@zveltio/sdk 3.0.0-beta.5 → 3.0.0-beta.68

package/dist/local-store.js

@@ -46,6 +46,7 @@ export class LocalStore {
         await this.db.put('meta', { key: 'crdt_lamport', value: this.clock.current });
     }
     /** Write a local record and add to sync queue */
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     async put(collection, id, data) {
         if (!this.db)
             throw new Error('LocalStore not opened');
@@ -155,14 +156,33 @@ export class LocalStore {
         }
     }
     /** Apply data from server (via WebSocket or pull) */
-    async applyServerUpdate(collection, id, data, serverVersion) {
+    async applyServerUpdate(collection, id, 
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
+    data, serverVersion) {
         if (!this.db)
             throw new Error('LocalStore not opened');
         const existing = (await this.db.get('records', [collection, id]));
-        // Conflict detection: local has changes not yet confirmed by server
-        if (existing && existing._localVersion > existing._serverVersion) {
+        // Conflict detection: local has changes not yet confirmed by server.
+        //
+        // `_syncStatus` is the signal that survives contact with the SyncManager.
+        // The version comparison alone does not: `syncNow()` and `pull()` both pass
+        // `Date.now()` as the server version, because the collections API returns no
+        // version column — so after the first ACK `_serverVersion` is an epoch
+        // millisecond count while `_localVersion` is still a small counter, and
+        // `2 > 1790144009198` is false forever. Every local edit made after that
+        // first sync was overwritten in silence: status `synced`, no `_conflictData`,
+        // nothing in `getConflicts()`. The unit tests missed it because they hand
+        // this method versions on the same scale as the counter (1, 2, 3, 5).
+        //
+        // The version comparison is kept as a second signal: it still catches the
+        // race where an ACK for an earlier operation marks the record synced while a
+        // later one is queued.
+        if (existing &&
+            (existing._syncStatus !== 'synced' || existing._localVersion > existing._serverVersion)) {
             // CRDT field-level merge if both sides have CRDT docs
+            // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
             if (existing._crdtDoc && data.__crdt) {
+                // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
                 const remoteCrdtDoc = data.__crdt;
                 const merged = mergeLWW(existing._crdtDoc, remoteCrdtDoc);
                 const mergedData = fromDocument(merged);
@@ -192,9 +212,22 @@ export class LocalStore {
             _serverVersion: serverVersion,
             _syncStatus: 'synced',
             _updatedAt: Date.now(),
+            // Carried over: rebuilding the record from scratch dropped the CRDT
+            // document, so the next merge had nothing on the local side to merge with
+            // and fell through to the manual-conflict branch.
+            ...(existing?._crdtDoc ? { _crdtDoc: existing._crdtDoc } : {}),
         };
         await this.db.put('records', record);
     }
+    /**
+     * The server deleted a record: drop the local copy WITHOUT queueing a delete.
+     * `delete()` would queue one, echoing the server's own deletion back at it.
+     */
+    async applyServerDelete(collection, id) {
+        if (!this.db)
+            throw new Error('LocalStore not opened');
+        await this.db.delete('records', [collection, id]);
+    }
     /** Get records with conflicts for UI resolution */
     async getConflicts(collection) {
         if (!this.db)
@@ -205,16 +238,35 @@ export class LocalStore {
         return all;
     }
     /** Resolve a conflict (user decides which version wins) */
-    async resolveConflict(collection, id, resolvedData) {
+    async resolveConflict(collection, id, 
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
+    resolvedData) {
         if (!this.db)
             throw new Error('LocalStore not opened');
         const record = (await this.db.get('records', [collection, id]));
-        if (record) {
-            record.data = resolvedData;
-            record._syncStatus = 'pending'; // Re-sync with server
-            record._localVersion += 1;
-            await this.db.put('records', record);
-        }
+        if (!record)
+            return;
+        record.data = resolvedData;
+        record._syncStatus = 'pending'; // Re-sync with server
+        record._localVersion += 1;
+        record._conflictData = undefined;
+        // Nothing re-synced it. The status said `pending` and the queue held no
+        // operation carrying the resolved data, so a resolution — whether a person
+        // chose it in the UI or the CRDT merge produced it — stayed on the device.
+        // The only operation for this record was the one the server had already
+        // rejected.
+        const tx = this.db.transaction(['records', 'sync_queue'], 'readwrite');
+        await tx.objectStore('records').put(record);
+        await tx.objectStore('sync_queue').add({
+            id: `${Date.now()}-${Math.random().toString(36).slice(2)}`,
+            collection,
+            recordId: id,
+            operation: 'update',
+            payload: resolvedData,
+            attempts: 0,
+            createdAt: Date.now(),
+        });
+        await tx.done;
     }
     /** Save an offline blob — returns a temporary ID 'local_blob_<UUID>' */
     async saveBlob(blob, collection, recordId, field) {

package/dist/offline/index.d.ts

@@ -69,9 +69,9 @@ export interface OfflineProviderConfig {
     websocket?: typeof WebSocket;
 }
 /**
- * Public interface every provider implements. Today the CRDT provider
- * wraps `SyncManager`; the Electric provider wraps a websocket. Both
- * expose the same surface.
+ * Public interface every provider implements. The CRDT provider wraps
+ * `SyncManager`; the Electric provider wraps a websocket. Both expose the same
+ * surface.
  */
 export interface OfflineProvider {
     readonly kind: OfflineProviderKind;

package/dist/offline/index.js

@@ -45,7 +45,7 @@ export class ElectricNotConfigured extends Error {
     constructor(reason) {
         super(`Electric SQL provider is not configured: ${reason}. ` +
             `Set provider: 'crdt' for the default sync path, or stand up an Electric ` +
-            `service and pass electricUrl. See docs/OFFLINE-SYNC.md.`);
+            `service and pass electricUrl. See docs/engine/offline-sync.md.`);
         this.name = 'ElectricNotConfigured';
     }
 }
@@ -76,27 +76,63 @@ export async function createOfflineProvider(config) {
     return makeCrdtAdapter(config);
 }
 // ── CRDT adapter (today's working path) ─────────────────────────────────────
-async function makeCrdtAdapter(_config) {
-    // The existing SyncManager lives in `sync-manager.ts`. We don't import
-    // it at the top of this file to keep the bundle tree-shakeable for
-    // consumers who only want the type definitions. Lazy import here.
-    const { SyncManager } = await import('../sync-manager.js');
-    void SyncManager;
+/**
+ * The CRDT provider, wrapping `SyncManager`.
+ *
+ * It did not wrap anything. `pull()` was an empty body, `subscribe()` returned
+ * an unsubscribe that unsubscribed from nothing, and `push()` returned `0` —
+ * which is the worst of the four, because `0` reads as "there was nothing to
+ * send" rather than "I did not look". `SyncManager` was imported and then
+ * discarded with `void SyncManager`, and the interface docs a few lines up said
+ * "Today the CRDT provider wraps SyncManager" while it did not.
+ *
+ * This is the DEFAULT provider (`config.provider ?? 'crdt'`), so an application
+ * that called `createOfflineProvider({ engineUrl })` and pushed on a timer got a
+ * clean run and an empty server, forever, with nothing in any log.
+ *
+ * The store is opened but background sync is NOT started: this interface is
+ * explicitly pull/push, and a timer firing `syncNow()` underneath would make the
+ * number `push()` returns meaningless.
+ */
+async function makeCrdtAdapter(config) {
+    // Lazy imports keep the bundle tree-shakeable for consumers who only want the
+    // type definitions.
+    const [{ SyncManager }, { ZveltioClient }] = await Promise.all([
+        import('../sync-manager.js'),
+        import('../client.js'),
+    ]);
+    const client = new ZveltioClient({ baseUrl: config.engineUrl });
+    const sync = new SyncManager(client);
+    await sync.open();
+    const tables = config.tables ?? [];
     return {
         kind: 'crdt',
         async pull() {
-            /* delegated to SyncManager in the full impl */
+            // Silence here is what the old implementation was. A provider asked to
+            // pull with nothing to pull from is a configuration mistake, and saying so
+            // costs one throw; not saying so costs an empty local database that looks
+            // like an empty server.
+            if (tables.length === 0) {
+                throw new Error('createOfflineProvider: `tables` is empty, so there is nothing to pull. ' +
+                    'List the collections to replicate, e.g. { tables: ["orders", "customers"] }.');
+            }
+            await sync.pull(tables);
         },
         async push() {
-            return 0;
+            // The count is the drop in pending operations across the sync. Operations
+            // that failed stay pending and are therefore not counted, which is what
+            // "the number of ops sent" has to mean if the number is to be worth
+            // anything.
+            const before = await sync.getStatus();
+            await sync.syncNow();
+            const after = await sync.getStatus();
+            return Math.max(0, before.pending - after.pending);
         },
-        subscribe(_table, _cb) {
-            return () => {
-                /* */
-            };
+        subscribe(table, cb) {
+            return sync.collection(table).subscribe((rows) => cb(rows));
         },
         async close() {
-            /* */
+            await sync.stop();
         },
     };
 }
@@ -131,7 +167,7 @@ async function makeElectricProvider(config) {
         return (await res.json());
     }
     let auth = await mintToken();
-    let electricUrl = config.electricUrl ?? auth.electricUrl;
+    const electricUrl = config.electricUrl ?? auth.electricUrl;
     // Per-table subscription registry.
     const subscribers = new Map();
     // Token refresh — fire-and-forget background timer that mints a fresh

package/dist/publish/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/publish/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,SAAS,EAAE,UAAU,CAAC;IACtB,oDAAoD;IACpD,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,SAAS,CAAC;IACrB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,iBAAS,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CAK3D;AAED,iBAAS,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAKhD;AAED,iBAAS,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAO9C;AAED,6CAA6C;AAC7C,wBAAsB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlE;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAY7E;AAQD,qEAAqE;AACrE,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAE1E;AAED,yEAAyE;AACzE,wBAAsB,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAEzE;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAY7B;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,kBAAkB,EAC7B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BvD;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CASlD;AAGD,eAAO,MAAM,MAAM;;;;CAA+C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/publish/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,SAAS,EAAE,UAAU,CAAC;IACtB,oDAAoD;IACpD,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,SAAS,CAAC;IACrB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,iBAAS,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CAK3D;AAED,iBAAS,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAKhD;AAED,iBAAS,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAO9C;AAED,6CAA6C;AAC7C,wBAAsB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlE;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAY7E;AAQD,qEAAqE;AACrE,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAE1E;AAED,yEAAyE;AACzE,wBAAsB,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAEzE;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAa7B;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,kBAAkB,EAC7B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA+BvD;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CASlD;AAGD,eAAO,MAAM,MAAM;;;;CAA+C,CAAC"}

package/dist/publish/index.js

@@ -86,6 +86,7 @@ export async function signBundle(archive, keypair) {
     const bundleSha256 = await sha256Hex(archive);
     const key = await importPrivateKey(keypair.privateJwk);
     const dataBytes = new TextEncoder().encode(bundleSha256.toLowerCase());
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     const sigBuf = await crypto.subtle.sign({ name: 'Ed25519' }, key, dataBytes);
     return {
         algorithm: 'ed25519',
@@ -123,7 +124,11 @@ export async function verifyBundle(archive, signature, publicJwk) {
     }
     const key = await importPublicKey(publicJwk);
     const dataBytes = new TextEncoder().encode(signature.bundleSha256.toLowerCase());
-    const ok = await crypto.subtle.verify({ name: 'Ed25519' }, key, sigBytes, dataBytes);
+    const ok = await crypto.subtle.verify({ name: 'Ed25519' }, key, 
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
+    sigBytes, 
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
+    dataBytes);
     return ok ? { ok: true } : { ok: false, reason: 'Ed25519 verification failed' };
 }
 /**

package/dist/realtime.d.ts

@@ -5,7 +5,15 @@ export declare class ZveltioRealtime {
     private reconnectAttempts;
     private maxReconnectAttempts;
     private reconnectTimer;
-    constructor(baseUrl: string);
+    private headers;
+    /**
+     * @param options.headers Sent with the upgrade — e.g. `{ 'X-API-Key': key }`
+     *   for a server-side client. Bun and Node (undici) accept them; a browser
+     *   cannot set headers on a WebSocket and authenticates by session cookie.
+     */
+    constructor(baseUrl: string, options?: {
+        headers?: Record<string, string>;
+    });
     connect(): void;
     private attemptReconnect;
     subscribe(collection: string, callback: (data: any) => void): () => void;

package/dist/realtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"realtime.d.ts","sourceRoot":"","sources":["../src/realtime.ts"],"names":[],"mappings":"AAAA,qBAAa,eAAe;IAC1B,OAAO,CAAC,EAAE,CAA0B;IACpC,OAAO,CAAC,SAAS,CAAoD;IACrE,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,oBAAoB,CAAM;IAClC,OAAO,CAAC,cAAc,CAA8C;gBAExD,OAAO,EAAE,MAAM;IAK3B,OAAO,IAAI,IAAI;IAyCf,OAAO,CAAC,gBAAgB;IAQxB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,GAAG,MAAM,IAAI;IAqBxE,UAAU,IAAI,IAAI;CAQnB"}
+{"version":3,"file":"realtime.d.ts","sourceRoot":"","sources":["../src/realtime.ts"],"names":[],"mappings":"AAAA,qBAAa,eAAe;IAC1B,OAAO,CAAC,EAAE,CAA0B;IAEpC,OAAO,CAAC,SAAS,CAAoD;IACrE,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,oBAAoB,CAAM;IAClC,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,OAAO,CAAqC;IAEpD;;;;OAIG;gBACS,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAO;IAM/E,OAAO,IAAI,IAAI;IA6Cf,OAAO,CAAC,gBAAgB;IASxB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,GAAG,MAAM,IAAI;IAqBxE,UAAU,IAAI,IAAI;CAQnB"}

package/dist/realtime.js

@@ -1,17 +1,29 @@
 export class ZveltioRealtime {
     ws = null;
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     listeners = new Map();
     baseUrl;
     reconnectAttempts = 0;
     maxReconnectAttempts = 10;
     reconnectTimer = null;
-    constructor(baseUrl) {
+    headers;
+    /**
+     * @param options.headers Sent with the upgrade — e.g. `{ 'X-API-Key': key }`
+     *   for a server-side client. Bun and Node (undici) accept them; a browser
+     *   cannot set headers on a WebSocket and authenticates by session cookie.
+     */
+    constructor(baseUrl, options = {}) {
         // Convert http(s) to ws(s)
         this.baseUrl = baseUrl.replace(/^http/, 'ws');
+        this.headers = options.headers;
     }
     connect() {
         const wsUrl = `${this.baseUrl}/api/ws`;
-        this.ws = new WebSocket(wsUrl);
+        // The two-argument form with `{ headers }` is the Bun/undici extension; the
+        // standard constructor stays in use when there is nothing to send.
+        this.ws = this.headers
+            ? new WebSocket(wsUrl, { headers: this.headers })
+            : new WebSocket(wsUrl);
         this.ws.onopen = () => {
             this.reconnectAttempts = 0;
             // Re-subscribe to all existing collections using the server's expected protocol
@@ -55,6 +67,7 @@ export class ZveltioRealtime {
         this.reconnectAttempts++;
         this.reconnectTimer = setTimeout(() => this.connect(), delay);
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     subscribe(collection, callback) {
         if (!this.listeners.has(collection))
             this.listeners.set(collection, new Set());

package/dist/rpc/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rpc/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAC3D,IAAI,EAAE,gBAAgB,GACrB,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAoB1B;AAID,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rpc/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;;;GAMG;AAGH,wBAAgB,eAAe,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAC3D,IAAI,EAAE,gBAAgB,GACrB,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAqB1B;AAID,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC"}

package/dist/rpc/index.js

@@ -38,9 +38,11 @@ import { hc } from 'hono/client';
  *               `ZveltioApi` from `@zveltio/engine/api-types`. For an
  *               extension's own routes, pass `typeof yourApp`.
  */
+// biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
 export function createRpcClient(opts) {
     const baseUrl = opts.baseUrl.replace(/\/$/, '');
     const includeCredentials = opts.includeCredentials !== false;
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     const customFetch = (async (input, init) => {
         const dynHeaders = opts.getHeaders ? await opts.getHeaders() : {};
         const merged = new Headers(init?.headers ?? {});

package/dist/schema-codegen.d.ts

@@ -8,7 +8,9 @@
  * column names in editors and `tsc` catches typos.
  *
  * Scope intentionally narrow:
- *   - Handles `CREATE TABLE [IF NOT EXISTS]` and `ALTER TABLE … ADD COLUMN`.
+ *   - Reads only the UP half of each file (everything before `-- DOWN`).
+ *   - Handles `CREATE TABLE [IF NOT EXISTS]`, `ALTER TABLE … ADD COLUMN`
+ *     and `ALTER TABLE … DROP COLUMN`.
  *   - Maps the common Postgres types we see in extension migrations to TS.
  *   - Ignores constraint-only ALTER TABLE statements (PRIMARY KEY, FK).
  *   - Ignores CREATE INDEX, CREATE TYPE, CREATE FUNCTION, etc.

package/dist/schema-codegen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-codegen.d.ts","sourceRoot":"","sources":["../src/schema-codegen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAsMD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA+BtD;AA6BD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,CA+C7D;AAID,MAAM,WAAW,cAAc;IAC7B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,GAAE,cAAmB,GAAG,MAAM,CA0BtF"}
+{"version":3,"file":"schema-codegen.d.ts","sourceRoot":"","sources":["../src/schema-codegen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAoND;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA+BtD;AA6BD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,CAoE7D;AAID,MAAM,WAAW,cAAc;IAC7B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,GAAE,cAAmB,GAAG,MAAM,CA0BtF"}

package/dist/schema-codegen.js

@@ -8,7 +8,9 @@
  * column names in editors and `tsc` catches typos.
  *
  * Scope intentionally narrow:
- *   - Handles `CREATE TABLE [IF NOT EXISTS]` and `ALTER TABLE … ADD COLUMN`.
+ *   - Reads only the UP half of each file (everything before `-- DOWN`).
+ *   - Handles `CREATE TABLE [IF NOT EXISTS]`, `ALTER TABLE … ADD COLUMN`
+ *     and `ALTER TABLE … DROP COLUMN`.
  *   - Maps the common Postgres types we see in extension migrations to TS.
  *   - Ignores constraint-only ALTER TABLE statements (PRIMARY KEY, FK).
  *   - Ignores CREATE INDEX, CREATE TYPE, CREATE FUNCTION, etc.
@@ -90,6 +92,19 @@ function mapPgTypeToTs(pgType) {
     return isArray ? `${tsBase}[]` : tsBase;
 }
 // ─── SQL parsing ───────────────────────────────────────────────────────────
+/**
+ * Keep only the UP half of a migration file. Extension migrations carry their
+ * rollback in the same file, after a line that is exactly `-- DOWN`; the
+ * engine's runner (`parseMigrationSql`) splits on that marker and only ever
+ * executes the UP half. Codegen read both halves, so a `DROP TABLE` /
+ * `ADD COLUMN` written for rollback described the generated types as much as
+ * the real schema did. Same anchored regex as the runner — a loose `-- DOWN`
+ * prefix match once cost the engine half a schema.
+ */
+function upSection(sql) {
+    const i = sql.search(/^--\s*DOWN\s*$/im);
+    return i < 0 ? sql : sql.slice(0, i);
+}
 /**
  * Strip line comments (`-- …`) and block comments (`/* … * /`) so they don't
  * confuse the table/column regexes. Dollar-quoted blocks are preserved
@@ -301,13 +316,18 @@ export function parseSchema(sqlChunks) {
         }
         return tables.get(name);
     };
-    const allSql = sqlChunks.map(stripComments).join('\n');
+    const allSql = sqlChunks.map(upSection).map(stripComments).join('\n');
     // CREATE TABLE [IF NOT EXISTS] <name> ( <body> )
     const createRe = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))\s*\(/gi;
-    let m;
-    while ((m = createRe.exec(allSql)) !== null) {
+    for (const m of allSql.matchAll(createRe)) {
         const tableName = m[1] ?? m[2];
-        const openIdx = createRe.lastIndex - 1; // position of '('
+        // From the MATCH, not from the regex's `lastIndex`.
+        //
+        // `matchAll` clones the regex internally, so `createRe.lastIndex` stays 0
+        // here — it is only advanced by `exec`. Converting this loop from
+        // `while ((m = createRe.exec(...)))` and keeping `lastIndex` silently made
+        // every table body start at the top of the file; five tests caught it.
+        const openIdx = m.index + m[0].length - 1; // position of '('
         const closeIdx = findMatchingParen(allSql, openIdx);
         if (closeIdx < 0)
             continue; // unbalanced — skip
@@ -316,11 +336,10 @@ export function parseSchema(sqlChunks) {
         const tableCols = ensureTable(tableName);
         for (const c of columns)
             tableCols.set(c.name, c);
-        createRe.lastIndex = closeIdx + 1;
     }
     // ALTER TABLE <name> ADD COLUMN [IF NOT EXISTS] <col> <type> <rest>
     const alterRe = /ALTER\s+TABLE\s+(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))\s+ADD\s+COLUMN\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))\s+([^;]+?)(?=;|$)/gi;
-    while ((m = alterRe.exec(allSql)) !== null) {
+    for (const m of allSql.matchAll(alterRe)) {
         const tableName = m[1] ?? m[2];
         const colName = m[3] ?? m[4];
         const tail = m[5];
@@ -330,6 +349,21 @@ export function parseSchema(sqlChunks) {
             tableCols.set(col.name, col);
         }
     }
+    // ALTER TABLE <name> DROP COLUMN [IF EXISTS] <col>
+    //
+    // Run last, after every CREATE and ADD COLUMN: a column the migrations
+    // removed used to stay in the generated types, so `ctx.db` promised a
+    // column Postgres no longer has — the silent runtime failure this module
+    // exists to prevent.
+    //
+    // ponytail: a third pass, not an ordered walk of the statements. A column
+    // dropped and then re-added by a later migration would be lost; no
+    // extension does that today. Make the parser statement-ordered if one does.
+    const dropRe = /ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))\s+DROP\s+COLUMN\s+(?:IF\s+EXISTS\s+)?(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))/gi;
+    for (const m of allSql.matchAll(dropRe)) {
+        // Never `ensureTable` here — a DROP alone must not invent a table.
+        tables.get(m[1] ?? m[2])?.delete(m[3] ?? m[4]);
+    }
     return {
         tables: order.map((name) => ({ name, columns: [...tables.get(name).values()] })),
     };

package/dist/schema-watcher.d.ts

@@ -6,7 +6,7 @@
  * updated, or deleted.
  *
  * Usage (in `zveltio dev --watch`):
- *   import { watchSchema } from '@zveltio/sdk/schema-watcher';
+ *   import { watchSchema } from '@zveltio/sdk';
  *   await watchSchema('http://localhost:3000', './src/zveltio-types.d.ts');
  */
 export interface CollectionField {

package/dist/schema-watcher.js

@@ -6,7 +6,7 @@
  * updated, or deleted.
  *
  * Usage (in `zveltio dev --watch`):
- *   import { watchSchema } from '@zveltio/sdk/schema-watcher';
+ *   import { watchSchema } from '@zveltio/sdk';
  *   await watchSchema('http://localhost:3000', './src/zveltio-types.d.ts');
  */
 const TYPE_MAP = {

package/dist/studio/index.d.ts

@@ -35,6 +35,7 @@ export declare function applyFormAlterHooks(hooks: FormAlterHook[], schema: Form
 export declare function sortSlotContributions<T extends {
     priority?: number;
 }>(items: T[]): T[];
+export { removeOwnerFromSlots, registerOwnedOnSlot, type OwnedSlotContribution, } from './slot-owner-registry.js';
 /** Register a top-level Studio page contributed by this extension. */
 export declare function registerRoute(route: StudioRoute): void;
 /**

package/dist/studio/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/studio/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,UAAU,EAEV,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAE/B,UAAU,SAAU,SAAQ,YAAY;IACtC,qDAAqD;IACrD,MAAM,IAAI,UAAU,CAAC;CACtB;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,CAoE5D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,aAAa,EAAE,EACtB,MAAM,EAAE,UAAU,EAClB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAChC,UAAU,CAWZ;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAGtF;AAoCD,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAEtD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAE/E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,CAE3E;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,eAAe,GAAG,IAAI,CAE3D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAEvE;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAID,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,UAAU,EACV,SAAS,GACV,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/studio/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,UAAU,EAEV,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAE/B,UAAU,SAAU,SAAQ,YAAY;IACtC,qDAAqD;IACrD,MAAM,IAAI,UAAU,CAAC;CACtB;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,CAoE5D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,aAAa,EAAE,EACtB,MAAM,EAAE,UAAU,EAClB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAChC,UAAU,CAWZ;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAGtF;AAED,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,qBAAqB,GAC3B,MAAM,0BAA0B,CAAC;AAqClC,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAEtD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAE/E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,CAE3E;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,eAAe,GAAG,IAAI,CAE3D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAEvE;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,IAAI,MAAM,CAIrC;AAID,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,UAAU,EACV,SAAS,GACV,MAAM,uBAAuB,CAAC"}

package/dist/studio/index.js

@@ -109,9 +109,11 @@ export function sortSlotContributions(items) {
     // We rely on Array.prototype.sort being stable (TC39 since 2019).
     return items.slice().sort((a, b) => (a.priority ?? 100) - (b.priority ?? 100));
 }
+export { removeOwnerFromSlots, registerOwnedOnSlot, } from './slot-owner-registry.js';
 function getStudioGlobal() {
     if (typeof window === 'undefined')
         return null;
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     const g = window.__zveltio;
     if (!g) {
         console.warn('[zveltio/sdk/studio] window.__zveltio is not installed. Is the bundle running inside Studio?');
@@ -176,5 +178,6 @@ export function registerAssetPreview(handler) {
 export function getEngineUrl() {
     if (typeof window === 'undefined')
         return '';
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     return window.__ZVELTIO_ENGINE_URL__ || getStudioGlobal()?.engineUrl || '';
 }

package/dist/studio/slot-owner-registry.d.ts

@@ -0,0 +1,13 @@
+import type { SlotContribution } from '../extension/index.js';
+/** Owner tag set by compile-time `contribute.ts` modules; absent on legacy window.__zveltio calls. */
+export type OwnedSlotContribution = SlotContribution & {
+    owner?: string;
+};
+/** Remove every contribution registered by `owner` across all slot names. */
+export declare function removeOwnerFromSlots(slots: Record<string, OwnedSlotContribution[]>, owner: string): Record<string, OwnedSlotContribution[]>;
+/**
+ * Register (or replace) a single owner's contribution on one slot.
+ * Prior entries from the same owner on that slot are dropped first.
+ */
+export declare function registerOwnedOnSlot(slots: Record<string, OwnedSlotContribution[]>, owner: string, slotName: string, contribution: SlotContribution): Record<string, OwnedSlotContribution[]>;
+//# sourceMappingURL=slot-owner-registry.d.ts.map

package/dist/studio/slot-owner-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slot-owner-registry.d.ts","sourceRoot":"","sources":["../../src/studio/slot-owner-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,sGAAsG;AACtG,MAAM,MAAM,qBAAqB,GAAG,gBAAgB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC,EAC9C,KAAK,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAOzC;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC,EAC9C,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,gBAAgB,GAC7B,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAMzC"}

package/dist/studio/slot-owner-registry.js

@@ -0,0 +1,21 @@
+/** Remove every contribution registered by `owner` across all slot names. */
+export function removeOwnerFromSlots(slots, owner) {
+    const out = {};
+    for (const [name, list] of Object.entries(slots)) {
+        const kept = list.filter((c) => c.owner !== owner);
+        if (kept.length > 0)
+            out[name] = kept;
+    }
+    return out;
+}
+/**
+ * Register (or replace) a single owner's contribution on one slot.
+ * Prior entries from the same owner on that slot are dropped first.
+ */
+export function registerOwnedOnSlot(slots, owner, slotName, contribution) {
+    const out = { ...slots };
+    const prev = out[slotName] ?? [];
+    const kept = prev.filter((c) => c.owner !== owner);
+    out[slotName] = [...kept, { ...contribution, owner }];
+    return out;
+}

package/dist/svelte.d.ts

@@ -6,7 +6,7 @@
  * ```svelte
  * <script lang="ts">
  *   import { SyncManager } from '@zveltio/sdk';
- *   import { useSyncCollection, useSyncStatus } from '@zveltio/sdk/svelte';
+ *   import { useSyncCollection, useSyncStatus } from '@zveltio/sdk';
  *
  *   let todos = $state<any[]>([]);
  *   const unsub = useSyncCollection(sync, 'todos', (records) => { todos = records; });

package/dist/svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"svelte.d.ts","sourceRoot":"","sources":["../src/svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,IAAI,GAC/B,MAAM,IAAI,CAGZ;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,KAAK,IAAI,EACnF,UAAU,SAAO,GAChB,MAAM,IAAI,CAeZ"}
+{"version":3,"file":"svelte.d.ts","sourceRoot":"","sources":["../src/svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAElB,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,IAAI,GAC/B,MAAM,IAAI,CAGZ;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,KAAK,IAAI,EACnF,UAAU,SAAO,GAChB,MAAM,IAAI,CAeZ"}

package/dist/svelte.js

@@ -6,7 +6,7 @@
  * ```svelte
  * <script lang="ts">
  *   import { SyncManager } from '@zveltio/sdk';
- *   import { useSyncCollection, useSyncStatus } from '@zveltio/sdk/svelte';
+ *   import { useSyncCollection, useSyncStatus } from '@zveltio/sdk';
  *
  *   let todos = $state<any[]>([]);
  *   const unsub = useSyncCollection(sync, 'todos', (records) => { todos = records; });
@@ -23,7 +23,9 @@
  * Calls `setter` immediately with current state and on each update.
  * Returns the unsubscribe function.
  */
-export function useSyncCollection(sync, collection, setter) {
+export function useSyncCollection(sync, collection, 
+// biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
+setter) {
     const col = sync.collection(collection);
     return col.subscribe(setter);
 }