDirty';
+} | {
+  type: 'LifecycleTick';
+} | {
+  type: 'GcTick';
+} | {
+  type: 'Drain';
+} | {
+  type: 'FlushWrite';
+  key: string;
+} | {
+  type: 'FlushPendingWrites';
+} | {
+  type: 'AdoptPendingWrites';
+} | {
+  type: 'PollTick';
+} | {
+  type: 'SelfHealTick';
+} | {
+  type: 'HeartbeatNow';
+} | {
+  type: 'StartRemote';
+} | {
+  type: 'PrimeCircuit';
+} | {
+  type: 'VersionsPrimed';
+  entries: Array<readonly [string, number]>;
+} | {
+  type: 'WarmBlobs';
+} | {
+  type: 'AuthFlip';
+  userId: string | null;
+} | {
+  type: 'BucketSwitch';
+  target: string;
+} | {
+  type: 'PageHide';
+} | {
+  type: 'ConnectionChanged';
+  state: ConnectionState;
+} | {
+  type: 'StreamUpdate';
+  update: StreamUpdate;
+} | {
+  type: 'LiveStart';
+} | {
+  type: 'LiveChange';
+  hashes: QueryHash[];
+  rows?: InlineRow[];
+} | {
+  type: 'TabRole';
+  role: 'solo' | 'leader' | 'follower';
+} | {
+  type: 'TabMessage';
+  message: unknown;
+};
+type OutEvent = {
+  type: 'query:records';
+  hash: QueryHash;
+  records: ReadonlyArray<Record<string, unknown>>;
+} | {
+  type: 'query:status';
+  hash: QueryHash;
+  status: QueryStatus;
+} | {
+  type: 'query:authority';
+  hash: QueryHash;
+  known: boolean;
+} | {
+  type: 'query:view-lost';
+  hash: QueryHash;
+} | {
+  type: 'query:evicted';
+  hash: QueryHash;
+} | {
+  type: 'mutation:event';
+  event: unknown;
+} | {
+  type: 'mutation:settled';
+  mutationId: string;
+  recordId: string;
+  eventType: string;
+} | {
+  type: 'mutation:rolled-back';
+  mutationId: string;
+  recordId: string;
+  eventType: string;
+  error: string;
+} | {
+  type: 'tray:changed';
+  count: number;
+} | {
+  type: 'health:changed';
+  health: SyncHealth;
+} | {
+  type: 'activity:changed';
+  fetching: number;
+  pending: number;
+} | {
+  type: 'tabs:broadcast';
+  message: unknown;
+} | {
+  type: 'tabs:sendTo';
+  tabId: string;
+  message: unknown;
+} | {
+  type: 'log';
+  level: 'debug' | 'info' | 'warn' | 'error';
+  message: string;
+  data?: unknown;
+};
+//#endregion
+//#region src/state/lifecycle.d.ts
+/**
+ * The query lifecycle as one explicit machine.
+ *
+ * `phase` answers "where do this query's rows come from":
+ * - `cold`      never resolved on this device: rows come from a local
+ *               predicate scan (or the SSP local window), bindings show a loader.
+ * - `cached`    a durable `_00_view` row was found: rows come from that id-set.
+ * - `live`      a server membership set was accepted this session.
+ * - `view-lost` the server's `_00_query` row vanished while we held
+ *               membership; rows are kept, a re-registration is under way.
+ *
+ * `remote` tracks the server-side registration, `fetchDepth` is the refcount
+ * behind `status: 'fetching'`, `notified` says whether subscribers received
+ * at least one materialization this registration.
+ *
+ * `backgroundDepth` is the part of `fetchDepth` that re-verifies rows the
+ * query already shows: a registration of a query that is not `cold`. It still
+ * holds `status: 'fetching'` (results are not yet confirmed), but it is not
+ * traffic the user waits on, so the activity indicator leaves it out.
+ */
+type QueryPhase = 'cold' | 'cached' | 'live' | 'view-lost';
+type RemotePhase = 'unregistered' | 'registering' | 'registered' | 'failed';
+interface QueryLifecycle {
+  readonly phase: QueryPhase;
+  readonly remote: RemotePhase;
+  readonly fetchDepth: number;
+  readonly backgroundDepth: number;
+  readonly notified: boolean;
+}
+//#endregion
+//#region src/kernel/effects.d.ts
+type Vars = Record<string, unknown>;
+/** What the in-browser SSP needs to build a local view. */
+interface RegisterPlan {
+  queryHash: string;
+  surql: string;
+  params: Vars;
+  ttl: string;
+  tableName: string;
+  involvedTables?: string[];
+}
+/** One statement's outcome of a multi-statement remote request. */
+type StatementResult = {
+  status: 'OK';
+  result: unknown;
+} | {
+  status: 'ERR';
+  error: string;
+};
+/** One entry of an `all` fan-out result (allSettled semantics). */
+
+/**
+ * Effects are data. A saga yields one and gets its result back on the next
+ * `next()`; the interpreter (client/runtime) is the only place they execute.
+ */
+type Effect = {
+  kind: 'local.query';
+  sql: string;
+  vars?: Vars;
+  epoch?: number;
+} | {
+  kind: 'local.select';
+  plan: QueryPlan;
+  params?: Vars;
+} | {
+  kind: 'local.execute';
+  query: SealedQuery<unknown>;
+  vars?: Vars;
+  epoch?: number;
+} | {
+  kind: 'local.getById';
+  table: string;
+  id: unknown;
+} | {
+  kind: 'local.upsert';
+  table: string;
+  id: unknown;
+  data: Record<string, unknown>;
+  mode: 'replace' | 'merge';
+} | {
+  kind: 'local.delete';
+  table: string;
+  id: unknown;
+} | {
+  kind: 'local.epoch';
+} | {
+  kind: 'remote.query';
+  sql: string;
+  vars?: Vars;
+  timeoutMs?: number;
+} | {
+  kind: 'remote.live';
+  table: string;
+} | {
+  kind: 'remote.kill';
+  uuid: string;
+} | {
+  kind: 'ssp.register';
+  plan: RegisterPlan;
+} | {
+  kind: 'ssp.unregister';
+  hash: string;
+} | {
+  kind: 'ssp.ingest';
+  records: IngestRecord[];
+} | {
+  kind: 'timer.set';
+  key: string;
+  ms: number;
+  event: RuntimeEvent;
+} | {
+  kind: 'timer.clear';
+  key: string;
+} | {
+  kind: 'state.read';
+  select: (s: ClientState) => unknown;
+} | {
+  kind: 'state.update';
+  fn: (s: ClientState) => ClientState;
+} | {
+  kind: 'state.wait';
+  until: (s: ClientState) => boolean;
+} | {
+  kind: 'now';
+} | {
+  kind: 'id';
+  scope: IdScope;
+} | {
+  kind: 'hash';
+  input: string;
+} | {
+  kind: 'emit';
+  event: OutEvent;
+} | {
+  kind: 'dispatch';
+  event: RuntimeEvent;
+} | {
+  kind: 'all';
+  effects: Effect[];
+} | {
+  kind: 'service';
+  name: ServiceName;
+  args: unknown[];
+};
+/** `mutation`: an outbox row id. `salt`: a query-key salt. `owner`: a page's anonymous-view owner secret. */
+type IdScope = 'mutation' | 'salt' | 'owner';
+/**
+ * Calls into the legacy services that are adapters, not state: auth, tabs,
+ * blobs, migrator, crdt, persistence, the SSP lifecycle, the remote socket.
+ * A saga names the call; the runtime binds it to the real service.
+ */
+interface ServiceCalls {
+  'hint.read': () => string | null;
+  'hint.write': (bucketId: string) => void;
+  /** The salt (and owner secret) this tab's previous page left, if minted for `authId`. */
+  'salt.take': (authId: string | null) => {
+    salt: string;
+    owner: string | null;
+  } | null;
+  'salt.leave': (salt: string, authId: string | null, owner: string | null) => void;
+  'local.connect': (bucketId: string) => Promise<void>;
+  'local.switchStore': (bucketId: string) => Promise<void>;
+  'local.beginSwitch': () => () => void;
+  'local.currentBucketId': () => string;
+  'local.usesSurqlSchema': () => boolean;
+  'local.dropBucket': (bucketId: string) => Promise<void>;
+  'migrator.provision': () => Promise<void>;
+  'blobs.start': (bucketId: string) => Promise<void>;
+  'blobs.setNamespace': (bucketId: string) => Promise<void>;
+  'blobs.clear': () => Promise<void>;
+  'ssp.init': () => Promise<void>;
+  'ssp.setPermissions': () => void;
+  'ssp.setSessionAuth': (authId: string | null, access: string | null) => void;
+  'ssp.prime': (pendingIds: string[]) => Promise<void>;
+  'ssp.reset': () => Promise<void>;
+  'ssp.setPersistence': (enabled: boolean) => void;
+  'auth.restoreSession': () => Promise<string | null>;
+  'auth.init': () => Promise<void>;
+  'auth.sessionAuthId': () => string | null;
+  'auth.access': () => string | null;
+  'auth.token': () => string | null;
+  'auth.currentUser': () => Record<string, unknown> | null;
+  'auth.consumeEndedImpersonation': () => string | null;
+  'remote.connect': () => Promise<void>;
+  'remote.releaseViews': (ids: unknown[]) => void;
+  'supervisor.start': () => void;
+  'tabs.start': (bucketId: string) => Promise<'solo' | 'leader' | 'follower'>;
+  'tabs.moveToBucket': (bucketId: string) => Promise<'solo' | 'leader' | 'follower'>;
+  'crdt.setSessionId': (sessionId: string) => void;
+  'crdt.closeAll': (flush: boolean) => void;
+  'persistence.set': (key: string, value: unknown) => Promise<void>;
+  'features.init': () => void;
+  'releases.init': () => void;
+  'window.attach': () => void;
+}
+type ServiceName = keyof ServiceCalls;
+/** Typed constructors. Each is one line so the saga reads like the plan. */
+//#endregion
+//#region src/kernel/saga.d.ts
+/**
+ * A saga is a generator that yields effects and receives their results. It
+ * holds no references to adapters or state, so it can be driven by the real
+ * interpreter or by `testing/run-pure` with canned results.
+ */
+type Saga<R> = Generator<Effect, R, any>;
+/**
+ * Lanes bound concurrency without a queue object per lane:
+ * - `serial`: runs strictly one at a time per key, in arrival order.
+ * - `dedupe`: a request while one run is active joins that run instead of
+ *   starting another.
+ * The bookkeeping is a pure value so the policy is unit-testable; the runtime
+ * owns the promises.
+ */
+type Lane = {
+  kind: 'serial';
+  key: string;
+} | {
+  kind: 'dedupe';
+  key: string;
+};
+interface LaneState {
+  readonly running: ReadonlySet<string>;
+  readonly waiting: ReadonlyMap<string, number>;
+}
+//#endregion
+//#region src/state/client-state.d.ts
+type Row = Record<string, unknown>;
+/** Everything a query is, minus anything that changes after registration. */
+interface QueryDefinition {
+  /** Session-salted `_00_query:<hash>` record id: the remote view id. */
+  readonly id: RecordId<string>;
+  readonly hash: QueryHash;
+  /** Unsalted `sha256({surql, params})`: key of the durable `_00_view` row. */
+  readonly viewKey: string;
+  readonly surql: string;
+  readonly params: Readonly<Record<string, unknown>>;
+  readonly plan?: QueryPlan;
+  readonly ttl: QueryTimeToLive;
+  readonly ttlMs: number;
+  readonly tableName: string;
+  readonly createdAt: number;
+}
+type ServerViewState = 'materializing' | 'ready' | null;
+interface QueryTelemetry {
+  readonly updateCount: number;
+  readonly errorCount: number;
+  readonly lastUpdatedAt: number | null;
+  readonly materializationSamples: ReadonlyArray<number>;
+  readonly lastIngestLatencyMs: number | null;
+  readonly phaseSamples: Readonly<Record<string, ReadonlyArray<number>>>;
+  readonly phaseLast: Readonly<Record<string, number | null>>;
+  readonly registrationTimings: RegistrationTimings;
+}
+interface QueryEntry {
+  readonly def: QueryDefinition;
+  readonly lifecycle: QueryLifecycle;
+  /** Server membership (ids + versions) or the durable seed. */
+  readonly remoteArray: RecordVersionArray;
+  /** The in-browser SSP view's id-set: local truth for "does this row match". */
+  readonly localArray: RecordVersionArray;
+  readonly subqueryRemoteArray: RecordVersionArray;
+  readonly records: ReadonlyArray<Row>;
+  readonly serverState: ServerViewState;
+  readonly subscribers: number;
+  readonly lastSubscriberLeftAt: number | null;
+  readonly lastHeartbeatAt: number | null;
+  readonly lastPolledAt: number | null;
+  readonly registerAttempts: number;
   /**
-   * Subscribe to auth state changes.
-   * callback is called immediately with current value and whenever validation status changes.
+   * Re-registrations issued because the `_00_query` row read as gone, since
+   * the row was last seen. Paces the next one (see `applyMembership`).
    */
-  subscribe(cb: (userId: string | null) => void): () => void;
-  private notifyListeners;
+  readonly viewLostCount: number;
+  /** When the paced re-registration is due; null when none is pending. */
+  readonly viewLostRetryAt: number | null;
+  readonly telemetry: QueryTelemetry;
+}
+type OutboxStatus = 'pending' | 'acked';
+/** In-memory mirror of one `_00_pending_mutations` row plus its push progress. */
+interface OutboxItem {
+  readonly id: string;
+  readonly type: MutationEventType;
+  readonly recordId: string;
+  readonly table: string;
+  readonly status: OutboxStatus;
+  readonly ackedAt: number | null;
+  readonly attempts: number;
+}
+type TabRole = 'solo' | 'leader' | 'follower';
+/** A debounced update accumulating locally until its flush writes the outbox row. */
+interface PendingWrite {
+  readonly key: string;
+  readonly table: string;
+  readonly recordId: string;
+  readonly data: Readonly<Record<string, unknown>>;
+  readonly before: Readonly<Record<string, unknown>> | null;
+  readonly firstAt: number;
+  /** Its durable copy in `_00_pending_writes`; null when `flushOnHide` is off. */
+  readonly mirrorId: string | null;
+}
+interface SyncSlice {
+  readonly health: SyncHealth;
+  readonly consecutiveFailures: number;
+  readonly hasSyncedOnce: boolean;
+  readonly selfHealAttempts: number;
+  readonly pollIdleStreak: number;
+  readonly lastReconnectRefetchAt: number | null;
+  readonly needsResubscribe: boolean;
+  readonly fetchAttempts: number;
+  readonly liveUuid: string | null;
+  readonly liveTable: string | null;
+  readonly lanes: LaneState;
+}
+interface ClientState {
+  readonly sessionId: string | null;
+  readonly userId: string | null;
+  /** The principal the current session salt was minted for. */
+  readonly saltUserId: string | null;
   /**
-   * Check for existing session and validate
+   * This page's secret, sent with every registration (`$config.owner`). An
+   * anonymous view answers only to the secret it was registered with, so it
+   * lives as long as the page's views: a reconnect keeps it, and a reload
+   * that keeps the salt keeps it too.
    */
-  check(accessToken?: string): Promise<void>;
+  readonly ownerSecret: string | null;
+  /** Latest bucket-switch target; an older switch that wakes up to a newer target skips. */
+  readonly pendingBucket: string | null;
+  readonly tabId: string;
+  readonly tabRole: TabRole;
+  readonly bucketId: string | null;
+  readonly localReady: boolean;
+  readonly primed: boolean;
+  readonly queries: ReadonlyMap<QueryHash, QueryEntry>;
+  /** Hashes whose local registration is in flight (dedupes concurrent `query()` calls). */
+  readonly registering: ReadonlySet<QueryHash>;
+  /** Re-read attempts per hash while the server reports a view as `materializing`. */
+  readonly membershipReread: ReadonlyMap<QueryHash, number>;
+  /** Local body versions (`_00_rv`) by encoded record id. */
+  readonly versions: ReadonlyMap<string, number>;
   /**
-   * Sign out and clear session
+   * What each durable `_00_view` row vouches for, by view key: its members
+   * and subquery children. A body no row names is an orphan: it never paints
+   * before the server answers and the GC deletes it.
    */
-  signOut(): Promise<void>;
-  private setSession;
-  signUp<Name extends keyof S['access'] & string>(accessName: Name, params: ExtractAccessParams<S, Name, 'signup'>): Promise<void>;
-  signIn<Name extends keyof S['access'] & string>(accessName: Name, params: ExtractAccessParams<S, Name, 'signIn'>): Promise<void>;
+  readonly views: ReadonlyMap<string, ReadonlyArray<string>>;
+  readonly outbox: ReadonlyArray<OutboxItem>;
+  readonly pendingWrites: ReadonlyMap<string, PendingWrite>;
+  readonly failedCount: number;
+  /** Queries whose render inputs changed since their last materialization. */
+  readonly dirty: ReadonlySet<QueryHash>;
+  /** Queries whose server membership must be re-read. */
+  readonly membershipDirty: ReadonlySet<QueryHash>;
+  readonly sync: SyncSlice;
+}
+//#endregion
+//#region src/modules/ref-tables.d.ts
+type RefMode = 'single' | 'dedicated';
+/**
+ * Sentinel user id for unauthenticated clients when anonymous live queries are
+ * enabled. Mirrors `ssp_protocol::ANON_AUTH_ID`. It carries no `user:` prefix
+ * so it can never collide with a real user id (those arrive as `user:<id>`);
+ * both sides resolve it to the shared `_00_list_ref_anon` table.
+ */
+//#endregion
+//#region src/query/env.d.ts
+/**
+ * Static configuration the sagas read. Plain data, built once by the runtime
+ * from `Sp00kyConfig`; sagas never see the config object itself.
+ */
+interface SagaEnv {
+  readonly schema: SchemaStructure;
+  readonly refMode: RefMode;
+  readonly anonLive: boolean;
+  readonly remoteTimeoutMs: number;
+  readonly pushTimeoutMs: number;
+  readonly outboxBatchSize: number;
+  readonly degradeAfter: number;
+  readonly materializeDebounceMs: number;
+  readonly pollBaseMs: number;
+  readonly defaultTtlMs: number;
 }
 //#endregion
-//#region src/sp00ky.d.ts
+//#region src/mutation/rows.d.ts
+interface FailedMutationRow {
+  id: string;
+  mutationType: MutationEventType;
+  recordId: string;
+  tableName: string;
+  data?: Record<string, unknown>;
+  beforeRecord?: Record<string, unknown> | null;
+  error: {
+    message: string;
+    kind: 'application' | 'unreplayable';
+  };
+  attempts: number;
+  createdAt: number;
+  failedAt: number;
+  revert: 'full' | 'partial' | 'none';
+}
+/**
+ * Parse a record id READ BACK FROM THE STORE, stripping SurrealDB's `⟨⟩`
+ * escaping (outbox ids contain `_`, so they come back escaped).
+ */
+//#endregion
+//#region src/kernel/interpreter.d.ts
+/** The five adapters plus the pure ports, as the interpreter sees them. */
+interface Adapters {
+  local: Pick<LocalStore, 'query' | 'execute' | 'select' | 'getById' | 'upsert' | 'delete'> & {
+    readonly epoch: number;
+  };
+  remote: {
+    queryResponses(sql: string, vars?: Record<string, unknown>): Promise<StatementResult[]>;
+    /**
+     * Subscribe to `LIVE SELECT * FROM <table>`; the callback receives the
+     * changed query hashes, plus the changed rows themselves when the
+     * subscription was opened with the body joined on (`liveInlineBodies`).
+     */
+    live(table: string, onChange: (hashes: string[], rows?: InlineRow[]) => void): Promise<string>;
+    kill(uuid: string): Promise<void>;
+  };
+  ssp: {
+    registerQueryPlan(plan: {
+      queryHash: string;
+      surql: string;
+      params: Record<string, unknown>;
+      ttl: Duration;
+      lastActiveAt: Date;
+      localArray: [];
+      remoteArray: [];
+      meta: {
+        tableName: string;
+        involvedTables?: string[];
+      };
+    }): StreamUpdate | undefined;
+    unregisterQueryPlan(hash: string): void;
+    ingestMany(records: IngestRecord[]): unknown;
+  };
+  timers: {
+    set(key: string, ms: number, fire: () => void): void;
+    clear(key: string): void;
+  };
+  clock: {
+    now(): number;
+  };
+  ids: Record<IdScope, () => string>;
+  hash(input: string): Promise<string>;
+  services: ServiceCalls;
+}
+/** What the interpreter needs from the runtime: state, waiting, emitting, dispatching. */
+//#endregion
+//#region src/client/runtime.d.ts
+interface RuntimeOptions {
+  env: SagaEnv;
+  adapters: Adapters;
+  logger: Logger$1;
+  tabId: string;
+  initialState?: ClientState;
+}
+/**
+ * The one effectful object of the engine: holds the state, runs sagas on
+ * lanes, fires timers, fans events out to subscribers and schedules
+ * materialization for dirty queries. No decision logic lives here.
+ */
+declare class Runtime {
+  private stateValue;
+  private readonly interpret;
+  private readonly env;
+  private readonly adapters;
+  private readonly logger;
+  private readonly serialLanes;
+  private readonly dedupeLanes;
+  private readonly waiters;
+  private readonly recordSubs;
+  private readonly statusSubs;
+  private readonly authoritySubs;
+  private readonly lastStatus;
+  private readonly listeners;
+  private readonly scheduledMaterialize;
+  private readonly timerKeys;
+  private lastActivity;
+  private lastHealth;
+  private disposed;
+  constructor(opts: RuntimeOptions);
+  get state(): ClientState;
+  /** Run a saga, optionally on a lane. Rejections propagate to the caller. */
+  run<R>(saga: Saga<R>, opts?: {
+    lane?: Lane;
+    signal?: AbortSignal;
+  }): Promise<R>;
+  /** Route an event to its saga. Never rejects: failures are logged. */
+  dispatch(event: RuntimeEvent): Promise<void>;
+  private setState;
+  waitFor(until: (s: ClientState) => boolean, signal?: AbortSignal): Promise<void>;
+  /** Deliver an outbound event to its subscribers and listeners. */
+  emit(event: OutEvent): void;
+  private notify;
+  private safely;
+  /** Observe outbound events by type (`'*'` for all). */
+  on(type: OutEvent['type'] | '*', cb: (event: OutEvent) => void): () => void;
+  subscribe(hash: QueryHash, cb: QueryUpdateCallback, options?: {
+    immediate?: boolean;
+  }): () => void;
+  subscribeStatus(hash: QueryHash, cb: QueryStatusCallback, options?: {
+    immediate?: boolean;
+  }): () => void;
+  subscribeAuthority(hash: QueryHash, cb: QueryAuthorityCallback, options?: {
+    immediate?: boolean;
+  }): () => void;
+  /** Apply a reducer outside a saga (facade conveniences such as timing reports). */
+  update(reducer: (s: ClientState) => ClientState): void;
+  dispose(): void;
+}
+//#endregion
+//#region src/services/tabs/coordinator.d.ts
+interface CoordinatorHooks {
+  /** Become the store owner: spawn the worker, open the pool under the given
+   *  per-leadership lock. Returns the resulting health for db-ready relays.
+   *  `resumeHeld` = keep the existing live worker (broker-restart path). */
+  adoptOwner(bucketId: string, opts: {
+    workerLockName: string;
+    allowMemoryFallback: boolean;
+    forceTakeover: boolean;
+    resumeHeld: boolean;
+  }): Promise<StorageHealth>;
+  /** Attach to a leader's worker through `dbPort`. */
+  adoptAttached(dbPort: MessagePort, snapshot: {
+    bucketId: string;
+    storageHealth: StorageHealth;
+    leadershipId: number;
+  }): Promise<void>;
+  /** We were leader and got demoted (zombie thaw / stale promotion): tear the
+   *  owned worker down so its SAH handles free up. */
+  releaseOwnership(): Promise<void>;
+  /** The leader (or its port) is gone; queue/park ops until a new role lands. */
+  onLeaderLost(reason: string): void;
+  /** Leader side: forward a follower's dbPort into the owned worker. */
+  exposeClientPort(clientId: string, port: MessagePort): Promise<void>;
+  removeClientPort(clientId: string): Promise<void>;
+  /** Sync layer role changes (implemented in the sync module). */
+  /** Synchronous leader WIRING. Must not block: the role is published and
+   *  `leader-ready` is sent right after it returns. */
+  becomeSyncLeader(hub: LeaderSyncHub): void;
+  /** The blocking half of the leader handover (outbox drain, LIVE restart),
+   *  run in the background once the tab is already a working leader. */
+  resumeSyncLeaderDuties(): Promise<void>;
+  becomeSyncFollower(forwarder: SyncForwarder): void;
+  becomeSyncSolo(): void;
+  /** Current storage health, for db-ready sent to late-joining followers. */
+  currentStorageHealth(): StorageHealth;
+}
+/** Leader-side fan-out surface handed to the sync layer. The sync router
+ *  (modules/sync/tab-router.ts) registers itself as the message handler. */
+declare class LeaderSyncHub {
+  readonly leadershipId: number;
+  private logger;
+  private followers;
+  private seq;
+  onFollowerMessage: ((tabId: TabId, msg: FollowerToLeaderMessage) => void) | null;
+  onFollowerDetached: ((tabId: TabId) => void) | null;
+  constructor(leadershipId: number, logger: Logger$1);
+  attach(tabId: TabId, port: MessagePort): void;
+  detach(tabId: TabId): void;
+  detachAll(): void;
+  sendTo(tabId: TabId, msg: LeaderToFollowerMessage): void;
+  broadcast(msg: LeaderToFollowerMessage, exceptTabId?: TabId): void;
+  /** Stamped ingest relay; seq lets followers detect gaps. */
+  relayIngest(tuples: IngestTuple[], exceptTabId?: TabId): void;
+  get followerCount(): number;
+  get relayedBatches(): number;
+}
+/** Follower half of the syncPort. Queues while detached (leaderless window)
+ *  and flushes on rebind; a lost-in-flight mutation notify is additionally
+ *  backstopped by the new leader reloading the shared outbox from the store. */
+declare class SyncForwarder {
+  private tabId;
+  private port;
+  private queued;
+  onLeaderMessage: ((msg: LeaderToFollowerMessage) => void) | null;
+  constructor(tabId: TabId);
+  rebind(port: MessagePort): void;
+  unbind(): void;
+  private post;
+  mutationEnqueued(mutationId: string): void;
+  /** An optimistic write this tab just ingested. Deliberately NOT queued while
+   *  detached: a new leader primes its circuit from the shared store, which
+   *  already holds the row, and replaying a stale tuple at it later would put
+   *  an older `_00_rv` in its version memo. */
+  ingest(tuples: IngestTuple[]): void;
+  requestPoll(): void;
+}
+declare class TabsCoordinator {
+  private deps;
+  role: TabRole$1;
+  leadershipId: number;
+  leaderTabId: TabId | null;
+  brokerRole: 'pending' | TabRole$1;
+  /** Wall time from `become-leader` to `leader-ready` on the last promotion.
+   *  Reported in the DevTools role-change event: a slow store adopt (OPFS pool
+   *  contention after the previous leader died) shows up here as seconds. */
+  lastPromotionMs: number | null;
+  private fingerprint;
+  private bucketId;
+  private broker;
+  private hub;
+  private forwarder;
+  private roleListeners;
+  private startResolve;
+  private startReject;
+  /** Ports received before start() resolves or between roles. */
+  private promotionChain;
+  private closed;
+  constructor(deps: {
+    tabId: TabId;
+    fingerprint: string;
+    hooks: CoordinatorHooks;
+    logger: Logger$1;
+    /** Fired on pagehide while this tab leads: last-chance OPFS release. */
+    onLeaderPageHide?: () => void;
+  });
+  /** Serialize role transitions; each is small but async (worker opens). */
+  private enqueue;
+  onRoleChange(cb: (role: TabRole$1) => void): () => void;
+  private setRole;
+  /** Connect the broker and resolve once this tab has a usable store role.
+   *  Rejects when no role lands in time; the caller then boots solo. */
+  start(bucketId: string): Promise<TabRole$1>;
+  /** Bucket switch: leave the old namespace, join the new one. Resolves when
+   *  a role lands in the new namespace. */
+  moveToBucket(bucketId: string): Promise<TabRole$1>;
+  private promote;
+  private demote;
+  private tabLock;
+  private teardownLeader;
+  private teardownFollower;
+  private serveFollower;
+  private attachToLeader;
+  private handleLeaderGone;
+  private fallbackToSolo;
+  get syncHub(): LeaderSyncHub | null;
+  get syncForwarder(): SyncForwarder | null;
+  get tabId(): TabId;
+  stop(): Promise<void>;
+}
+//#endregion
+//#region src/services/blobs/blob-store.d.ts
+/**
+ * Byte storage for cached bucket files.
+ *
+ * The default implementation is OPFS. Bucket files never arrive over HTTP in
+ * this client — `BucketHandle.get()` is a SurrealQL RPC on the sync socket — so
+ * neither the browser's HTTP cache nor the Cache API can hold them. We persist
+ * the bytes ourselves, and OPFS is the cheapest place to put them: a read is
+ * `getFile()` → a disk-backed lazy `File` that `URL.createObjectURL` can serve
+ * without ever moving the bytes through the JS heap.
+ *
+ * Layout is real nested directories rather than one hashed filename:
+ *
+ *   sp00ky-blobs/<namespace>/<bucket>/<...path segments>
+ *
+ * That costs a `getDirectoryHandle` per segment on write, and buys the property
+ * the whole orphan story rests on: the full `(bucket, path)` key is recoverable
+ * from a directory walk alone. The `_00_blob` manifest can therefore be wiped
+ * (memory fallback, SQLite pool wipe, IndexedDB corruption recovery) and be
+ * rebuilt from disk instead of taking the cached bytes down with it.
+ */
+/** Identifies one cached file: the bucket it lives in and its path within. */
+interface BlobKey {
+  bucket: string;
+  path: string;
+}
+/** What a directory walk can tell us about a stored file, with no manifest. */
+interface BlobStat {
+  key: BlobKey;
+  size: number;
+  /** File mtime. Seeds `lastAccess` when a manifest row has to be rebuilt. */
+  mtime: number;
+}
+interface BlobStore {
+  /** False for {@link MemoryBlobStore} and for OPFS-less environments: the
+   *  cache still dedupes and serves within a tab, but nothing survives reload. */
+  readonly persistent: boolean;
+  /** Namespace (the local bucketId) all keys are resolved under. */
+  readonly namespace: string;
+  read(key: BlobKey): Promise<Blob | null>;
+  /** Returns the number of bytes written. Throws on quota exhaustion. */
+  write(key: BlobKey, bytes: Blob): Promise<number>;
+  remove(key: BlobKey): Promise<void>;
+  /** Every committed file under the current namespace. Sweeps torn writes. */
+  list(): Promise<BlobStat[]>;
+  /** Drop the whole namespace (sign-out with `clearOnSignOut`, or a reset). */
+  clear(): Promise<void>;
+  /** Point at another namespace. Does not touch the bytes of the old one. */
+  setNamespace(namespace: string): void;
+}
+//#endregion
+//#region src/services/blobs/blob-manifest.d.ts
+interface BlobEntry {
+  /** `${bucket}/${path}` — also the `_00_blob` row id. */
+  id: string;
+  bucket: string;
+  path: string;
+  size: number;
+  contentType: string;
+  createdAt: number;
+  lastAccess: number;
+  hits: number;
+  /** Exempt from pressure eviction. Never expires on its own. */
+  pinned: boolean;
+}
+declare class BlobManifest {
+  private local;
+  private entries;
+  /** Ids whose in-memory state has not been written back yet. */
+  private dirty;
+  private removed;
+  private flushing;
+  constructor(local: LocalStore);
+  /**
+   * Hydrate from the rows matching `keys`. Ids come from the OPFS listing, so
+   * this never needs a full-table scan (and therefore never needs a QueryPlan).
+   * Any read failure yields an empty manifest: reconcile then rebuilds every
+   * row from disk, which is exactly the desired degradation.
+   */
+  load(ids: string[]): Promise<void>;
+  get(key: BlobKey): BlobEntry | undefined;
+  getById(id: string): BlobEntry | undefined;
+  all(): BlobEntry[];
+  totalBytes(): number;
+  pinnedBytes(): number;
+  put(entry: BlobEntry): void;
+  touch(id: string, now: number): void;
+  setPinned(id: string, pinned: boolean): boolean;
+  remove(id: string): void;
+  /** Forget everything without scheduling deletes — for a bucket switch, where
+   *  the rows belong to the store we are leaving and must stay put. */
+  reset(): void;
+  hasPendingWrites(): boolean;
+  /**
+   * Write back pending changes. Serialized: a second concurrent flush awaits
+   * the first rather than racing it into the same rows. Failures are swallowed
+   * on purpose — a lost metadata write costs an LRU timestamp, and the entry is
+   * rebuilt from disk on the next reconcile.
+   */
+  flush(): Promise<void>;
+  private doFlush;
+}
+//#endregion
+//#region src/services/blobs/blob-cache.d.ts
+interface BlobUrlLease {
+  url: string;
+  release(): void;
+}
+interface BlobReadOptions {
+  /** Write through to L1 on a miss. Default true. */
+  persist?: boolean;
+  /** Mark the entry exempt from pressure eviction. */
+  pin?: boolean;
+  /**
+   * Default `'never'`: a bucket path is treated as immutable, which is how the
+   * client writes them (`crypto.randomUUID() + ext`). `'head'` spends a remote
+   * `head()` to compare sizes before trusting L1.
+   */
+  revalidate?: 'never' | 'head';
+  /** Skip L0/L1 entirely and refill from remote. Backs `refetch()`. */
+  reload?: boolean;
+}
+interface BlobCacheStats {
+  entries: number;
+  totalBytes: number;
+  budgetBytes: number;
+  pinnedBytes: number;
+  evictedEntries: number;
+  evictedBytes: number;
+  reconciledEntries: number;
+  hits: number;
+  misses: number;
+  persistent: boolean;
+  /** True when pinned bytes alone exceed the budget: new entries stop being
+   *  written rather than pinned ones being thrown away. */
+  persistPaused: boolean;
+}
+interface BlobCacheOptions {
+  store: BlobStore;
+  manifest: BlobManifest;
+  /** L2 read. Resolves to null when the file does not exist remotely. */
+  fetchRemote(key: BlobKey): Promise<Blob | null>;
+  /** L2 metadata, for `revalidate: 'head'`. */
+  headRemote?(key: BlobKey): Promise<Record<string, unknown> | null>;
+  logger: Logger$1;
+  maxBytes: number;
+  now?: () => number;
+  /** Injected so the URL layer is exercisable off a DOM (node tests). */
+  urls?: {
+    create(blob: Blob): string;
+    revoke(url: string): void;
+  };
+}
+declare class BlobCache {
+  private readonly store;
+  private readonly manifest;
+  private readonly fetchRemote;
+  private readonly headRemote?;
+  private readonly logger;
+  private readonly now;
+  private readonly urlFactory;
+  private maxBytes;
+  private persistPaused;
+  /** Set after a quota failure survives one forced eviction. */
+  private persistDisabled;
+  private readonly urls;
+  /** Ids at zero references, oldest first — the hot-URL window. */
+  private idleUrls;
+  private readonly inflight;
+  private flushTimer;
+  private readonly onPageHide;
+  /**
+   * Resolves once the manifest has been reconciled against disk. Reads await
+   * it, so `start()` does NOT have to be awaited on the boot path — blocking
+   * boot on an OPFS directory walk delayed the WebSocket connect (and with it
+   * the connection supervisor) for no benefit.
+   */
+  private ready;
+  private hits;
+  private misses;
+  private evictedEntries;
+  private evictedBytes;
+  private reconciledEntries;
+  constructor(opts: BlobCacheOptions);
+  /** Coalesce manifest write-back. Metadata only, so losing the tail costs an
+   *  LRU timestamp that reconcile reseeds from the file mtime. */
+  private scheduleFlush;
+  /**
+   * Resolve the bytes for `key`, filling L1 on the way when `persist` is on.
+   * Returns null when the file does not exist remotely and is not cached.
+   */
+  read(key: BlobKey, options?: BlobReadOptions): Promise<Blob | null>;
+  /**
+   * An object URL for `key`, refcounted. Callers MUST `release()`; the URL is
+   * revoked once the last holder lets go and it falls out of the hot window.
+   */
+  acquireUrl(key: BlobKey, options?: BlobReadOptions): Promise<BlobUrlLease | null>;
+  private lease;
+  private releaseUrl;
+  private revokeUrl;
+  /** L1 lookup with the size check that catches torn and cross-tab writes. */
+  private readLocal;
+  /** True when the remote agrees with the cached size, or cannot be reached. */
+  private headMatches;
+  private fetchDeduped;
+  private persist;
+  private writeThrough;
+  /** Forget one path everywhere. Called on `bucket.put()`/`bucket.delete()`. */
+  invalidate(key: BlobKey): Promise<void>;
+  private dropLocal;
+  setPinned(key: BlobKey, pinned: boolean): void;
+  /**
+   * Bring total bytes under budget by dropping the least recently used
+   * entries. Pinned entries and anything with a live object URL are skipped —
+   * evicting bytes that a mounted `<img>` is displaying would blank it.
+   */
+  private enforceBudget;
+  /** Evict LRU-first until at or below `target`. Returns the resulting total. */
+  private evictTo;
+  /**
+   * Rebuild the manifest from what is actually on disk. OPFS wins on existence
+   * in both directions: files with no row get a row (seeded from mtime), rows
+   * are only loaded for files that exist, and torn `.part-` writes are swept by
+   * the walk itself.
+   *
+   * Rows whose file vanished outside our control (a browser origin eviction)
+   * are left in `_00_blob`. They are inert — `load()` only ever asks for ids it
+   * found on disk — and are overwritten if that path is cached again.
+   */
+  reconcile(): Promise<void>;
+  /** Warm the cache for offline use. Skips anything already cached. */
+  prefetch(keys: BlobKey[]): Promise<void>;
+  /** Bind to the boot bucket and hydrate the manifest from disk. Separate from
+   *  {@link setNamespace} because boot must reconcile even when the namespace
+   *  it lands on is the one the store was constructed with. */
+  start(namespace: string): Promise<void>;
+  /** Repoint at another local bucket. The bytes of the old one stay on disk so
+   *  switching back (or signing back in) is still warm. */
+  setNamespace(namespace: string): Promise<void>;
+  setMaxBytes(maxBytes: number): void;
+  /** Delete every cached byte in the current namespace. */
+  clear(): Promise<void>;
+  flush(): Promise<void>;
+  /** Flush metadata and drop every object URL. Must run before the local store
+   *  closes — the flush writes through it. */
+  close(): Promise<void>;
+  stats(): BlobCacheStats;
+}
+//#endregion
+//#region src/client/services.d.ts
+/** Everything the facade talks to besides the runtime. */
+interface Services<S extends SchemaStructure> {
+  logger: Logger$1;
+  /** What the logger wrote, for the DevTools Logs tab. Absent in test fakes. */
+  logTap?: LogTap;
+  local: LocalStore;
+  remote: RemoteDatabaseService;
+  connectionSupervisor: ConnectionSupervisor;
+  blobs: BlobCache;
+  persistence: PersistenceClient;
+  streamProcessor: StreamProcessorService;
+  migrator: LocalMigrator;
+  crdt: CrdtManager;
+  auth: AuthService<S>;
+  tabs: TabsCoordinator | null;
+  tabsUnsupportedReason: string | undefined;
+  tabId: string;
+}
+/** What the services need back from the runtime once it exists. */
+//#endregion
+//#region src/utils/blurhash.d.ts
+/**
+ * Blurhash generation settings. `true` enables with the defaults below, `false`
+ * disables. Resolution order for a put: per-call option > client config >
+ * default ON. See {@link Sp00kyConfig.blurhash}.
+ */
+type BlurhashSetting = boolean | BlurhashEncodeOptions;
+interface BlurhashEncodeOptions {
+  /** Horizontal detail components, 1-9. Defaults to 4. */
+  componentX?: number;
+  /** Vertical detail components, 1-9. Defaults to 3. */
+  componentY?: number;
+}
+/**
+ * Where an image's blurhash lives: a tiny sidecar object in the same bucket.
+ * Buckets have no per-object metadata channel (`put` is just `.put($content)`),
+ * so the hash for `covers/x_t.webp` is the text object `covers/x_t.webp.bh`.
+ */
+declare function blurhashSidecarPath(path: string): string;
+/** Extensions `bucket.put` treats as images worth hashing. */
+declare const BLURHASH_IMAGE_EXTENSIONS: readonly ["webp", "png", "jpg", "jpeg", "gif", "avif", "bmp"];
+declare function isImagePath(path: string): boolean;
+/**
+ * Decode `content` as an image and compute its blurhash. Browser-only: returns
+ * null (never throws) when image decoding is unavailable (node, workers without
+ * canvas), when the bytes are not a decodable image, or on any other failure —
+ * a missing hash must never break the upload that triggered it.
+ */
+declare function encodeImageToBlurhash(content: string | Uint8Array | Blob, options?: BlurhashEncodeOptions): Promise<string | null>;
+//#endregion
+//#region src/client/bucket-handle.d.ts
+/** Coerce whatever the `.get()` RPC hands back into a Blob. */
+declare function bucketContentToBlob(content: unknown): Blob | null;
+interface BucketPutOptions {
+  /** Override the client-level {@link Sp00kyConfig.blurhash} setting for this put. */
+  blurhash?: BlurhashSetting;
+}
+interface BucketPutResult {
+  /** The computed blurhash when the content was a hashable image; else null. */
+  blurhash: string | null;
+}
+interface BucketHandleSettings {
+  blurhash?: BlurhashSetting;
+  logger?: {
+    warn: (obj: unknown, msg?: string) => void;
+  };
+  /** The bucket's backend as generated (`'r2'`: files live with the SSP). */
+  backend?: string;
+  /** {@link Sp00kyConfig.files}: where `r2` bucket files are read and written. */
+  files?: {
+    endpoint?: string;
+  };
+}
+/** A handle's settings from the client config and the bucket's generated schema. */
+
 declare class BucketHandle {
   private bucketName;
-  private remote;
-  constructor(bucketName: string, remote: RemoteDatabaseService);
-  put(path: string, content: string | Uint8Array | Blob): Promise<void>;
+  /** Absent on the raw handle the cache itself reads through. */
+  private blobs?;
+  private settings?;
+  private io;
+  constructor(bucketName: string, remote: RemoteDatabaseService, /** Absent on the raw handle the cache itself reads through. */
+  blobs?: (BlobCache | null) | undefined, settings?: BucketHandleSettings | undefined);
+  /** Effective blurhash setting: per-call option > client config > default ON. */
+  private resolveBlurhash;
+  put(path: string, content: string | Uint8Array | Blob, options?: BucketPutOptions): Promise<BucketPutResult>;
+  /**
+   * The blurhash stored alongside an uploaded image (see
+   * {@link blurhashSidecarPath}), or null when there is none. Reads through the
+   * blob cache, so a warm client answers from OPFS without a network hop, and
+   * misses are remembered per tab so a hashless image costs at most one
+   * serialized remote read per session.
+   */
+  blurhash(path: string): Promise<string | null>;
   get(path: string): Promise<unknown>;
+  /**
+   * Read through the local blob cache: OPFS first, the bucket second. Unlike
+   * {@link get} this survives a reload and works offline. Returns null when the
+   * file exists in neither place.
+   */
+  read(path: string, options?: BlobReadOptions): Promise<Blob | null>;
+  /**
+   * A refcounted object URL for `path`, suitable for `<img src>`. The caller
+   * MUST call `release()` when the URL goes off screen. Returns null when the
+   * file does not exist, or when object URLs are unavailable (non-browser).
+   */
+  url(path: string, options?: BlobReadOptions): Promise<BlobUrlLease | null>;
+  /** Exempt `path` from pressure eviction. Pinned bytes never expire. */
+  pin(path: string): void;
+  unpin(path: string): void;
+  /** Drop `path` from the local cache without touching the remote file. */
+  evict(path: string): Promise<void>;
+  /** Warm the cache for offline use. Already-cached paths are skipped. */
+  prefetch(paths: string[]): Promise<void>;
   delete(path: string): Promise<void>;
   exists(path: string): Promise<boolean>;
   head(path: string): Promise<Record<string, unknown>>;
@@ -208,55 +2040,161 @@ declare class BucketHandle {
   rename(sourcePath: string, targetPath: string): Promise<void>;
   list(prefix?: string): Promise<string[]>;
 }
+//#endregion
+//#region src/client/sp00ky-client.d.ts
+interface Sp00kyClientDeps<S extends SchemaStructure> {
+  services?: Services<S>;
+  runtime?: Runtime;
+  env?: Partial<SagaEnv>;
+}
+/**
+ * The public client. Every method is a thin translation into a saga run, a
+ * state read, or a subscription on the runtime; the engine's behaviour lives
+ * in the sagas.
+ */
 declare class Sp00kyClient<S extends SchemaStructure> {
-  private config;
-  private local;
-  private remote;
-  private persistenceClient;
-  private migrator;
-  private cache;
-  private dataModule;
-  private sync;
-  private devTools;
-  private logger;
-  auth: AuthService<S>;
-  streamProcessor: StreamProcessorService;
-  get remoteClient(): Surreal;
-  get localClient(): Surreal;
-  get pendingMutationCount(): number;
-  subscribeToPendingMutations(cb: (count: number) => void): () => void;
-  constructor(config: Sp00kyConfig<S>);
-  /**
-   * Setup direct callbacks instead of event subscriptions
-   */
-  private setupCallbacks;
+  private readonly config;
+  readonly auth: AuthService<S>;
+  readonly streamProcessor: StreamProcessorService;
+  /** Web Push for this browser: subscribe, devices, self-pushes, service worker bridge. */
+  readonly webPush: WebPushModule;
+  private readonly services;
+  private readonly env;
+  private readonly runtime;
+  private readonly featureFlags;
+  private readonly appReleases;
+  /** Teardown for subscriptions the client itself owns. */
+  private readonly disposers;
+  /** Assigned in `wireAdapters`, which the constructor always runs. */
+  private impersonationBanner;
+  private readonly devTools;
+  private hub;
+  private forwarder;
+  private detachWindow;
+  private sharedActive;
+  constructor(config: Sp00kyConfig<S>, deps?: Sp00kyClientDeps<S>);
+  /** Adapter callbacks become runtime events; runtime events reach the legacy services. */
+  private wireAdapters;
+  /** Runtime events the DevTools panel follows; query transitions also go to the log. */
+  private forwardToDevTools;
   init(): Promise<void>;
   close(): Promise<void>;
-  authenticate(token: string): Promise<surrealdb0.Tokens>;
-  deauthenticate(): Promise<void>;
+  isLocalReady(): boolean;
   query<Table extends TableNames<S>>(table: Table, options: QueryOptions<TableModel<GetTable<S, Table>>, false>, ttl?: QueryTimeToLive): QueryBuilder<S, Table, Sp00kyQueryResultPromise>;
+  private registerInput;
   private initQuery;
+  /**
+   * The raw remote escape hatches bypass the query builder, so their shapes
+   * can never be on the server's query allowlist. When the generated schema
+   * says the allowlist is on, refuse them unless the app opted in explicitly.
+   */
+  private assertRawRemoteAllowed;
   queryRaw(sql: string, params: Record<string, any>, ttl: QueryTimeToLive): Promise<string>;
+  /**
+   * Preload = register a query nobody subscribes to. Resolved before on this
+   * device: returns at once. Never resolved: resolves when the server's
+   * membership and every body are local. `signal` aborts the wait.
+   */
+  preload(finalQuery: FinalQuery<S, any, any, any, any, any>, options?: PreloadOptions): Promise<void>;
   subscribe(queryHash: string, callback: (records: Record<string, any>[]) => void, options?: {
     immediate?: boolean;
   }): Promise<() => void>;
+  deregisterQuery(queryHash: string): void;
+  subscribeQueryStatus(queryHash: string, callback: QueryStatusCallback, options?: {
+    immediate?: boolean;
+  }): () => void;
+  subscribeQueryAuthority(queryHash: string, callback: QueryAuthorityCallback, options?: {
+    immediate?: boolean;
+  }): () => void;
+  reportFrontendTiming(queryHash: string, ms: number): void;
+  create<T extends Record<string, unknown>>(id: string, data: T): Promise<T>;
+  update<T extends Record<string, unknown>>(_table: string, id: string, data: Partial<T>, options?: UpdateOptions): Promise<T>;
+  delete(_table: string, id: string): Promise<void>;
   run<B extends BackendNames<S>, R extends BackendRoutes<S, B>>(backend: B, path: R, payload: RoutePayload<S, B, R>, options?: RunOptions): Promise<void>;
-  bucket<B extends BucketNames<S>>(name: B): BucketHandle;
-  create(id: string, data: Record<string, unknown>): Promise<Record<string, unknown>>;
-  update(table: string, id: string, data: Record<string, unknown>, options?: UpdateOptions): Promise<{
-    [x: string]: /*elided*/any;
-  }>;
-  delete(table: string, id: string): Promise<void>;
+  get failedMutationCount(): number;
+  subscribeToFailedMutations(cb: (count: number) => void): () => void;
+  listFailedMutations(): Promise<FailedMutationRow[]>;
+  retryFailedMutation(mutationId: string): Promise<boolean>;
+  discardFailedMutation(mutationId: string): Promise<boolean>;
+  get tabRole(): TabRole$1 | null;
+  get remoteClient(): Surreal;
+  get localClient(): unknown;
+  get pendingMutationCount(): number;
+  /** Kept for the e2e suite; the saga core has no LIVE retry ladder. */
+  get liveRetryCount(): number;
+  subscribeToPendingMutations(cb: (count: number) => void): () => void;
+  get fetchingQueryCount(): number;
+  subscribeToFetchActivity(cb: (fetching: number) => void): () => void;
+  get syncHealth(): SyncHealth;
+  subscribeToSyncHealth(cb: (health: SyncHealth) => void): () => void;
+  get storageHealth(): StorageHealth;
+  subscribeToStorageHealth(cb: (health: StorageHealth) => void): () => void;
+  /** The engine state, read-only. For tests and DevTools. */
+  get state(): ClientState;
+  /** Feed an event into the engine. For adapters, tests and DevTools. */
+  dispatch(event: RuntimeEvent): Promise<void>;
+  authenticate(token: string): Promise<surrealdb0.Tokens>;
+  deauthenticate(): Promise<void>;
   useRemote<T>(fn: (client: Surreal) => Promise<T> | T): Promise<T>;
-  private persistClientId;
-  private loadOrGenerateClientId;
+  remoteQuery<T extends unknown[]>(sql: string, vars?: Record<string, unknown>): Promise<T>;
+  /**
+   * Tell the client that the app's own impersonation banner is on screen.
+   * Only meaningful with `impersonationBanner: { mode: 'custom' }`, where it
+   * cancels the fallback that would otherwise show the built-in banner. Call
+   * it while the custom banner is rendered (the Solid `useImpersonation`
+   * hook does it for you with `rendersBanner: true`).
+   */
+  acknowledgeImpersonationBanner(): void;
+  feature(key: string, options?: FeatureFlagOptions): FeatureFlagHandle;
+  setFeatureOverride(key: string, variant: string | null, payload?: unknown): void;
+  clearFeatureOverrides(): void;
+  getFeatureOverrides(): Record<string, FeatureFlagOverride>;
+  appRelease(app: string, options?: AppReleaseOptions): AppReleaseHandle;
+  /** Open a `@crdt` field for editing. `draft` (from {@link createCrdtDraft})
+   *  hands over edits made before the record existed. */
+  openCrdtField(table: string, recordId: string, field: string, draft?: CrdtField): Promise<CrdtField>;
+  /** A detached `@crdt` document for a record not created yet; see
+   *  {@link openCrdtField}. */
+  createCrdtDraft(table: string, field: string): Promise<CrdtField>;
+  /** Close a `@crdt` field. The last close resolves once its unsent edits
+   *  are queued in the outbox; offline, once they are saved on the device. */
+  closeCrdtField(table: string, recordId: string, field: string): Promise<void>;
+  bucket<B extends BucketNames<S>>(name: B): BucketHandle;
+  getBlobCacheStats(): BlobCacheStats;
 }
 //#endregion
-//#region src/utils/index.d.ts
-declare function fileToUint8Array(file: File | Blob): Promise<Uint8Array>;
+//#region src/utils/semver.d.ts
+/** True when `a` is a valid version strictly greater than valid version `b`. */
+declare function semverGt(a: unknown, b: unknown): boolean;
+//#endregion
+//#region src/services/database/errors.d.ts
 /**
- * Helper for retrying DB operations with exponential backoff
+ * A local-store operation that did not answer within its deadline.
+ *
+ * The local write path (`db.create` / `db.update` / `db.delete`, every local
+ * query behind them) used to have no deadline anywhere: the SQLite worker
+ * transport parks a call until the worker replies, the surrealdb engine's
+ * query chain waits on the previous link, and `withRetry` retries without a
+ * clock. One op that never settled (a worker starved behind a long select, a
+ * lock verification awaiting `navigator.locks.query()` forever) left the
+ * caller's promise pending for the tab's lifetime - a chat composer that never
+ * re-enabled, a call that never got past "Connecting".
+ *
+ * The message says "timed out" on purpose: `classifySyncError` keys off it and
+ * treats the failure as transient (re-queue), never as an application error
+ * that rolls the mutation back. `retryable: false` keeps `withRetry` from
+ * spinning on it: the op is still running in the engine, retrying queues a
+ * second copy behind it.
  */
-
+declare class LocalOpTimeoutError extends Error {
+  readonly name = "LocalOpTimeoutError";
+  readonly retryable = false;
+  readonly op: string;
+  readonly timeoutMs: number;
+  constructor(op: string, timeoutMs: number);
+}
+/** Default deadline for one local-store operation. Generous: a cold 4k-row
+ *  select on a throttled tab is seconds, not tens of seconds. */
+declare const DEFAULT_LOCAL_OP_TIMEOUT_MS = 30000;
 //#endregion
-export { AuthEventSystem, AuthEventTypeMap, AuthEventTypes, AuthService, BucketHandle, DebounceOptions, EventSubscriptionOptions, Level, MutationCallback, MutationEvent, MutationEventType, PersistenceClient, PinoTransmit, QueryConfig, QueryConfigRecord, QueryHash, QueryState, QueryTimeToLive, QueryUpdateCallback, RecordVersionArray, RecordVersionDiff, RunOptions, Sp00kyClient, Sp00kyConfig, Sp00kyQueryResult, Sp00kyQueryResultPromise, StoreType, UpdateOptions, createAuthEventSystem, fileToUint8Array };
+export { ActiveImpersonation, AppReleaseHandle, AppReleaseModule, type AppReleaseOptions, type AppReleaseSnapshot, AuthEventSystem, AuthEventTypeMap, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, type BlobCacheStats, type BlobEntry, type BlobKey, type BlobReadOptions, type BlobUrlLease, type BlurhashEncodeOptions, type BlurhashSetting, type BridgeSignOutMessage, type BridgeTokenMessage, BucketHandle, BucketPutOptions, BucketPutResult, CURSOR_COLORS, ConnectionState, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, DebounceOptions, EventSubscriptionOptions, type FailedMutationRow as FailedMutation, FeatureFlagHandle, FeatureFlagModule, type FeatureFlagOptions, type FeatureFlagOverride, type FeatureFlagSnapshot, IMPERSONATION_ACCESS, ImpersonationCandidate, ImpersonationInfo, ImpersonationTimerHost, ImpersonationTimers, InlineRow, Level, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, MembershipOutcome, MutationCallback, MutationEvent, MutationEventType, ORIGIN_TOKEN_KEY, PUSH_ENDPOINT_KEY, PUSH_PAYLOAD_VERSION, PersistenceClient, PhaseStat, PinoTransmit, PreloadOptions, PreloadRefresh, type PushDeviceKind, type PushNotification, type PushNotificationAction, type PushOp, type PushPayload, type PushPayloadKind, type PushUrgency, QueryAuthorityCallback, QueryConfig, QueryConfigRecord, QueryHash, QueryState, QueryStatus, QueryStatusCallback, QueryTimeToLive, QueryTimings, QueryUpdateCallback, ReconnectConfig, RecordVersionArray, RecordVersionDiff, RegistrationTimings, RunOptions, SESSION_POLL_MS, SIGN_OUT_HOOK_TIMEOUT_MS, ServerViewMeta, SignOutContext, SignOutHook, Sp00kyClient, Sp00kyClientDeps, Sp00kyConfig, Sp00kyQueryResult, Sp00kyQueryResultPromise, StorageHealth, StorageHealthStatus, StoreType, SyncHealth, SyncHealthConfig, SyncHealthStatus, TimingPhase, TokenClaims, UpdateOptions, type WebPushClientMessage, type WebPushConfig, type WebPushDevice, WebPushError, type WebPushErrorCode, type WebPushInfo, type WebPushMessage, type WebPushMessageInput, WebPushModule, type WebPushSubscribeOptions, type WebPushSupport, type WebPushSyncOptions, type WebPushSyncStatus, type WebPushUnsubscribeOptions, type WebPushUnsupportedReason, type WebPushUpdateOptions, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, detectWebPushSupport, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, isPushPayload, renewDelayMs, sameImpersonation, semverGt, textToHtml };