@wells-nelson/data-storage 1.0.0 → 1.0.2

package/dist/sql.js

@@ -1,12 +1,34 @@
 /**
  * Generates the Supabase migration for an app's tables: `_deleted` / `_modified` replication
- * columns with their trigger and checkpoint index, `current_email()`, a membership table with
- * an `is_<noun>_member` helper and RLS on every table, the creator-becomes-member trigger, the
- * "touch rows on new share" trigger, the members RPC (active / pending) and the realtime
- * publication. With `roles`, members are viewer / editor / owner and the last owner is protected.
+ * columns with their trigger and checkpoint index, `current_email()` (confirmed emails only), a
+ * membership table with an `is_<noun>_member` helper and RLS on every table, the
+ * creator-becomes-member trigger, the "touch rows on new share" trigger, the members RPC
+ * (active / pending), a write-only `client_errors` table with its `report_client_error`
+ * function, and the realtime publication. With `roles`, members are viewer / editor / owner and
+ * the last owner is protected. Signed-out callers (`anon`) get nothing but `report_client_error`.
  *
  * Pure string building: no database or Svelte dependency, so it runs from a plain Node script.
  */
+/** Move everything the migration creates from `public` into `schema` (`auth.*` is untouched). */
+function inSchema(sql, schema) {
+    const setup = `-- ---------------------------------------------------------------- schema
+
+create schema if not exists ${schema};
+
+-- Signed-in users (authenticated) get table access, and row level security on every table decides
+-- what each one can read and write. Signed-out callers (anon) get none, so a table added later
+-- without RLS still isn't public; anon only reaches report_client_error, granted below.
+grant usage on schema ${schema} to anon, authenticated, service_role;
+alter default privileges in schema ${schema} grant all on tables to authenticated, service_role;
+alter default privileges in schema ${schema} grant all on functions to authenticated, service_role;
+alter default privileges in schema ${schema} grant all on sequences to authenticated, service_role;
+
+`;
+    return sql
+        .replaceAll('public.', `${schema}.`)
+        .replaceAll('set search_path = public', `set search_path = ${schema}`)
+        .replace('-- ---------------------------------------------------------------- helpers', `${setup}-- ---------------------------------------------------------------- helpers`);
+}
 const SQL_TYPES = { text: 'text', number: 'double precision', boolean: 'boolean' };
 const DEFAULTS = { text: "''", number: '0', boolean: 'false' };
 function columnSql(name, spec) {
@@ -33,7 +55,9 @@ export function tablesFromSchemas(collections, schemas, options) {
     });
 }
 export function generateMigration(config) {
-    const { container, containerField: cf, noun, roles = false } = config;
+    const { container, containerField: cf, noun, roles = false, schema = 'public' } = config;
+    if (!/^[a-z_][a-z0-9_]*$/.test(schema))
+        throw new Error(`Not a valid schema name: "${schema}".`);
     const members = config.membersTable ?? `${noun}_members`;
     const rpc = config.membersRpc ?? `get_${noun}_members`;
     const isMember = `is_${noun}_member`;
@@ -67,12 +91,20 @@ begin
 end;
 $$;
 
+-- The signed-in user's email, only once confirmed: a session whose email was never verified
+-- (e.g. a password sign-up with confirmation off) matches no membership. Read from auth.users,
+-- not the token, so a changed email applies right away.
 create or replace function public.current_email()
 returns text
 language sql
 stable
+security definer
+set search_path = ''
 as $$
-  select lower(coalesce(auth.jwt() ->> 'email', ''));
+  select coalesce((
+    select lower(u.email) from auth.users u
+    where u.id = auth.uid() and u.email_confirmed_at is not null
+  ), '');
 $$;
 
 -- ---------------------------------------------------------------- membership
@@ -104,14 +136,31 @@ as $$
   );
 $$;
 
+-- False once the ${noun} is deleted: nobody can add members or new rows to it. (Members still
+-- read and update its rows, so every device syncs the deletion.)
+create or replace function public.is_${noun}_live(p_${cf} text)
+returns boolean
+language sql
+stable
+security definer
+set search_path = public
+as $$
+  select not exists (select 1 from public.${container} c where c.id = p_${cf} and c._deleted);
+$$;
+
 alter table public.${members} enable row level security;
 `);
     if (roles) {
         add(`
+-- Editors and owners see every member; viewers see the owners and themselves.
 create policy "members read members" on public.${members}
-  for select to authenticated using (public.${isMember}(${cf}));
+  for select to authenticated using (
+    email = public.current_email()
+    or public.${isMember}(${cf}, 'editor')
+    or (role = 'owner' and public.${isMember}(${cf}))
+  );
 create policy "owners invite" on public.${members}
-  for insert to authenticated with check (public.${isMember}(${cf}, 'owner'));
+  for insert to authenticated with check (public.${isMember}(${cf}, 'owner') and public.is_${noun}_live(${cf}));
 create policy "owners change roles" on public.${members}
   for update to authenticated using (public.${isMember}(${cf}, 'owner'));
 -- Owners remove anyone; everyone can remove themselves (leave the ${noun}).
@@ -126,6 +175,9 @@ security definer
 set search_path = public
 as $$
 begin
+  -- Lock the ${noun} first, so two owners demoting each other at once can't both see "another
+  -- owner exists".
+  perform 1 from public.${container} where id = old.${cf} for update;
   if old.role = 'owner' and (tg_op = 'DELETE' or new.role <> 'owner') then
     if not exists (
       select 1 from public.${members}
@@ -150,7 +202,7 @@ create trigger ${members}_keep_owner before update or delete on public.${members
 create policy "members read memberships of their ${container}" on public.${members}
   for select to authenticated using (public.${isMember}(${cf}));
 create policy "members share their ${container}" on public.${members}
-  for insert to authenticated with check (public.${isMember}(${cf}));
+  for insert to authenticated with check (public.${isMember}(${cf}) and public.is_${noun}_live(${cf}));
 create policy "members unshare their ${container}" on public.${members}
   for delete to authenticated using (public.${isMember}(${cf}));
 `);
@@ -185,13 +237,13 @@ ${children.length === 0
 ${writer
             ? `    execute format(
       'create policy "editors insert" on public.%1$s for insert to authenticated
-         with check (public.${isMember}(${cf}, %2$L))', t, '${writer}');
+         with check (public.${isMember}(${cf}, %2$L) and public.is_${noun}_live(${cf}))', t, '${writer}');
     execute format(
       'create policy "editors update" on public.%1$s for update to authenticated
          using (public.${isMember}(${cf}, %2$L)) with check (public.${isMember}(${cf}, %2$L))', t, '${writer}');`
             : `    execute format(
       'create policy "members insert" on public.%1$s for insert to authenticated
-         with check (public.${isMember}(${cf}))', t);
+         with check (public.${isMember}(${cf}) and public.is_${noun}_live(${cf}))', t);
     execute format(
       'create policy "members update" on public.%1$s for update to authenticated
          using (public.${isMember}(${cf})) with check (public.${isMember}(${cf}))', t);`}
@@ -199,11 +251,11 @@ ${writer
 `}end;
 $$;
 
--- ${cap(container)}: any signed-in user creates one (and becomes ${roles ? 'its owner' : 'a member'}); ${roles ? 'only owners rename / delete' : 'members rename / delete'}.
+-- ${cap(container)}: any signed-in user with a confirmed email creates one (and becomes ${roles ? 'its owner' : 'a member'}); ${roles ? 'only owners rename / delete' : 'members rename / delete'}.
 create policy "members read" on public.${container}
   for select to authenticated using (public.${isMember}(id));
 create policy "signed-in users create ${container}" on public.${container}
-  for insert to authenticated with check (auth.uid() is not null);
+  for insert to authenticated with check (auth.uid() is not null and public.current_email() <> '');
 create policy "${roles ? 'owners' : 'members'} update" on public.${container}
   for update to authenticated using (public.${isMember}(id${roles ? ", 'owner'" : ''})) with check (public.${isMember}(id${roles ? ", 'owner'" : ''}));
 
@@ -247,8 +299,9 @@ $$;
 create trigger ${members}_touch after insert on public.${members}
   for each row execute function public.touch_${noun}_for_new_member();
 
--- Members of a ${noun}${roles ? ' with their role' : ''}, flagging which emails belong to a registered user
--- ("active") vs pending invites.
+-- Members of a ${noun}${roles ? ' with their role' : ''}. "active" says whether an invited person has signed in
+-- since being invited (false: the invite is still pending); it never reveals whether an email has
+-- an account.${roles ? '\n-- Only owners see it (null for others). Viewers only see the owners and themselves.' : ''}
 create or replace function public.${rpc}(p_${cf} text)
 returns table (id uuid, email text, ${roles ? `role public.${roleType}, ` : ''}active boolean)
 language sql
@@ -256,19 +309,82 @@ stable
 security definer
 set search_path = public, auth
 as $$
-  select m.id, m.email, ${roles ? 'm.role, ' : ''}exists (select 1 from auth.users u where lower(u.email) = m.email) as active
+  select m.id, m.email,${roles ? ' m.role,' : ''}
+    ${roles ? `case when public.${isMember}(p_${cf}, 'owner') or m.email = public.current_email() then ` : ''}m.email = public.current_email() or exists (
+      select 1 from auth.users u where lower(u.email) = m.email and u.last_sign_in_at >= m.created_at
+    )${roles ? ' end' : ''} as active
   from public.${members} m
-  where m.${cf} = p_${cf} and public.${isMember}(p_${cf})
+  where m.${cf} = p_${cf} and public.${isMember}(p_${cf})${roles
+        ? `
+    and (public.${isMember}(p_${cf}, 'editor') or m.role = 'owner' or m.email = public.current_email())`
+        : ''}
   order by ${roles ? 'm.role desc, ' : ''}m.created_at;
 $$;
 
+-- ---------------------------------------------------------------- client errors
+
+-- Errors the app reports (failed local writes, sync errors, crashes), written only through
+-- report_client_error. No policies: nobody reads them through the API; use the dashboard or the
+-- service role.
+create table public.client_errors (
+  id bigint generated always as identity primary key,
+  created_at timestamptz not null default now(),
+  app text not null,
+  version text not null,
+  kind text not null,
+  message text not null,
+  detail text not null,
+  path text not null,
+  user_id uuid
+);
+create index client_errors_created_idx on public.client_errors (created_at);
+alter table public.client_errors enable row level security;
+revoke all on public.client_errors from anon, authenticated;
+
+create or replace function public.report_client_error(
+  p_app text, p_version text, p_kind text, p_message text, p_detail text, p_path text
+)
+returns void
+language plpgsql
+security definer
+set search_path = public
+as $$
+begin
+  -- At most 300 reports an hour from everyone together, so a loop or abuse can't fill the
+  -- database; reports are kept for 30 days.
+  if (select count(*) from public.client_errors where created_at > now() - interval '1 hour') >= 300 then
+    return;
+  end if;
+  delete from public.client_errors where created_at < now() - interval '30 days';
+  insert into public.client_errors (app, version, kind, message, detail, path, user_id)
+  values (
+    left(coalesce(p_app, ''), 40), left(coalesce(p_version, ''), 40), left(coalesce(p_kind, ''), 40),
+    left(coalesce(p_message, ''), 500), left(coalesce(p_detail, ''), 4000), left(coalesce(p_path, ''), 200),
+    auth.uid()
+  );
+end;
+$$;
+
+-- ---------------------------------------------------------------- function privileges
+
+-- Postgres lets everyone (public) execute new functions. Only signed-in users may call these,
+-- and signed-out callers only report errors.
+revoke all on function public.current_email() from public, anon;
+revoke all on function public.${isMember}(text${roles ? `, public.${roleType}` : ''}) from public, anon;
+revoke all on function public.is_${noun}_live(text) from public, anon;
 revoke all on function public.${rpc}(text) from public, anon;
+revoke all on function public.report_client_error(text, text, text, text, text, text) from public;
+grant execute on function public.current_email() to authenticated;
+grant execute on function public.${isMember}(text${roles ? `, public.${roleType}` : ''}) to authenticated;
+grant execute on function public.is_${noun}_live(text) to authenticated;
 grant execute on function public.${rpc}(text) to authenticated;
+grant execute on function public.report_client_error(text, text, text, text, text, text) to anon, authenticated;
 
 -- ---------------------------------------------------------------- realtime
 
 alter publication supabase_realtime
   add table ${all.map((n) => `public.${n}`).join(', ')};
 `);
-    return out.join('');
+    const sql = out.join('');
+    return schema === 'public' ? sql : inSchema(sql, schema);
 }

package/dist/store.d.ts

@@ -22,6 +22,11 @@ export interface SyncedStoreConfig<D extends DocMap, C extends CollectionName<D>
     storage: StorageFactory;
     /** viewer / editor / owner roles (needs the roles variant of the SQL migration). */
     roles?: boolean;
+    /**
+     * Postgres schema for the app's tables and functions (default 'public'). A custom schema must be
+     * exposed in the Supabase project's Data API settings; generate its SQL with the same `schema`.
+     */
+    supabaseSchema?: string;
     /** Override membership table / RPC names (defaults: `<noun>_members`, `get_<noun>_members`). */
     members?: Partial<Omit<MembersConfig, 'roles' | 'containerField'>>;
     /** Fields per collection holding ids of other rows in the container (rewritten when copying). */
@@ -32,6 +37,19 @@ export interface SyncedStoreConfig<D extends DocMap, C extends CollectionName<D>
     remap?: RemapHook<D>;
     /** A `DevicePrefs` subclass with app-specific prefs. */
     prefs?: DevicePrefs;
+    /**
+     * localStorage key of the Supabase session (default `<appKey>-auth`), so apps sharing an
+     * origin don't share, or sign each other out of, a session.
+     */
+    authStorageKey?: string;
+    /**
+     * Send failed writes, sync errors, failed pref saves and uncaught errors to the
+     * `report_client_error` function of the app's Supabase schema (from the generated migration).
+     * Pass the deployed version (`version` from `$app/env`). Off when cloud sync isn't configured.
+     */
+    reportErrors?: {
+        version?: string;
+    };
 }
 /**
  * Wire the whole storage layer for an app from one config: app state (local + cloud data
@@ -63,6 +81,11 @@ export declare function createSyncedStore<D extends DocMap, C extends Collection
             containerId: string;
         };
         copyContainer: (from: DataSet<D>, to: DataSet<D>, containerId: string, newIds: boolean) => Promise<string>;
+        exportContainers: (items: {
+            id: string;
+            location: import("./types.js").Location;
+        }[]) => Promise<import("./containers.js").ContainerExport>;
+        importContainers: (data: unknown) => Promise<string[]>;
         makeCloud: (containerId: string) => Promise<void>;
         makeLocal: (containerId: string) => Promise<string>;
         deleteContainer: (ds: DataSet<D>, containerId: string) => Promise<void>;
@@ -75,5 +98,6 @@ export declare function createSyncedStore<D extends DocMap, C extends Collection
         beforeReady?: (local: DataSet<D>) => Promise<void>;
     }) => Promise<void>;
     resetDevice: () => Promise<void>;
+    requestPersistence: () => Promise<boolean | null>;
 };
 export type SyncedStore<D extends DocMap, C extends CollectionName<D> = CollectionName<D>> = ReturnType<typeof createSyncedStore<D, C>>;

package/dist/store.js

@@ -4,6 +4,7 @@ import { CloudSync } from './cloud.svelte.js';
 import { createContainerOps } from './containers.js';
 import { openDatabase, setStorageFactory } from './database.js';
 import { createDataSet } from './dataset.js';
+import { onWriteError, remoteReporter, reportError, setErrorReporter } from './errors.js';
 import { DevicePrefs, defaultPrefsKeys } from './prefs.svelte.js';
 import { createSupabaseApi } from './supabase.js';
 import { Tombstones } from './tombstones.svelte.js';
@@ -21,7 +22,7 @@ export function createSyncedStore(config) {
         ...config.members,
         containerField: config.containerField,
         roles
-    });
+    }, { schema: config.supabaseSchema, storageKey: config.authStorageKey ?? `${config.appKey}-auth` });
     const app = new AppState();
     const tombstones = new Tombstones(config.appKey);
     const prefs = config.prefs ?? new DevicePrefs(defaultPrefsKeys(config.appKey, config.nouns));
@@ -42,8 +43,39 @@ export function createSyncedStore(config) {
         supabase,
         roles,
         refs: config.refs,
-        remap: config.remap
+        remap: config.remap,
+        appKey: config.appKey
     });
+    onWriteError((message) => (app.writeError = message));
+    /**
+     * Ask the browser to keep this site's data (it may decide on its own, or ask the user). The
+     * result is `app.persisted`. Called on start; call it again from a button to retry.
+     */
+    async function requestPersistence() {
+        const storage = typeof navigator === 'undefined' ? undefined : navigator.storage;
+        if (!storage?.persisted || !storage.persist)
+            return (app.persisted = null);
+        try {
+            app.persisted = (await storage.persisted()) || (await storage.persist());
+        }
+        catch {
+            app.persisted = null;
+        }
+        return app.persisted;
+    }
+    function startErrorReporting() {
+        if (!config.reportErrors || !config.env.cloudConfigured || typeof window === 'undefined')
+            return;
+        setErrorReporter(remoteReporter({
+            supabaseUrl: config.env.supabaseUrl,
+            supabaseAnonKey: config.env.supabaseAnonKey,
+            schema: supabase.schema,
+            app: config.appKey,
+            version: config.reportErrors.version
+        }));
+        window.addEventListener('error', (e) => reportError('unhandled', e.error ?? e.message));
+        window.addEventListener('unhandledrejection', (e) => reportError('unhandled', e.reason));
+    }
     let started;
     /**
      * Open the local database, then restore any Supabase session (which opens the cloud
@@ -51,15 +83,18 @@ export function createSyncedStore(config) {
      */
     function init(options = {}) {
         started ??= (async () => {
+            startErrorReporting();
             setStorageFactory(config.storage);
             const db = await openDatabase(`${config.appKey}_local`, config, { storage: config.storage });
             const local = createDataSet('local', db, config);
             await options.beforeReady?.(local).catch((err) => console.error('Startup hook failed', err));
             app.local = local;
             app.ready = true;
+            void requestPersistence();
             await cloud.init();
         })().catch((err) => {
             console.error(err);
+            reportError('fatal', err);
             app.fatal = err instanceof Error ? err.message : String(err);
         });
         return started;
@@ -82,5 +117,5 @@ export function createSyncedStore(config) {
         app.local = null;
         await local?.db.remove();
     }
-    return { config, roles, app, cloud, tombstones, prefs, supabase, ops, init, resetDevice };
+    return { config, roles, app, cloud, tombstones, prefs, supabase, ops, init, resetDevice, requestPersistence };
 }

package/dist/supabase.d.ts

@@ -1,4 +1,4 @@
-import { type SupabaseClient } from '@supabase/supabase-js';
+import type { SupabaseClient } from '@supabase/supabase-js';
 import type { EnvConfig } from './env.js';
 import type { Role } from './types.js';
 export interface MembersConfig {
@@ -18,15 +18,46 @@ export interface MembersConfig {
 export interface Member {
     id: string;
     email: string;
-    /** True when the email belongs to a registered user; false means the invite is pending. */
-    active: boolean;
+    /**
+     * True once the invited person has signed in since being invited; false while the invite is
+     * pending. Null when the caller may not see it (only owners do, with roles).
+     */
+    active: boolean | null;
     /** Only when roles are on. */
     role?: Role | null;
 }
+export interface SupabaseOptions {
+    /**
+     * Postgres schema holding the app's tables and functions (default 'public'). A custom schema
+     * must be listed under the Supabase project's exposed schemas (Data API settings).
+     */
+    schema?: string;
+    /**
+     * localStorage key of the signed-in session. Give every app on an origin its own key, so
+     * signing in or out of one doesn't affect another. Default: supabase-js's `sb-<project>-auth-token`,
+     * which a session found there is moved from once.
+     */
+    storageKey?: string;
+}
 export interface SupabaseApi {
     readonly configured: boolean;
-    /** The shared client (PKCE, created on first use), or null in local-only mode. */
+    /** The Postgres schema the client reads and writes. */
+    readonly schema: string;
+    /** localStorage key of the session. */
+    readonly storageKey: string;
+    /**
+     * Load supabase-js and create the shared client (PKCE), once. Null in local-only mode. The
+     * library is only downloaded when something needs it: a stored session, a sign-in redirect,
+     * or a sign-in.
+     */
+    loadClient(): Promise<SupabaseClient | null>;
+    /** The client once `loadClient` has created it, otherwise null. */
     getClient(): SupabaseClient | null;
+    /**
+     * Whether a session may exist without loading supabase-js: one is stored, or the page is a
+     * sign-in redirect (PKCE `code` or an error in the URL).
+     */
+    mayHaveSession(): boolean;
     fetchMembers(containerId: string): Promise<Member[]>;
     inviteMember(containerId: string, email: string, role?: Role): Promise<void>;
     setMemberRole(memberId: string, role: Role): Promise<void>;
@@ -36,10 +67,33 @@ export interface SupabaseApi {
     /** Every container the user belongs to, with their role (null without roles). */
     fetchMyMemberships(email: string): Promise<Map<string, Role | null>>;
 }
+/**
+ * PostgREST refuses a schema that isn't exposed in the project's Data API settings (PGRST106,
+ * "Invalid schema: …"). Returns the fix to show instead, or null for other errors.
+ */
+export declare function schemaNotExposed(error: {
+    message?: string;
+    code?: string;
+} | undefined, schema: string): string | null;
 /** Turn Postgres errors from triggers / RLS into messages a person can act on. */
 export declare function friendlyError(error: {
     message: string;
     code?: string;
-}, noun: string): Error;
+}, noun: string, schema?: string): Error;
+/** supabase-js's own session key for a project URL. */
+export declare function defaultStorageKey(supabaseUrl: string): string;
+/**
+ * Move a session stored under supabase-js's default key to `storageKey` (once, when the new key
+ * is empty). The old key is removed: two apps holding the same refresh token would revoke each
+ * other's session, so only the first app to start keeps it and the other signs in again.
+ */
+export declare function adoptSession(legacyKey: string, storageKey: string): void;
 /** Supabase client plus the members API, with table and RPC names from `members`. */
-export declare function createSupabaseApi(env: EnvConfig, members: MembersConfig): SupabaseApi;
+export declare function createSupabaseApi(env: EnvConfig, members: MembersConfig, options?: SupabaseOptions): SupabaseApi;
+/**
+ * The client RxDB's Supabase replication should use. Its pulls and pushes go through
+ * `client.from()`, which follows the client's schema, but its realtime subscription always
+ * asks for schema 'public'. For any other schema this wraps the three methods the replication
+ * calls and points that subscription at the right schema.
+ */
+export declare function replicationClient(client: SupabaseClient, schema: string): SupabaseClient;

package/dist/supabase.js

@@ -1,6 +1,19 @@
-import { createClient } from '@supabase/supabase-js';
+/**
+ * PostgREST refuses a schema that isn't exposed in the project's Data API settings (PGRST106,
+ * "Invalid schema: …"). Returns the fix to show instead, or null for other errors.
+ */
+export function schemaNotExposed(error, schema) {
+    if (!error)
+        return null;
+    if (error.code !== 'PGRST106' && !/invalid schema|schema must be one of/i.test(error.message ?? ''))
+        return null;
+    return `Expose the ${schema} schema in Supabase (Project Settings → Data API).`;
+}
 /** Turn Postgres errors from triggers / RLS into messages a person can act on. */
-export function friendlyError(error, noun) {
+export function friendlyError(error, noun, schema = 'public') {
+    const unexposed = schemaNotExposed(error, schema);
+    if (unexposed)
+        return new Error(unexposed);
     if (error.message.includes('last owner')) {
         return new Error(`A ${noun} must always have at least one owner. Make someone else an owner first.`);
     }
@@ -10,34 +23,100 @@ export function friendlyError(error, noun) {
         return new Error(`That email already has access to this ${noun}.`);
     return new Error(error.message);
 }
+/** supabase-js's own session key for a project URL. */
+export function defaultStorageKey(supabaseUrl) {
+    try {
+        return `sb-${new URL(supabaseUrl).hostname.split('.')[0]}-auth-token`;
+    }
+    catch {
+        return 'sb-auth-token';
+    }
+}
+/**
+ * Move a session stored under supabase-js's default key to `storageKey` (once, when the new key
+ * is empty). The old key is removed: two apps holding the same refresh token would revoke each
+ * other's session, so only the first app to start keeps it and the other signs in again.
+ */
+export function adoptSession(legacyKey, storageKey) {
+    if (legacyKey === storageKey)
+        return;
+    try {
+        if (localStorage.getItem(storageKey) !== null)
+            return;
+        const value = localStorage.getItem(legacyKey);
+        if (value === null)
+            return;
+        localStorage.setItem(storageKey, value);
+        localStorage.removeItem(legacyKey);
+        const verifier = localStorage.getItem(`${legacyKey}-code-verifier`);
+        if (verifier !== null) {
+            localStorage.setItem(`${storageKey}-code-verifier`, verifier);
+            localStorage.removeItem(`${legacyKey}-code-verifier`);
+        }
+    }
+    catch {
+        /* storage unavailable: nothing to move */
+    }
+}
 /** Supabase client plus the members API, with table and RPC names from `members`. */
-export function createSupabaseApi(env, members) {
+export function createSupabaseApi(env, members, options = {}) {
     let client = null;
+    let loading = null;
+    const schema = options.schema ?? 'public';
+    const legacyKey = defaultStorageKey(env.supabaseUrl);
+    const storageKey = options.storageKey ?? legacyKey;
     const { table, containerField, membersRpc, roles, noun } = members;
     const rpcParam = members.rpcParam ?? `p_${containerField}`;
-    function getClient() {
+    function loadClient() {
         if (!env.cloudConfigured)
-            return null;
-        client ??= createClient(env.supabaseUrl, env.supabaseAnonKey, {
-            auth: { flowType: 'pkce', persistSession: true, autoRefreshToken: true, detectSessionInUrl: true }
-        });
-        return client;
+            return Promise.resolve(null);
+        loading ??= (async () => {
+            const { createClient } = await import('@supabase/supabase-js');
+            adoptSession(legacyKey, storageKey);
+            client = createClient(env.supabaseUrl, env.supabaseAnonKey, {
+                db: { schema },
+                auth: { flowType: 'pkce', persistSession: true, autoRefreshToken: true, detectSessionInUrl: true, storageKey }
+            });
+            return client;
+        })();
+        // A failed download (offline on first use) can be retried later.
+        loading.catch(() => (loading = null));
+        return loading;
     }
-    function requireClient() {
-        const sb = getClient();
+    function mayHaveSession() {
+        if (!env.cloudConfigured)
+            return false;
+        try {
+            if (localStorage.getItem(storageKey) !== null || localStorage.getItem(legacyKey) !== null)
+                return true;
+        }
+        catch {
+            /* no storage: only a redirect can carry a session */
+        }
+        if (typeof location === 'undefined')
+            return false;
+        const params = new URLSearchParams(location.search);
+        return params.has('code') || params.has('error_description') || /access_token|error_description/.test(location.hash);
+    }
+    async function requireClient() {
+        const sb = await loadClient();
         if (!sb)
             throw new Error('Cloud sync is not configured.');
         return sb;
     }
     const fail = (error) => {
         if (error)
-            throw friendlyError(error, noun);
+            throw friendlyError(error, noun, schema);
     };
     return {
         configured: env.cloudConfigured,
-        getClient,
+        schema,
+        storageKey,
+        loadClient,
+        getClient: () => client,
+        mayHaveSession,
         async fetchMembers(containerId) {
-            const { data, error } = await requireClient().rpc(membersRpc, { [rpcParam]: containerId });
+            const { data, error } = await (await requireClient()).rpc(membersRpc, { [rpcParam]: containerId });
             fail(error);
             return (data ?? []);
         },
@@ -45,21 +124,21 @@ export function createSupabaseApi(env, members) {
             const row = { [containerField]: containerId, email: email.trim().toLowerCase() };
             if (roles)
                 row.role = role ?? 'viewer';
-            const { error } = await requireClient().from(table).insert(row);
+            const { error } = await (await requireClient()).from(table).insert(row);
             fail(error);
         },
         async setMemberRole(memberId, role) {
             if (!roles)
                 throw new Error('Roles are not enabled.');
-            const { error } = await requireClient().from(table).update({ role }).eq('id', memberId);
+            const { error } = await (await requireClient()).from(table).update({ role }).eq('id', memberId);
             fail(error);
         },
         async removeMember(memberId) {
-            const { error } = await requireClient().from(table).delete().eq('id', memberId);
+            const { error } = await (await requireClient()).from(table).delete().eq('id', memberId);
             fail(error);
         },
         async leave(containerId, email) {
-            const { error } = await requireClient()
+            const { error } = await (await requireClient())
                 .from(table)
                 .delete()
                 .eq(containerField, containerId)
@@ -68,10 +147,31 @@ export function createSupabaseApi(env, members) {
         },
         async fetchMyMemberships(email) {
             const columns = roles ? `${containerField}, role` : containerField;
-            const { data, error } = await requireClient().from(table).select(columns).eq('email', email.toLowerCase());
+            const { data, error } = await (await requireClient()).from(table).select(columns).eq('email', email.toLowerCase());
             fail(error);
             const rows = (data ?? []);
             return new Map(rows.map((r) => [r[containerField], roles ? r.role : null]));
         }
     };
 }
+/**
+ * The client RxDB's Supabase replication should use. Its pulls and pushes go through
+ * `client.from()`, which follows the client's schema, but its realtime subscription always
+ * asks for schema 'public'. For any other schema this wraps the three methods the replication
+ * calls and points that subscription at the right schema.
+ */
+export function replicationClient(client, schema) {
+    if (schema === 'public')
+        return client;
+    const adapter = {
+        from: (table) => client.from(table),
+        removeChannel: (channel) => client.removeChannel(channel),
+        channel: (name, opts) => {
+            const channel = client.channel(name, opts);
+            const on = channel.on.bind(channel);
+            channel.on = (type, filter, cb) => on(type, type === 'postgres_changes' ? { ...filter, schema } : filter, cb);
+            return channel;
+        }
+    };
+    return adapter;
+}