@wells-nelson/data-storage 1.0.1 → 1.0.3

package/dist/errors.js

@@ -0,0 +1,101 @@
+/**
+ * Client error reporting. Library code calls `reportError` where something fails without the
+ * user necessarily noticing (a local write, sync, device prefs); the store installs a reporter
+ * that sends each report to the app's Supabase project (see `remoteReporter`). Reports are
+ * de-duplicated by kind and message and capped per page load.
+ */
+const MAX_REPORTS = 20;
+let reporter = null;
+let sent = 0;
+const seen = new Set();
+const writeListeners = new Set();
+/** Where reports go (null to stop reporting). */
+export function setErrorReporter(next) {
+    reporter = next;
+}
+/** Forget what was reported (tests). */
+export function resetErrorReports() {
+    sent = 0;
+    seen.clear();
+}
+export function describeError(err) {
+    if (err instanceof Error)
+        return { message: err.message || err.name, detail: err.stack };
+    if (err && typeof err === 'object') {
+        const e = err;
+        if (typeof e.message === 'string')
+            return { message: e.message, detail: safeJson(err) };
+        return { message: safeJson(err) ?? String(err) };
+    }
+    return { message: String(err) };
+}
+function safeJson(value) {
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Report an error once per kind and message (and at most 20 per page load). Never throws. */
+export function reportError(kind, err, detail) {
+    const described = describeError(err);
+    const key = `${kind}:${described.message}`;
+    if (seen.has(key) || sent >= MAX_REPORTS)
+        return;
+    seen.add(key);
+    if (!reporter)
+        return;
+    sent++;
+    try {
+        reporter({ kind, message: described.message, detail: detail ?? described.detail });
+    }
+    catch {
+        /* reporting must never break the app */
+    }
+}
+/** Called with a message whenever a local write fails (see `persist`). Returns an unsubscribe. */
+export function onWriteError(listener) {
+    writeListeners.add(listener);
+    return () => void writeListeners.delete(listener);
+}
+/** A local write failed: tell listeners (the store shows it) and report it. */
+export function writeFailed(err) {
+    console.error('Failed to save change', err);
+    reportError('write', err);
+    const { message } = describeError(err);
+    for (const listener of writeListeners)
+        listener(message);
+}
+/**
+ * Sends reports to the `report_client_error` function of the app's Supabase schema with a plain
+ * `fetch` (no supabase-js needed, so signed-out devices report too). Only the path of the page
+ * is sent, never its query or any user data beyond the error itself.
+ */
+export function remoteReporter(options) {
+    const url = `${options.supabaseUrl.replace(/\/$/, '')}/rest/v1/rpc/report_client_error`;
+    return ({ kind, message, detail }) => {
+        if (typeof fetch === 'undefined')
+            return;
+        void fetch(url, {
+            method: 'POST',
+            keepalive: true,
+            headers: {
+                apikey: options.supabaseAnonKey,
+                Authorization: `Bearer ${options.supabaseAnonKey}`,
+                'Content-Type': 'application/json',
+                'Content-Profile': options.schema
+            },
+            body: JSON.stringify({
+                p_app: options.app,
+                p_version: options.version ?? '',
+                p_kind: kind,
+                p_message: message.slice(0, 500),
+                p_detail: (detail ?? '').slice(0, 4000),
+                p_path: typeof location === 'undefined' ? '' : location.pathname
+            })
+        }).catch(() => {
+            /* offline or not set up: drop it */
+        });
+    };
+}

package/dist/index.d.ts

@@ -1,13 +1,14 @@
 export { AppState } from './app.svelte.js';
 export { CloudSync, errorMessage, isRejection, type CloudSyncOptions } from './cloud.svelte.js';
-export { createContainerOps, now, persist, uid, type ContainerDocs, type ContainerEntry, type ContainerOps, type ContainerOpsOptions, type RemapHook } from './containers.js';
+export { createContainerOps, now, type ContainerExport, persist, uid, type ContainerDocs, type ContainerEntry, type ContainerOps, type ContainerOpsOptions, type RemapHook } from './containers.js';
 export { docsEqual, lastWriteWins, openDatabase, setStorageFactory, type Collections, type Database, type OpenDatabaseOptions, type StorageFactory } from './database.js';
 export { createDataSet, disposeDataSet, type DataSet, type TSCollection } from './dataset.js';
 export { envConfig, type EnvConfig } from './env.js';
+export { describeError, onWriteError, remoteReporter, reportError, resetErrorReports, setErrorReporter, writeFailed, type ErrorKind, type ErrorReport, type ErrorReporter, type RemoteReporterOptions } from './errors.js';
 export { Persisted } from './persisted.svelte.js';
 export { DevicePrefs, defaultPrefsKeys, type DevicePrefsKeys } from './prefs.svelte.js';
 export { field, flatSchema, type FieldSpec } from './schema.js';
 export { createSyncedStore, type SyncedStore, type SyncedStoreConfig } from './store.js';
-export { createSupabaseApi, friendlyError, replicationClient, schemaNotExposed, type Member, type MembersConfig, type SupabaseApi, type SupabaseOptions } from './supabase.js';
+export { adoptSession, createSupabaseApi, defaultStorageKey, friendlyError, replicationClient, schemaNotExposed, type Member, type MembersConfig, type SupabaseApi, type SupabaseOptions } from './supabase.js';
 export { Tombstones } from './tombstones.svelte.js';
 export { containerIdOf, type CollectionName, type DocBase, type DocMap, type Location, type Nouns, type Role, type StoreSchema } from './types.js';

package/dist/index.js

@@ -4,10 +4,11 @@ export { createContainerOps, now, persist, uid } from './containers.js';
 export { docsEqual, lastWriteWins, openDatabase, setStorageFactory } from './database.js';
 export { createDataSet, disposeDataSet } from './dataset.js';
 export { envConfig } from './env.js';
+export { describeError, onWriteError, remoteReporter, reportError, resetErrorReports, setErrorReporter, writeFailed } from './errors.js';
 export { Persisted } from './persisted.svelte.js';
 export { DevicePrefs, defaultPrefsKeys } from './prefs.svelte.js';
 export { field, flatSchema } from './schema.js';
 export { createSyncedStore } from './store.js';
-export { createSupabaseApi, friendlyError, replicationClient, schemaNotExposed } from './supabase.js';
+export { adoptSession, createSupabaseApi, defaultStorageKey, friendlyError, replicationClient, schemaNotExposed } from './supabase.js';
 export { Tombstones } from './tombstones.svelte.js';
 export { containerIdOf } from './types.js';

package/dist/persisted.svelte.d.ts

@@ -1,4 +1,7 @@
-/** Reactive value mirrored to localStorage. Storage failures (private mode, quota) are ignored. */
+/**
+ * Reactive value mirrored to localStorage. Storage failures (private mode, quota) don't break the
+ * app; a failed write is reported once.
+ */
 export declare class Persisted<T> {
     #private;
     constructor(key: string, initial: T);

package/dist/persisted.svelte.js

@@ -1,4 +1,8 @@
-/** Reactive value mirrored to localStorage. Storage failures (private mode, quota) are ignored. */
+import { reportError } from './errors.js';
+/**
+ * Reactive value mirrored to localStorage. Storage failures (private mode, quota) don't break the
+ * app; a failed write is reported once.
+ */
 export class Persisted {
     #key;
     #value = $state();
@@ -31,8 +35,8 @@ export class Persisted {
         try {
             localStorage.setItem(key, JSON.stringify(value));
         }
-        catch {
-            /* ignore */
+        catch (err) {
+            reportError('prefs', err);
         }
     }
     static remove(key) {

package/dist/sql.d.ts

@@ -1,9 +1,11 @@
 /**
  * Generates the Supabase migration for an app's tables: `_deleted` / `_modified` replication
- * columns with their trigger and checkpoint index, `current_email()`, a membership table with
- * an `is_<noun>_member` helper and RLS on every table, the creator-becomes-member trigger, the
- * "touch rows on new share" trigger, the members RPC (active / pending) and the realtime
- * publication. With `roles`, members are viewer / editor / owner and the last owner is protected.
+ * columns with their trigger and checkpoint index, `current_email()` (confirmed emails only), a
+ * membership table with an `is_<noun>_member` helper and RLS on every table, the
+ * creator-becomes-member trigger, the "touch rows on new share" trigger, the members RPC
+ * (active / pending), a write-only `client_errors` table with its `report_client_error`
+ * function, and the realtime publication. With `roles`, members are viewer / editor / owner and
+ * the last owner is protected. Signed-out callers (`anon`) get nothing but `report_client_error`.
  *
  * Pure string building: no database or Svelte dependency, so it runs from a plain Node script.
  */

package/dist/sql.js

@@ -1,9 +1,11 @@
 /**
  * Generates the Supabase migration for an app's tables: `_deleted` / `_modified` replication
- * columns with their trigger and checkpoint index, `current_email()`, a membership table with
- * an `is_<noun>_member` helper and RLS on every table, the creator-becomes-member trigger, the
- * "touch rows on new share" trigger, the members RPC (active / pending) and the realtime
- * publication. With `roles`, members are viewer / editor / owner and the last owner is protected.
+ * columns with their trigger and checkpoint index, `current_email()` (confirmed emails only), a
+ * membership table with an `is_<noun>_member` helper and RLS on every table, the
+ * creator-becomes-member trigger, the "touch rows on new share" trigger, the members RPC
+ * (active / pending), a write-only `client_errors` table with its `report_client_error`
+ * function, and the realtime publication. With `roles`, members are viewer / editor / owner and
+ * the last owner is protected. Signed-out callers (`anon`) get nothing but `report_client_error`.
  *
  * Pure string building: no database or Svelte dependency, so it runs from a plain Node script.
  */
@@ -13,12 +15,13 @@ function inSchema(sql, schema) {
 
 create schema if not exists ${schema};
 
--- The API roles need the same access Supabase grants on public; row level security on every
--- table still decides what each user can read and write.
+-- Signed-in users (authenticated) get table access, and row level security on every table decides
+-- what each one can read and write. Signed-out callers (anon) get none, so a table added later
+-- without RLS still isn't public; anon only reaches report_client_error, granted below.
 grant usage on schema ${schema} to anon, authenticated, service_role;
-alter default privileges in schema ${schema} grant all on tables to anon, authenticated, service_role;
-alter default privileges in schema ${schema} grant all on functions to anon, authenticated, service_role;
-alter default privileges in schema ${schema} grant all on sequences to anon, authenticated, service_role;
+alter default privileges in schema ${schema} grant all on tables to authenticated, service_role;
+alter default privileges in schema ${schema} grant all on functions to authenticated, service_role;
+alter default privileges in schema ${schema} grant all on sequences to authenticated, service_role;
 
 `;
     return sql
@@ -88,12 +91,20 @@ begin
 end;
 $$;
 
+-- The signed-in user's email, only once confirmed: a session whose email was never verified
+-- (e.g. a password sign-up with confirmation off) matches no membership. Read from auth.users,
+-- not the token, so a changed email applies right away.
 create or replace function public.current_email()
 returns text
 language sql
 stable
+security definer
+set search_path = ''
 as $$
-  select lower(coalesce(auth.jwt() ->> 'email', ''));
+  select coalesce((
+    select lower(u.email) from auth.users u
+    where u.id = auth.uid() and u.email_confirmed_at is not null
+  ), '');
 $$;
 
 -- ---------------------------------------------------------------- membership
@@ -125,14 +136,31 @@ as $$
   );
 $$;
 
+-- False once the ${noun} is deleted: nobody can add members or new rows to it. (Members still
+-- read and update its rows, so every device syncs the deletion.)
+create or replace function public.is_${noun}_live(p_${cf} text)
+returns boolean
+language sql
+stable
+security definer
+set search_path = public
+as $$
+  select not exists (select 1 from public.${container} c where c.id = p_${cf} and c._deleted);
+$$;
+
 alter table public.${members} enable row level security;
 `);
     if (roles) {
         add(`
+-- Editors and owners see every member; viewers see the owners and themselves.
 create policy "members read members" on public.${members}
-  for select to authenticated using (public.${isMember}(${cf}));
+  for select to authenticated using (
+    email = public.current_email()
+    or public.${isMember}(${cf}, 'editor')
+    or (role = 'owner' and public.${isMember}(${cf}))
+  );
 create policy "owners invite" on public.${members}
-  for insert to authenticated with check (public.${isMember}(${cf}, 'owner'));
+  for insert to authenticated with check (public.${isMember}(${cf}, 'owner') and public.is_${noun}_live(${cf}));
 create policy "owners change roles" on public.${members}
   for update to authenticated using (public.${isMember}(${cf}, 'owner'));
 -- Owners remove anyone; everyone can remove themselves (leave the ${noun}).
@@ -147,6 +175,9 @@ security definer
 set search_path = public
 as $$
 begin
+  -- Lock the ${noun} first, so two owners demoting each other at once can't both see "another
+  -- owner exists".
+  perform 1 from public.${container} where id = old.${cf} for update;
   if old.role = 'owner' and (tg_op = 'DELETE' or new.role <> 'owner') then
     if not exists (
       select 1 from public.${members}
@@ -171,7 +202,7 @@ create trigger ${members}_keep_owner before update or delete on public.${members
 create policy "members read memberships of their ${container}" on public.${members}
   for select to authenticated using (public.${isMember}(${cf}));
 create policy "members share their ${container}" on public.${members}
-  for insert to authenticated with check (public.${isMember}(${cf}));
+  for insert to authenticated with check (public.${isMember}(${cf}) and public.is_${noun}_live(${cf}));
 create policy "members unshare their ${container}" on public.${members}
   for delete to authenticated using (public.${isMember}(${cf}));
 `);
@@ -206,13 +237,13 @@ ${children.length === 0
 ${writer
             ? `    execute format(
       'create policy "editors insert" on public.%1$s for insert to authenticated
-         with check (public.${isMember}(${cf}, %2$L))', t, '${writer}');
+         with check (public.${isMember}(${cf}, %2$L) and public.is_${noun}_live(${cf}))', t, '${writer}');
     execute format(
       'create policy "editors update" on public.%1$s for update to authenticated
          using (public.${isMember}(${cf}, %2$L)) with check (public.${isMember}(${cf}, %2$L))', t, '${writer}');`
             : `    execute format(
       'create policy "members insert" on public.%1$s for insert to authenticated
-         with check (public.${isMember}(${cf}))', t);
+         with check (public.${isMember}(${cf}) and public.is_${noun}_live(${cf}))', t);
     execute format(
       'create policy "members update" on public.%1$s for update to authenticated
          using (public.${isMember}(${cf})) with check (public.${isMember}(${cf}))', t);`}
@@ -220,11 +251,11 @@ ${writer
 `}end;
 $$;
 
--- ${cap(container)}: any signed-in user creates one (and becomes ${roles ? 'its owner' : 'a member'}); ${roles ? 'only owners rename / delete' : 'members rename / delete'}.
+-- ${cap(container)}: any signed-in user with a confirmed email creates one (and becomes ${roles ? 'its owner' : 'a member'}); ${roles ? 'only owners rename / delete' : 'members rename / delete'}.
 create policy "members read" on public.${container}
   for select to authenticated using (public.${isMember}(id));
 create policy "signed-in users create ${container}" on public.${container}
-  for insert to authenticated with check (auth.uid() is not null);
+  for insert to authenticated with check (auth.uid() is not null and public.current_email() <> '');
 create policy "${roles ? 'owners' : 'members'} update" on public.${container}
   for update to authenticated using (public.${isMember}(id${roles ? ", 'owner'" : ''})) with check (public.${isMember}(id${roles ? ", 'owner'" : ''}));
 
@@ -268,8 +299,9 @@ $$;
 create trigger ${members}_touch after insert on public.${members}
   for each row execute function public.touch_${noun}_for_new_member();
 
--- Members of a ${noun}${roles ? ' with their role' : ''}, flagging which emails belong to a registered user
--- ("active") vs pending invites.
+-- Members of a ${noun}${roles ? ' with their role' : ''}. "active" says whether an invited person has signed in
+-- since being invited (false: the invite is still pending); it never reveals whether an email has
+-- an account.${roles ? '\n-- Only owners see it (null for others). Viewers only see the owners and themselves.' : ''}
 create or replace function public.${rpc}(p_${cf} text)
 returns table (id uuid, email text, ${roles ? `role public.${roleType}, ` : ''}active boolean)
 language sql
@@ -277,14 +309,76 @@ stable
 security definer
 set search_path = public, auth
 as $$
-  select m.id, m.email, ${roles ? 'm.role, ' : ''}exists (select 1 from auth.users u where lower(u.email) = m.email) as active
+  select m.id, m.email,${roles ? ' m.role,' : ''}
+    ${roles ? `case when public.${isMember}(p_${cf}, 'owner') or m.email = public.current_email() then ` : ''}m.email = public.current_email() or exists (
+      select 1 from auth.users u where lower(u.email) = m.email and u.last_sign_in_at >= m.created_at
+    )${roles ? ' end' : ''} as active
   from public.${members} m
-  where m.${cf} = p_${cf} and public.${isMember}(p_${cf})
+  where m.${cf} = p_${cf} and public.${isMember}(p_${cf})${roles
+        ? `
+    and (public.${isMember}(p_${cf}, 'editor') or m.role = 'owner' or m.email = public.current_email())`
+        : ''}
   order by ${roles ? 'm.role desc, ' : ''}m.created_at;
 $$;
 
+-- ---------------------------------------------------------------- client errors
+
+-- Errors the app reports (failed local writes, sync errors, crashes), written only through
+-- report_client_error. No policies: nobody reads them through the API; use the dashboard or the
+-- service role.
+create table public.client_errors (
+  id bigint generated always as identity primary key,
+  created_at timestamptz not null default now(),
+  app text not null,
+  version text not null,
+  kind text not null,
+  message text not null,
+  detail text not null,
+  path text not null,
+  user_id uuid
+);
+create index client_errors_created_idx on public.client_errors (created_at);
+alter table public.client_errors enable row level security;
+revoke all on public.client_errors from anon, authenticated;
+
+create or replace function public.report_client_error(
+  p_app text, p_version text, p_kind text, p_message text, p_detail text, p_path text
+)
+returns void
+language plpgsql
+security definer
+set search_path = public
+as $$
+begin
+  -- At most 300 reports an hour from everyone together, so a loop or abuse can't fill the
+  -- database; reports are kept for 30 days.
+  if (select count(*) from public.client_errors where created_at > now() - interval '1 hour') >= 300 then
+    return;
+  end if;
+  delete from public.client_errors where created_at < now() - interval '30 days';
+  insert into public.client_errors (app, version, kind, message, detail, path, user_id)
+  values (
+    left(coalesce(p_app, ''), 40), left(coalesce(p_version, ''), 40), left(coalesce(p_kind, ''), 40),
+    left(coalesce(p_message, ''), 500), left(coalesce(p_detail, ''), 4000), left(coalesce(p_path, ''), 200),
+    auth.uid()
+  );
+end;
+$$;
+
+-- ---------------------------------------------------------------- function privileges
+
+-- Postgres lets everyone (public) execute new functions. Only signed-in users may call these,
+-- and signed-out callers only report errors.
+revoke all on function public.current_email() from public, anon;
+revoke all on function public.${isMember}(text${roles ? `, public.${roleType}` : ''}) from public, anon;
+revoke all on function public.is_${noun}_live(text) from public, anon;
 revoke all on function public.${rpc}(text) from public, anon;
+revoke all on function public.report_client_error(text, text, text, text, text, text) from public;
+grant execute on function public.current_email() to authenticated;
+grant execute on function public.${isMember}(text${roles ? `, public.${roleType}` : ''}) to authenticated;
+grant execute on function public.is_${noun}_live(text) to authenticated;
 grant execute on function public.${rpc}(text) to authenticated;
+grant execute on function public.report_client_error(text, text, text, text, text, text) to anon, authenticated;
 
 -- ---------------------------------------------------------------- realtime
 

package/dist/store.d.ts

@@ -12,7 +12,7 @@ import type { CollectionName, DocMap, Nouns, StoreSchema } from './types.js';
  * `C` is the container collection; pass it (`createSyncedStore<Docs, 'projects'>`) so container
  * rows are typed as that document rather than a union of every document.
  */
-export interface SyncedStoreConfig<D extends DocMap, C extends CollectionName<D> = CollectionName<D>> extends StoreSchema<D, C> {
+export interface SyncedStoreConfig<D extends DocMap<D>, C extends CollectionName<D> = CollectionName<D>> extends StoreSchema<D, C> {
     /** Prefix for database names and localStorage keys, e.g. 'demo' → `demo_local`, `demo:hidden`. */
     appKey: string;
     nouns: Nouns;
@@ -37,13 +37,26 @@ export interface SyncedStoreConfig<D extends DocMap, C extends CollectionName<D>
     remap?: RemapHook<D>;
     /** A `DevicePrefs` subclass with app-specific prefs. */
     prefs?: DevicePrefs;
+    /**
+     * localStorage key of the Supabase session (default `<appKey>-auth`), so apps sharing an
+     * origin don't share, or sign each other out of, a session.
+     */
+    authStorageKey?: string;
+    /**
+     * Send failed writes, sync errors, failed pref saves and uncaught errors to the
+     * `report_client_error` function of the app's Supabase schema (from the generated migration).
+     * Pass the deployed version (`version` from `$app/env`). Off when cloud sync isn't configured.
+     */
+    reportErrors?: {
+        version?: string;
+    };
 }
 /**
  * Wire the whole storage layer for an app from one config: app state (local + cloud data
  * sets), cloud sync, tombstones, device prefs, the Supabase members API and container
  * operations. Create it once in a module and import it where needed.
  */
-export declare function createSyncedStore<D extends DocMap, C extends CollectionName<D> = CollectionName<D>>(config: SyncedStoreConfig<D, C>): {
+export declare function createSyncedStore<D extends DocMap<D>, C extends CollectionName<D> = CollectionName<D>>(config: SyncedStoreConfig<D, C>): {
     config: SyncedStoreConfig<D, C>;
     roles: boolean;
     app: AppState<D>;
@@ -68,6 +81,11 @@ export declare function createSyncedStore<D extends DocMap, C extends Collection
             containerId: string;
         };
         copyContainer: (from: DataSet<D>, to: DataSet<D>, containerId: string, newIds: boolean) => Promise<string>;
+        exportContainers: (items: {
+            id: string;
+            location: import("./types.js").Location;
+        }[]) => Promise<import("./containers.js").ContainerExport>;
+        importContainers: (data: unknown) => Promise<string[]>;
         makeCloud: (containerId: string) => Promise<void>;
         makeLocal: (containerId: string) => Promise<string>;
         deleteContainer: (ds: DataSet<D>, containerId: string) => Promise<void>;
@@ -80,5 +98,6 @@ export declare function createSyncedStore<D extends DocMap, C extends Collection
         beforeReady?: (local: DataSet<D>) => Promise<void>;
     }) => Promise<void>;
     resetDevice: () => Promise<void>;
+    requestPersistence: () => Promise<boolean | null>;
 };
-export type SyncedStore<D extends DocMap, C extends CollectionName<D> = CollectionName<D>> = ReturnType<typeof createSyncedStore<D, C>>;
+export type SyncedStore<D extends DocMap<D>, C extends CollectionName<D> = CollectionName<D>> = ReturnType<typeof createSyncedStore<D, C>>;

package/dist/store.js

@@ -4,6 +4,7 @@ import { CloudSync } from './cloud.svelte.js';
 import { createContainerOps } from './containers.js';
 import { openDatabase, setStorageFactory } from './database.js';
 import { createDataSet } from './dataset.js';
+import { onWriteError, remoteReporter, reportError, setErrorReporter } from './errors.js';
 import { DevicePrefs, defaultPrefsKeys } from './prefs.svelte.js';
 import { createSupabaseApi } from './supabase.js';
 import { Tombstones } from './tombstones.svelte.js';
@@ -21,7 +22,7 @@ export function createSyncedStore(config) {
         ...config.members,
         containerField: config.containerField,
         roles
-    }, { schema: config.supabaseSchema });
+    }, { schema: config.supabaseSchema, storageKey: config.authStorageKey ?? `${config.appKey}-auth` });
     const app = new AppState();
     const tombstones = new Tombstones(config.appKey);
     const prefs = config.prefs ?? new DevicePrefs(defaultPrefsKeys(config.appKey, config.nouns));
@@ -42,8 +43,39 @@ export function createSyncedStore(config) {
         supabase,
         roles,
         refs: config.refs,
-        remap: config.remap
+        remap: config.remap,
+        appKey: config.appKey
     });
+    onWriteError((message) => (app.writeError = message));
+    /**
+     * Ask the browser to keep this site's data (it may decide on its own, or ask the user). The
+     * result is `app.persisted`. Called on start; call it again from a button to retry.
+     */
+    async function requestPersistence() {
+        const storage = typeof navigator === 'undefined' ? undefined : navigator.storage;
+        if (!storage?.persisted || !storage.persist)
+            return (app.persisted = null);
+        try {
+            app.persisted = (await storage.persisted()) || (await storage.persist());
+        }
+        catch {
+            app.persisted = null;
+        }
+        return app.persisted;
+    }
+    function startErrorReporting() {
+        if (!config.reportErrors || !config.env.cloudConfigured || typeof window === 'undefined')
+            return;
+        setErrorReporter(remoteReporter({
+            supabaseUrl: config.env.supabaseUrl,
+            supabaseAnonKey: config.env.supabaseAnonKey,
+            schema: supabase.schema,
+            app: config.appKey,
+            version: config.reportErrors.version
+        }));
+        window.addEventListener('error', (e) => reportError('unhandled', e.error ?? e.message));
+        window.addEventListener('unhandledrejection', (e) => reportError('unhandled', e.reason));
+    }
     let started;
     /**
      * Open the local database, then restore any Supabase session (which opens the cloud
@@ -51,15 +83,18 @@ export function createSyncedStore(config) {
      */
     function init(options = {}) {
         started ??= (async () => {
+            startErrorReporting();
             setStorageFactory(config.storage);
             const db = await openDatabase(`${config.appKey}_local`, config, { storage: config.storage });
             const local = createDataSet('local', db, config);
             await options.beforeReady?.(local).catch((err) => console.error('Startup hook failed', err));
             app.local = local;
             app.ready = true;
+            void requestPersistence();
             await cloud.init();
         })().catch((err) => {
             console.error(err);
+            reportError('fatal', err);
             app.fatal = err instanceof Error ? err.message : String(err);
         });
         return started;
@@ -82,5 +117,5 @@ export function createSyncedStore(config) {
         app.local = null;
         await local?.db.remove();
     }
-    return { config, roles, app, cloud, tombstones, prefs, supabase, ops, init, resetDevice };
+    return { config, roles, app, cloud, tombstones, prefs, supabase, ops, init, resetDevice, requestPersistence };
 }

package/dist/supabase.d.ts

@@ -1,4 +1,4 @@
-import { type SupabaseClient } from '@supabase/supabase-js';
+import type { SupabaseClient } from '@supabase/supabase-js';
 import type { EnvConfig } from './env.js';
 import type { Role } from './types.js';
 export interface MembersConfig {
@@ -18,8 +18,11 @@ export interface MembersConfig {
 export interface Member {
     id: string;
     email: string;
-    /** True when the email belongs to a registered user; false means the invite is pending. */
-    active: boolean;
+    /**
+     * True once the invited person has signed in since being invited; false while the invite is
+     * pending. Null when the caller may not see it (only owners do, with roles).
+     */
+    active: boolean | null;
     /** Only when roles are on. */
     role?: Role | null;
 }
@@ -29,13 +32,32 @@ export interface SupabaseOptions {
      * must be listed under the Supabase project's exposed schemas (Data API settings).
      */
     schema?: string;
+    /**
+     * localStorage key of the signed-in session. Give every app on an origin its own key, so
+     * signing in or out of one doesn't affect another. Default: supabase-js's `sb-<project>-auth-token`,
+     * which a session found there is moved from once.
+     */
+    storageKey?: string;
 }
 export interface SupabaseApi {
     readonly configured: boolean;
     /** The Postgres schema the client reads and writes. */
     readonly schema: string;
-    /** The shared client (PKCE, created on first use), or null in local-only mode. */
+    /** localStorage key of the session. */
+    readonly storageKey: string;
+    /**
+     * Load supabase-js and create the shared client (PKCE), once. Null in local-only mode. The
+     * library is only downloaded when something needs it: a stored session, a sign-in redirect,
+     * or a sign-in.
+     */
+    loadClient(): Promise<SupabaseClient | null>;
+    /** The client once `loadClient` has created it, otherwise null. */
     getClient(): SupabaseClient | null;
+    /**
+     * Whether a session may exist without loading supabase-js: one is stored, or the page is a
+     * sign-in redirect (PKCE `code` or an error in the URL).
+     */
+    mayHaveSession(): boolean;
     fetchMembers(containerId: string): Promise<Member[]>;
     inviteMember(containerId: string, email: string, role?: Role): Promise<void>;
     setMemberRole(memberId: string, role: Role): Promise<void>;
@@ -58,6 +80,14 @@ export declare function friendlyError(error: {
     message: string;
     code?: string;
 }, noun: string, schema?: string): Error;
+/** supabase-js's own session key for a project URL. */
+export declare function defaultStorageKey(supabaseUrl: string): string;
+/**
+ * Move a session stored under supabase-js's default key to `storageKey` (once, when the new key
+ * is empty). The old key is removed: two apps holding the same refresh token would revoke each
+ * other's session, so only the first app to start keeps it and the other signs in again.
+ */
+export declare function adoptSession(legacyKey: string, storageKey: string): void;
 /** Supabase client plus the members API, with table and RPC names from `members`. */
 export declare function createSupabaseApi(env: EnvConfig, members: MembersConfig, options?: SupabaseOptions): SupabaseApi;
 /**