@svadmin/pocketbase 0.10.7 → 0.11.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/pocketbase",
-  "version": "0.10.7",
+  "version": "0.11.6",
   "description": "PocketBase adapters — DataProvider, AuthProvider, LiveProvider for svadmin",
   "type": "module",
   "sideEffects": false,
@@ -20,9 +20,15 @@
     }
   },
   "peerDependencies": {
-    "@svadmin/core": "^0.50.0",
+    "@svadmin/core": "^0.52.0",
     "pocketbase": ">=0.28.0"
   },
+  "dependencies": {
+    "@sinclair/typebox": "^0.34.52"
+  },
+  "devDependencies": {
+    "pocketbase": "0.28.0"
+  },
   "keywords": [
     "svadmin",
     "pocketbase",
@@ -34,7 +40,7 @@
   "author": "zuohuadong",
   "repository": {
     "type": "git",
-    "url": "https://github.com/vibeunion/svadmin.git",
+    "url": "git+https://github.com/vibeunion/svadmin.git",
     "directory": "packages/pocketbase"
   },
   "homepage": "https://github.com/vibeunion/svadmin#readme",

package/src/auth-provider.ts

@@ -1,117 +1,179 @@
-// @svadmin/pocketbase — PocketBase AuthProvider
+import { Type } from '@sinclair/typebox';
+import { definedOptions } from '@svadmin/core/options';
 import type { AuthProvider, Identity, AuthActionResult, CheckResult } from '@svadmin/core';
+import { authRecord, collectionName, decode, nonempty, PocketBaseBoundaryError } from './boundary';
 
-interface PocketBaseAuthOptions {
-  /** PocketBase client instance */
-  pb: unknown; // PocketBase
-}
-
-// Duck-typed PocketBase client with auth methods
-interface PBClientAuth {
-  authStore: {
-    isValid: boolean;
-    model: { id: string; name?: string; email: string; avatar?: string; [key: string]: unknown } | null;
-    clear: () => void;
-    token: string;
+export interface PocketBaseAuthClient {
+  readonly authStore: {
+    readonly isValid: unknown;
+    readonly record: unknown;
+    readonly token: unknown;
+    clear(): void;
   };
-  collection: (name: string) => {
-    authWithPassword: (email: string, password: string) => Promise<{ record: Record<string, unknown>; token: string }>;
-    create: (data: Record<string, unknown>) => Promise<Record<string, unknown>>;
-    requestPasswordReset: (email: string) => Promise<boolean>;
-    confirmPasswordReset: (token: string, password: string, passwordConfirm: string) => Promise<boolean>;
+  collection(name: string): {
+    authWithPassword(email: string, password: string): Promise<unknown>;
+    create(data: Record<string, unknown>): Promise<unknown>;
+    requestPasswordReset(email: string): Promise<unknown>;
+    confirmPasswordReset(token: string, password: string, passwordConfirm: string): Promise<unknown>;
   };
 }
 
-/**
- * Create an AuthProvider backed by PocketBase.
- *
- * Usage:
- * ```ts
- * import PocketBase from 'pocketbase';
- * import { createPocketBaseAuthProvider } from '@svadmin/pocketbase';
- *
- * const pb = new PocketBase('http://127.0.0.1:8090');
- * const authProvider = createPocketBaseAuthProvider({ pb });
- * ```
- */
-export function createPocketBaseAuthProvider(options: PocketBaseAuthOptions): AuthProvider {
-  const pb = options.pb as PBClientAuth;
+export interface PocketBaseAuthOptions {
+  pb: PocketBaseAuthClient;
+}
+
+const collection = Type.Optional(collectionName);
+const username = Type.Optional(nonempty);
+const credentials = Type.Object({ email: nonempty, password: nonempty, username, collection }, { additionalProperties: false });
+const registration = Type.Object({
+  email: nonempty, password: nonempty, username,
+  confirmPassword: Type.Optional(nonempty), name: Type.Optional(Type.String()), collection,
+}, { additionalProperties: false });
+const resetRequest = Type.Object({ email: nonempty, username, collection }, { additionalProperties: false });
+const resetConfirmation = Type.Object({
+  token: nonempty, password: nonempty, confirmPassword: Type.Optional(nonempty), collection,
+}, { additionalProperties: false });
+const authResponse = Type.Object({ record: authRecord, token: nonempty });
+const session = Type.Object({ isValid: Type.Literal(true), record: authRecord, token: nonempty });
+const confirmed = Type.Literal(true);
+
+function validateIdentifier(input: { email: string; username?: string }): void {
+  if (input.username !== undefined && input.username !== input.email) throw new PocketBaseBoundaryError('input');
+}
+
+function failure(operation: string, error: unknown, write = false): AuthActionResult {
+  if (error instanceof PocketBaseBoundaryError) {
+    return {
+      success: false,
+      error: {
+        name: write && error.phase === 'response' ? 'WRITE_OUTCOME_UNKNOWN' : 'INVALID_AUTH_DATA',
+        message: write && error.phase === 'response'
+          ? `${operation} response was invalid; the operation may have succeeded.`
+          : error.message,
+      },
+    };
+  }
+  return { success: false, error: { message: `${operation} failed.` } };
+}
+
+/** SDK return values and auth-store records enter the application only after validation. */
+export function createPocketBaseAuthProvider({ pb }: PocketBaseAuthOptions): AuthProvider {
+  function currentRecord() {
+    try {
+      const isValid: unknown = pb.authStore.isValid;
+      if (isValid === false) return null;
+      return decode(session, {
+        isValid, record: pb.authStore.record, token: pb.authStore.token,
+      }, 'session').record;
+    } catch {
+      pb.authStore.clear();
+      return null;
+    }
+  }
 
   return {
-    async login({ email, password, collection }: Record<string, unknown>): Promise<AuthActionResult> {
+    async login(params): Promise<AuthActionResult> {
       try {
-        const col = (collection as string) || 'users';
-        await pb.collection(col).authWithPassword(email as string, password as string);
+        const input = decode(credentials, params, 'input');
+        validateIdentifier(input);
+        const result: unknown = await pb.collection(input.collection ?? 'users')
+          .authWithPassword(input.email, input.password);
+        try {
+          decode(authResponse, result, 'response');
+        } catch (error) {
+          pb.authStore.clear();
+          throw error;
+        }
         return { success: true, redirectTo: '/' };
-      } catch (err) {
-        return { success: false, error: { message: (err as Error).message } };
+      } catch (error) {
+        return failure('Login', error);
       }
     },
 
     async logout(): Promise<AuthActionResult> {
-      pb.authStore.clear();
-      return { success: true, redirectTo: '/login' };
+      try {
+        pb.authStore.clear();
+        return { success: true, redirectTo: '/login' };
+      } catch (error) {
+        return failure('Logout', error);
+      }
     },
 
     async check(): Promise<CheckResult> {
-      if (pb.authStore.isValid && pb.authStore.model) {
-        return { authenticated: true };
-      }
-      return { authenticated: false, redirectTo: '/login', logout: true };
+      return currentRecord()
+        ? { authenticated: true }
+        : { authenticated: false, redirectTo: '/login', logout: true };
     },
 
     async getIdentity(): Promise<Identity | null> {
-      const model = pb.authStore.model;
-      if (!model) return null;
-      return {
-        id: model.id,
-        name: model.name || model.email.split('@')[0],
-        email: model.email,
-        avatar: model.avatar,
-      };
+      const record = currentRecord();
+      if (!record) return null;
+      return definedOptions({
+        id: record.id,
+        name: record.name || record.email?.split('@')[0] || record.id,
+        email: record.email,
+        avatar: record.avatar,
+      });
     },
 
-    async register({ email, password, passwordConfirm, name, collection }: Record<string, unknown>): Promise<AuthActionResult> {
+    async register(params): Promise<AuthActionResult> {
       try {
-        const col = (collection as string) || 'users';
-        await pb.collection(col).create({
-          email: email as string,
-          password: password as string,
-          passwordConfirm: (passwordConfirm ?? password) as string,
-          name: name as string | undefined,
-        });
+        const input = decode(registration, params, 'input');
+        validateIdentifier(input);
+        if (input.confirmPassword !== undefined && input.confirmPassword !== input.password) {
+          throw new PocketBaseBoundaryError('input');
+        }
+        const result: unknown = await pb.collection(input.collection ?? 'users').create(definedOptions({
+          email: input.email, password: input.password,
+          passwordConfirm: input.confirmPassword ?? input.password, name: input.name,
+        }));
+        decode(authRecord, result, 'response');
         return { success: true, redirectTo: '/login' };
-      } catch (err) {
-        return { success: false, error: { message: (err as Error).message } };
+      } catch (error) {
+        return failure('Registration', error, true);
       }
     },
 
-    async forgotPassword({ email, collection }: Record<string, unknown>): Promise<AuthActionResult> {
+    async forgotPassword(params): Promise<AuthActionResult> {
       try {
-        const col = (collection as string) || 'users';
-        await pb.collection(col).requestPasswordReset(email as string);
+        const input = decode(resetRequest, params, 'input');
+        validateIdentifier(input);
+        const result: unknown = await pb.collection(input.collection ?? 'users').requestPasswordReset(input.email);
+        decode(confirmed, result, 'response');
         return { success: true };
-      } catch (err) {
-        return { success: false, error: { message: (err as Error).message } };
+      } catch (error) {
+        return failure('Password reset request', error, true);
       }
     },
 
-    async updatePassword({ token, password, passwordConfirm, collection }: Record<string, unknown>): Promise<AuthActionResult> {
+    async updatePassword(params): Promise<AuthActionResult> {
       try {
-        const col = (collection as string) || 'users';
-        await pb.collection(col).confirmPasswordReset(
-          token as string,
-          password as string,
-          (passwordConfirm ?? password) as string,
+        const input = decode(resetConfirmation, params, 'input');
+        if (input.confirmPassword !== undefined && input.confirmPassword !== input.password) {
+          throw new PocketBaseBoundaryError('input');
+        }
+        const result: unknown = await pb.collection(input.collection ?? 'users').confirmPasswordReset(
+          input.token, input.password, input.confirmPassword ?? input.password,
         );
+        decode(confirmed, result, 'response');
         return { success: true, redirectTo: '/' };
-      } catch (err) {
-        return { success: false, error: { message: (err as Error).message } };
+      } catch (error) {
+        return failure('Password reset', error, true);
       }
     },
 
-    async onError(error: unknown): Promise<{ redirectTo?: string; logout?: boolean }> {
-      if (error instanceof Error && (error.message.includes('401') || error.message.includes('403'))) {
+    async onError(error): Promise<{ redirectTo?: string; logout?: boolean }> {
+      // SDK errors are class instances. Only the numeric status is projected.
+      let status: unknown;
+      try {
+        const descriptor = typeof error === 'object' && error !== null
+          ? Object.getOwnPropertyDescriptor(error, 'status') : undefined;
+        status = descriptor && 'value' in descriptor ? descriptor.value : undefined;
+      } catch {
+        return {};
+      }
+      if (status === 401 || status === 403) {
+        pb.authStore.clear();
         return { redirectTo: '/login', logout: true };
       }
       return {};

package/src/boundary.ts

@@ -0,0 +1,30 @@
+import { Type, type Static, type TSchema } from '@sinclair/typebox';
+import { checkExact, snapshotPlainData } from '@svadmin/core/schema';
+
+export const nonempty = Type.String({ minLength: 1 });
+export const collectionName = Type.String({ minLength: 1, pattern: '^[A-Za-z0-9_]+$' });
+export const authRecord = Type.Object({
+  id: nonempty,
+  name: Type.Optional(Type.String()),
+  email: Type.Optional(Type.String()),
+  avatar: Type.Optional(Type.String()),
+});
+
+export class PocketBaseBoundaryError extends Error {
+  constructor(readonly phase: 'input' | 'response' | 'session' | 'event') {
+    super(`Invalid PocketBase ${phase}`);
+    this.name = 'PocketBaseBoundaryError';
+  }
+}
+
+export function decode<S extends TSchema>(
+  schema: S, value: unknown, phase: PocketBaseBoundaryError['phase'],
+): Static<S> {
+  try {
+    const candidate = snapshotPlainData(value);
+    if (checkExact(schema, candidate)) return candidate;
+  } catch {
+    // Never expose submitted credentials, SDK payloads, or accessor exceptions.
+  }
+  throw new PocketBaseBoundaryError(phase);
+}

package/src/data-provider.ts

@@ -1,26 +1,25 @@
-/* eslint-disable @typescript-eslint/no-explicit-any */
 // @svadmin/pocketbase — PocketBase DataProvider
 // Maps svadmin CRUD operations to PocketBase SDK
 
 import type {
-  DataProvider, GetListParams, GetListResult, GetOneParams, GetOneResult,
-  CreateParams, CreateResult, UpdateParams, UpdateResult, DeleteParams, DeleteResult,
-  GetManyParams, GetManyResult, DeleteManyParams, DeleteManyResult, BaseRecord,
+  DataProvider,
 } from '@svadmin/core';
+import { definedOptions } from '@svadmin/core/options';
+import { withValidatedResponses, type DataTransport } from '@svadmin/core/schema';
 
 interface PocketBaseProviderOptions {
   /** PocketBase client instance */
-  pb: unknown; // PocketBase
+  pb: PBClient;
 }
 
-// Duck-typed PocketBase collection interface
+// SDK results remain unknown until the shared response boundary validates them.
 interface PBCollection {
-  getList: (page: number, perPage: number, options?: { sort?: string; filter?: string }) => Promise<{ items: Record<string, unknown>[]; totalItems: number }>;
-  getOne: (id: string) => Promise<Record<string, unknown>>;
-  getFullList: (options?: { sort?: string; filter?: string; batch?: number }) => Promise<Record<string, unknown>[]>;
-  create: (data: Record<string, unknown>) => Promise<Record<string, unknown>>;
-  update: (id: string, data: Record<string, unknown>) => Promise<Record<string, unknown>>;
-  delete: (id: string) => Promise<boolean>;
+  getList: (page: number, perPage: number, options?: { sort?: string; filter?: string }) => Promise<unknown>;
+  getOne: (id: string) => Promise<unknown>;
+  getFullList: (options?: { sort?: string; filter?: string; batch?: number }) => Promise<unknown>;
+  create: (data: Record<string, unknown>) => Promise<unknown>;
+  update: (id: string, data: Record<string, unknown>) => Promise<unknown>;
+  delete: (id: string) => Promise<unknown>;
 }
 
 interface PBClient {
@@ -28,6 +27,15 @@ interface PBClient {
   buildUrl: (path: string) => string;
 }
 
+function isObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function inputRecord(value: unknown): Record<string, unknown> {
+  if (!isObject(value)) throw new TypeError('PocketBase variables must be an object');
+  return value;
+}
+
 function buildSort(sorters?: { field: string; order: 'asc' | 'desc' }[]): string | undefined {
   if (!sorters?.length) return undefined;
   return sorters.map(s => s.order === 'desc' ? `-${s.field}` : s.field).join(',');
@@ -48,7 +56,9 @@ function buildFilter(filters?: { field: string; operator: string; value: unknown
       case 'lte': return `${f.field} <= '${v}'`;
       case 'null': return `${f.field} = ''`;
       case 'nnull': return `${f.field} != ''`;
-      case 'in': return `${f.field} ?= '${(v as unknown[]).join("' || " + f.field + " ?= '")}'`;
+      case 'in':
+        if (!Array.isArray(v)) throw new TypeError('PocketBase in filter requires an array');
+        return `${f.field} ?= '${v.join("' || " + f.field + " ?= '")}'`;
       default: return `${f.field} = '${v}'`;
     }
   }).join(' && ');
@@ -67,57 +77,62 @@ function buildFilter(filters?: { field: string; operator: string; value: unknown
  * ```
  */
 export function createPocketBaseDataProvider(options: PocketBaseProviderOptions): DataProvider {
-  const pb = options.pb as PBClient;
+  const pb = options.pb;
 
-  return {
+  const transport: DataTransport = {
     getApiUrl: () => pb.buildUrl('/api'),
 
-    async getList<TData extends BaseRecord = BaseRecord>(params: GetListParams): Promise<GetListResult<TData>> {
+    async getList(params) {
       const page = params.pagination?.current ?? 1;
       const perPage = params.pagination?.pageSize ?? 10;
-      const result = await pb.collection(params.resource).getList(page, perPage, {
+      const result = await pb.collection(params.resource).getList(page, perPage, definedOptions({
         sort: buildSort(params.sorters),
-        filter: buildFilter((params.filters || []).filter((f) => 'field' in f) as any),
-      });
+        filter: buildFilter((params.filters || []).filter((f) => 'field' in f)),
+      }));
+      if (!isObject(result)) return result;
       return {
-        data: result.items as unknown as TData[],
-        total: result.totalItems,
+        data: result['items'],
+        total: result['totalItems'],
       };
     },
 
-    async getOne<TData extends BaseRecord = BaseRecord>(params: GetOneParams): Promise<GetOneResult<TData>> {
+    async getOne(params) {
       const record = await pb.collection(params.resource).getOne(String(params.id));
-      return { data: record as unknown as TData };
+      return { data: record };
     },
 
-    async create<TData extends BaseRecord = BaseRecord, TVariables = unknown>(params: CreateParams<TVariables>): Promise<CreateResult<TData>> {
-      const record = await pb.collection(params.resource).create(params.variables as Record<string, unknown>);
-      return { data: record as unknown as TData };
+    async create(params) {
+      const variables = inputRecord(params.variables);
+      const record = await pb.collection(params.resource).create(variables);
+      return { data: record };
     },
 
-    async update<TData extends BaseRecord = BaseRecord, TVariables = unknown>(params: UpdateParams<TVariables>): Promise<UpdateResult<TData>> {
-      const record = await pb.collection(params.resource).update(String(params.id), params.variables as Record<string, unknown>);
-      return { data: record as unknown as TData };
+    async update(params) {
+      const variables = inputRecord(params.variables);
+      const record = await pb.collection(params.resource).update(String(params.id), variables);
+      return { data: record };
     },
 
-    async deleteOne<TData extends BaseRecord = BaseRecord, TVariables = unknown>(params: DeleteParams<TVariables>): Promise<DeleteResult<TData>> {
-      await pb.collection(params.resource).delete(String(params.id));
-      return { data: { id: params.id } as unknown as TData };
+    async deleteOne(params) {
+      const deleted = await pb.collection(params.resource).delete(String(params.id));
+      return deleted === true ? { data: { id: params.id } } : undefined;
     },
 
-    async getMany<TData extends BaseRecord = BaseRecord>(params: GetManyParams): Promise<GetManyResult<TData>> {
+    async getMany(params) {
       const filter = params.ids.map(id => `id = '${id}'`).join(' || ');
       const records = await pb.collection(params.resource).getFullList({ filter });
-      return { data: records as unknown as TData[] };
+      return { data: records };
     },
 
-    async deleteMany<TData extends BaseRecord = BaseRecord, TVariables = unknown>(params: DeleteManyParams<TVariables>): Promise<DeleteManyResult<TData>> {
+    async deleteMany(params) {
       const results: unknown[] = [];
       for (const id of params.ids) {
-        await pb.collection(params.resource).delete(String(id));
+        const deleted = await pb.collection(params.resource).delete(String(id));
+        if (deleted !== true) return undefined;
         results.push({ id });
       }
-      return { data: results as unknown as TData[] };
+      return { data: results };
     },
   };
+  return withValidatedResponses(transport);
 }

package/src/index.ts

@@ -2,4 +2,6 @@
 
 export { createPocketBaseDataProvider } from './data-provider';
 export { createPocketBaseAuthProvider } from './auth-provider';
-export { createPocketBaseLiveProvider } from './live-provider';
+export type { PocketBaseAuthClient, PocketBaseAuthOptions } from './auth-provider';
+export { createPocketBaseLiveProvider, PocketBaseLiveError } from './live-provider';
+export type { PocketBaseRealtimeClient, PocketBaseLiveOptions } from './live-provider';

package/src/live-provider.ts

@@ -1,65 +1,111 @@
-// @svadmin/pocketbase — PocketBase LiveProvider (SSE Realtime)
+import { Type, type Static } from '@sinclair/typebox';
 import type { LiveProvider, LiveEvent } from '@svadmin/core';
+import { collectionName, decode, nonempty } from './boundary';
 
-interface PocketBaseLiveOptions {
-  /** PocketBase client instance */
-  pb: unknown; // PocketBase
+export interface PocketBaseRealtimeClient {
+  collection(name: string): {
+    subscribe(topic: string, callback: (event: unknown) => void): Promise<unknown>;
+  };
 }
 
-// Duck-typed PocketBase realtime interface
-interface PBClientRealtime {
-  collection: (name: string) => {
-    subscribe: (topic: string, callback: (data: PBRealtimeEvent) => void) => Promise<void>;
-    unsubscribe: (topic?: string, callback?: (data: PBRealtimeEvent) => void) => Promise<void>;
-  };
+type LiveErrorCode = 'INVALID_EVENT' | 'SUBSCRIBE_FAILED' | 'UNSUBSCRIBE_FAILED' | 'CALLBACK_FAILED';
+
+export class PocketBaseLiveError extends Error {
+  constructor(readonly code: LiveErrorCode) {
+    super(`PocketBase realtime ${code.toLowerCase().replaceAll('_', ' ')}`);
+    this.name = 'PocketBaseLiveError';
+  }
 }
 
-interface PBRealtimeEvent {
-  action: 'create' | 'update' | 'delete';
-  record: Record<string, unknown>;
+export interface PocketBaseLiveOptions {
+  pb: PocketBaseRealtimeClient;
+  onError?: (error: PocketBaseLiveError) => void;
 }
 
-/**
- * Map PocketBase realtime action to svadmin LiveEvent type.
- */
-function mapAction(action: string): LiveEvent['type'] {
+const eventSchema = Type.Object({
+  action: Type.Union([Type.Literal('create'), Type.Literal('update'), Type.Literal('delete')]),
+  record: Type.Object({ id: nonempty }),
+}, { additionalProperties: false });
+
+function mapAction(action: Static<typeof eventSchema>['action']): LiveEvent['type'] {
   switch (action) {
     case 'create': return 'INSERT';
     case 'update': return 'UPDATE';
     case 'delete': return 'DELETE';
-    default: return 'UPDATE';
   }
 }
 
-/**
- * Create a LiveProvider backed by PocketBase Realtime (SSE).
- *
- * Usage:
- * ```ts
- * import PocketBase from 'pocketbase';
- * import { createPocketBaseLiveProvider } from '@svadmin/pocketbase';
- *
- * const pb = new PocketBase('http://127.0.0.1:8090');
- * const liveProvider = createPocketBaseLiveProvider({ pb });
- * ```
- */
+/** Each subscription owns the SDK-provided disposer, including cancellation during setup. */
 export function createPocketBaseLiveProvider(options: PocketBaseLiveOptions): LiveProvider {
-  const pb = options.pb as PBClientRealtime;
+  const report = (code: LiveErrorCode): void => {
+    const error = new PocketBaseLiveError(code);
+    if (!options.onError) {
+      console.error(error);
+      return;
+    }
+    try {
+      void Promise.resolve(options.onError(error)).catch(() => {
+        console.error('PocketBase realtime error handler failed');
+      });
+    } catch {
+      console.error('PocketBase realtime error handler failed');
+    }
+  };
 
   return {
     subscribe({ resource, callback }) {
-      const handler = (data: PBRealtimeEvent) => {
-        callback({
-          type: mapAction(data.action),
-          resource,
-          payload: data.record,
-        });
+      const name = decode(collectionName, resource, 'input');
+      let active = true;
+      let dispose: (() => unknown) | undefined;
+      let disposed = false;
+      const cleanup = (): void => {
+        if (!dispose || disposed) return;
+        disposed = true;
+        try {
+          const result = dispose();
+          void Promise.resolve(result).catch(() => report('UNSUBSCRIBE_FAILED'));
+        } catch {
+          report('UNSUBSCRIBE_FAILED');
+        }
       };
-
-      pb.collection(resource).subscribe('*', handler).catch(console.error);
-
+      const handler = (value: unknown): void => {
+        if (!active) return;
+        let event: LiveEvent;
+        try {
+          const data = decode(eventSchema, value, 'event');
+          event = { type: mapAction(data.action), resource: name, payload: data.record };
+        } catch {
+          report('INVALID_EVENT');
+          return;
+        }
+        try {
+          void Promise.resolve(callback(event)).catch(() => report('CALLBACK_FAILED'));
+        } catch {
+          report('CALLBACK_FAILED');
+        }
+      };
+      try {
+        const result = options.pb.collection(name).subscribe('*', handler);
+        void Promise.resolve(result).then((unsubscribe: unknown) => {
+          if (typeof unsubscribe !== 'function') {
+            active = false;
+            report('SUBSCRIBE_FAILED');
+            return;
+          }
+          dispose = (): unknown => unsubscribe();
+          if (!active) cleanup();
+        }, () => {
+          const wasActive = active;
+          active = false;
+          if (wasActive) report('SUBSCRIBE_FAILED');
+        });
+      } catch {
+        active = false;
+        report('SUBSCRIBE_FAILED');
+      }
       return () => {
-        pb.collection(resource).unsubscribe('*', handler).catch(console.error);
+        active = false;
+        cleanup();
       };
     },
   };