@zveltio/sdk 3.0.0-beta.5 → 3.0.0-beta.70

package/dist/local-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-store.d.ts","sourceRoot":"","sources":["../src/local-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAoD,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAG/F,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,QAAQ,CAAC,EAAE,WAAW,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD,qBAAa,UAAU;IACrB,OAAO,CAAC,EAAE,CAA6B;IACvC,OAAO,CAAC,KAAK,CAA6B;IAEpC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAuCb,cAAc;IAK5B,iDAAiD;IAC3C,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;IA0C1F,gDAAgD;IAC1C,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAO3E,6CAA6C;IACvC,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAUtD,8CAA8C;IACxC,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4B3D,qDAAqD;IAC/C,aAAa,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAK/C,+EAA+E;IACzE,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAqBhB,mEAAmE;IAC7D,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWnE,qDAAqD;IAC/C,iBAAiB,CACrB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IA4ChB,mDAAmD;IAC7C,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAW/D,2DAA2D;IACrD,eAAe,CACnB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC;IAWhB,wEAAwE;IAClE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAehG,wCAAwC;IAClC,eAAe,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAK/C,qDAAqD;IAC/C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3C,2BAA2B;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAUtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B"}
+{"version":3,"file":"local-store.d.ts","sourceRoot":"","sources":["../src/local-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAoD,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAG/F,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IAEnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,QAAQ,CAAC,EAAE,WAAW,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAE1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD,qBAAa,UAAU;IACrB,OAAO,CAAC,EAAE,CAA6B;IACvC,OAAO,CAAC,KAAK,CAA6B;IAEpC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAuCb,cAAc;IAK5B,iDAAiD;IAE3C,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;IA0C1F,gDAAgD;IAC1C,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAO3E,6CAA6C;IACvC,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAUtD,8CAA8C;IACxC,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4B3D,qDAAqD;IAC/C,aAAa,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAK/C,+EAA+E;IACzE,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAqBhB,mEAAmE;IAC7D,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWnE,qDAAqD;IAC/C,iBAAiB,CACrB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EAEV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAmEhB;;;OAGG;IACG,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtE,mDAAmD;IAC7C,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAW/D,2DAA2D;IACrD,eAAe,CACnB,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EAEV,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC;IA4BhB,wEAAwE;IAClE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAehG,wCAAwC;IAClC,eAAe,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAK/C,qDAAqD;IAC/C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3C,2BAA2B;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAUtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B"}

package/dist/local-store.js

@@ -46,6 +46,7 @@ export class LocalStore {
         await this.db.put('meta', { key: 'crdt_lamport', value: this.clock.current });
     }
     /** Write a local record and add to sync queue */
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     async put(collection, id, data) {
         if (!this.db)
             throw new Error('LocalStore not opened');
@@ -155,14 +156,33 @@ export class LocalStore {
         }
     }
     /** Apply data from server (via WebSocket or pull) */
-    async applyServerUpdate(collection, id, data, serverVersion) {
+    async applyServerUpdate(collection, id, 
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
+    data, serverVersion) {
         if (!this.db)
             throw new Error('LocalStore not opened');
         const existing = (await this.db.get('records', [collection, id]));
-        // Conflict detection: local has changes not yet confirmed by server
-        if (existing && existing._localVersion > existing._serverVersion) {
+        // Conflict detection: local has changes not yet confirmed by server.
+        //
+        // `_syncStatus` is the signal that survives contact with the SyncManager.
+        // The version comparison alone does not: `syncNow()` and `pull()` both pass
+        // `Date.now()` as the server version, because the collections API returns no
+        // version column — so after the first ACK `_serverVersion` is an epoch
+        // millisecond count while `_localVersion` is still a small counter, and
+        // `2 > 1790144009198` is false forever. Every local edit made after that
+        // first sync was overwritten in silence: status `synced`, no `_conflictData`,
+        // nothing in `getConflicts()`. The unit tests missed it because they hand
+        // this method versions on the same scale as the counter (1, 2, 3, 5).
+        //
+        // The version comparison is kept as a second signal: it still catches the
+        // race where an ACK for an earlier operation marks the record synced while a
+        // later one is queued.
+        if (existing &&
+            (existing._syncStatus !== 'synced' || existing._localVersion > existing._serverVersion)) {
             // CRDT field-level merge if both sides have CRDT docs
+            // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
             if (existing._crdtDoc && data.__crdt) {
+                // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
                 const remoteCrdtDoc = data.__crdt;
                 const merged = mergeLWW(existing._crdtDoc, remoteCrdtDoc);
                 const mergedData = fromDocument(merged);
@@ -192,9 +212,22 @@ export class LocalStore {
             _serverVersion: serverVersion,
             _syncStatus: 'synced',
             _updatedAt: Date.now(),
+            // Carried over: rebuilding the record from scratch dropped the CRDT
+            // document, so the next merge had nothing on the local side to merge with
+            // and fell through to the manual-conflict branch.
+            ...(existing?._crdtDoc ? { _crdtDoc: existing._crdtDoc } : {}),
         };
         await this.db.put('records', record);
     }
+    /**
+     * The server deleted a record: drop the local copy WITHOUT queueing a delete.
+     * `delete()` would queue one, echoing the server's own deletion back at it.
+     */
+    async applyServerDelete(collection, id) {
+        if (!this.db)
+            throw new Error('LocalStore not opened');
+        await this.db.delete('records', [collection, id]);
+    }
     /** Get records with conflicts for UI resolution */
     async getConflicts(collection) {
         if (!this.db)
@@ -205,16 +238,35 @@ export class LocalStore {
         return all;
     }
     /** Resolve a conflict (user decides which version wins) */
-    async resolveConflict(collection, id, resolvedData) {
+    async resolveConflict(collection, id, 
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
+    resolvedData) {
         if (!this.db)
             throw new Error('LocalStore not opened');
         const record = (await this.db.get('records', [collection, id]));
-        if (record) {
-            record.data = resolvedData;
-            record._syncStatus = 'pending'; // Re-sync with server
-            record._localVersion += 1;
-            await this.db.put('records', record);
-        }
+        if (!record)
+            return;
+        record.data = resolvedData;
+        record._syncStatus = 'pending'; // Re-sync with server
+        record._localVersion += 1;
+        record._conflictData = undefined;
+        // Nothing re-synced it. The status said `pending` and the queue held no
+        // operation carrying the resolved data, so a resolution — whether a person
+        // chose it in the UI or the CRDT merge produced it — stayed on the device.
+        // The only operation for this record was the one the server had already
+        // rejected.
+        const tx = this.db.transaction(['records', 'sync_queue'], 'readwrite');
+        await tx.objectStore('records').put(record);
+        await tx.objectStore('sync_queue').add({
+            id: `${Date.now()}-${Math.random().toString(36).slice(2)}`,
+            collection,
+            recordId: id,
+            operation: 'update',
+            payload: resolvedData,
+            attempts: 0,
+            createdAt: Date.now(),
+        });
+        await tx.done;
     }
     /** Save an offline blob — returns a temporary ID 'local_blob_<UUID>' */
     async saveBlob(blob, collection, recordId, field) {

package/dist/offline/index.d.ts

@@ -69,9 +69,9 @@ export interface OfflineProviderConfig {
     websocket?: typeof WebSocket;
 }
 /**
- * Public interface every provider implements. Today the CRDT provider
- * wraps `SyncManager`; the Electric provider wraps a websocket. Both
- * expose the same surface.
+ * Public interface every provider implements. The CRDT provider wraps
+ * `SyncManager`; the Electric provider wraps a websocket. Both expose the same
+ * surface.
  */
 export interface OfflineProvider {
     readonly kind: OfflineProviderKind;

package/dist/offline/index.js

@@ -45,7 +45,7 @@ export class ElectricNotConfigured extends Error {
     constructor(reason) {
         super(`Electric SQL provider is not configured: ${reason}. ` +
             `Set provider: 'crdt' for the default sync path, or stand up an Electric ` +
-            `service and pass electricUrl. See docs/OFFLINE-SYNC.md.`);
+            `service and pass electricUrl. See docs/engine/offline-sync.md.`);
         this.name = 'ElectricNotConfigured';
     }
 }
@@ -76,27 +76,63 @@ export async function createOfflineProvider(config) {
     return makeCrdtAdapter(config);
 }
 // ── CRDT adapter (today's working path) ─────────────────────────────────────
-async function makeCrdtAdapter(_config) {
-    // The existing SyncManager lives in `sync-manager.ts`. We don't import
-    // it at the top of this file to keep the bundle tree-shakeable for
-    // consumers who only want the type definitions. Lazy import here.
-    const { SyncManager } = await import('../sync-manager.js');
-    void SyncManager;
+/**
+ * The CRDT provider, wrapping `SyncManager`.
+ *
+ * It did not wrap anything. `pull()` was an empty body, `subscribe()` returned
+ * an unsubscribe that unsubscribed from nothing, and `push()` returned `0` —
+ * which is the worst of the four, because `0` reads as "there was nothing to
+ * send" rather than "I did not look". `SyncManager` was imported and then
+ * discarded with `void SyncManager`, and the interface docs a few lines up said
+ * "Today the CRDT provider wraps SyncManager" while it did not.
+ *
+ * This is the DEFAULT provider (`config.provider ?? 'crdt'`), so an application
+ * that called `createOfflineProvider({ engineUrl })` and pushed on a timer got a
+ * clean run and an empty server, forever, with nothing in any log.
+ *
+ * The store is opened but background sync is NOT started: this interface is
+ * explicitly pull/push, and a timer firing `syncNow()` underneath would make the
+ * number `push()` returns meaningless.
+ */
+async function makeCrdtAdapter(config) {
+    // Lazy imports keep the bundle tree-shakeable for consumers who only want the
+    // type definitions.
+    const [{ SyncManager }, { ZveltioClient }] = await Promise.all([
+        import('../sync-manager.js'),
+        import('../client.js'),
+    ]);
+    const client = new ZveltioClient({ baseUrl: config.engineUrl });
+    const sync = new SyncManager(client);
+    await sync.open();
+    const tables = config.tables ?? [];
     return {
         kind: 'crdt',
         async pull() {
-            /* delegated to SyncManager in the full impl */
+            // Silence here is what the old implementation was. A provider asked to
+            // pull with nothing to pull from is a configuration mistake, and saying so
+            // costs one throw; not saying so costs an empty local database that looks
+            // like an empty server.
+            if (tables.length === 0) {
+                throw new Error('createOfflineProvider: `tables` is empty, so there is nothing to pull. ' +
+                    'List the collections to replicate, e.g. { tables: ["orders", "customers"] }.');
+            }
+            await sync.pull(tables);
         },
         async push() {
-            return 0;
+            // The count is the drop in pending operations across the sync. Operations
+            // that failed stay pending and are therefore not counted, which is what
+            // "the number of ops sent" has to mean if the number is to be worth
+            // anything.
+            const before = await sync.getStatus();
+            await sync.syncNow();
+            const after = await sync.getStatus();
+            return Math.max(0, before.pending - after.pending);
         },
-        subscribe(_table, _cb) {
-            return () => {
-                /* */
-            };
+        subscribe(table, cb) {
+            return sync.collection(table).subscribe((rows) => cb(rows));
         },
         async close() {
-            /* */
+            await sync.stop();
         },
     };
 }
@@ -131,7 +167,7 @@ async function makeElectricProvider(config) {
         return (await res.json());
     }
     let auth = await mintToken();
-    let electricUrl = config.electricUrl ?? auth.electricUrl;
+    const electricUrl = config.electricUrl ?? auth.electricUrl;
     // Per-table subscription registry.
     const subscribers = new Map();
     // Token refresh — fire-and-forget background timer that mints a fresh

package/dist/publish/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/publish/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,SAAS,EAAE,UAAU,CAAC;IACtB,oDAAoD;IACpD,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,SAAS,CAAC;IACrB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,iBAAS,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CAK3D;AAED,iBAAS,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAKhD;AAED,iBAAS,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAO9C;AAED,6CAA6C;AAC7C,wBAAsB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlE;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAY7E;AAQD,qEAAqE;AACrE,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAE1E;AAED,yEAAyE;AACzE,wBAAsB,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAEzE;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAY7B;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,kBAAkB,EAC7B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BvD;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CASlD;AAGD,eAAO,MAAM,MAAM;;;;CAA+C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/publish/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,SAAS,EAAE,UAAU,CAAC;IACtB,oDAAoD;IACpD,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,SAAS,CAAC;IACrB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,iBAAS,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CAK3D;AAED,iBAAS,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAKhD;AAED,iBAAS,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAO9C;AAED,6CAA6C;AAC7C,wBAAsB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlE;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAY7E;AAQD,qEAAqE;AACrE,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAE1E;AAED,yEAAyE;AACzE,wBAAsB,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAEzE;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAa7B;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,kBAAkB,EAC7B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA+BvD;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CASlD;AAGD,eAAO,MAAM,MAAM;;;;CAA+C,CAAC"}

package/dist/publish/index.js

@@ -86,6 +86,7 @@ export async function signBundle(archive, keypair) {
     const bundleSha256 = await sha256Hex(archive);
     const key = await importPrivateKey(keypair.privateJwk);
     const dataBytes = new TextEncoder().encode(bundleSha256.toLowerCase());
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     const sigBuf = await crypto.subtle.sign({ name: 'Ed25519' }, key, dataBytes);
     return {
         algorithm: 'ed25519',
@@ -123,7 +124,11 @@ export async function verifyBundle(archive, signature, publicJwk) {
     }
     const key = await importPublicKey(publicJwk);
     const dataBytes = new TextEncoder().encode(signature.bundleSha256.toLowerCase());
-    const ok = await crypto.subtle.verify({ name: 'Ed25519' }, key, sigBytes, dataBytes);
+    const ok = await crypto.subtle.verify({ name: 'Ed25519' }, key, 
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
+    sigBytes, 
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
+    dataBytes);
     return ok ? { ok: true } : { ok: false, reason: 'Ed25519 verification failed' };
 }
 /**

package/dist/realtime.d.ts

@@ -1,3 +1,9 @@
+/**
+ * The engine closes a socket with this code when the session or API key it
+ * opened with is no longer valid (signed out, revoked, expired, user
+ * deactivated). Reconnecting is refused with 401, so clients stop instead.
+ */
+export declare const WS_UNAUTHORIZED = 4001;
 export declare class ZveltioRealtime {
     private ws;
     private listeners;
@@ -5,10 +11,21 @@ export declare class ZveltioRealtime {
     private reconnectAttempts;
     private maxReconnectAttempts;
     private reconnectTimer;
-    constructor(baseUrl: string);
+    private headers;
+    private unauthorizedCallbacks;
+    /**
+     * @param options.headers Sent with the upgrade — e.g. `{ 'X-API-Key': key }`
+     *   for a server-side client. Bun and Node (undici) accept them; a browser
+     *   cannot set headers on a WebSocket and authenticates by session cookie.
+     */
+    constructor(baseUrl: string, options?: {
+        headers?: Record<string, string>;
+    });
     connect(): void;
     private attemptReconnect;
     subscribe(collection: string, callback: (data: any) => void): () => void;
+    /** Called when the engine ends the socket because its credentials were revoked. */
+    onUnauthorized(callback: () => void): () => void;
     disconnect(): void;
 }
 //# sourceMappingURL=realtime.d.ts.map

package/dist/realtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"realtime.d.ts","sourceRoot":"","sources":["../src/realtime.ts"],"names":[],"mappings":"AAAA,qBAAa,eAAe;IAC1B,OAAO,CAAC,EAAE,CAA0B;IACpC,OAAO,CAAC,SAAS,CAAoD;IACrE,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,oBAAoB,CAAM;IAClC,OAAO,CAAC,cAAc,CAA8C;gBAExD,OAAO,EAAE,MAAM;IAK3B,OAAO,IAAI,IAAI;IAyCf,OAAO,CAAC,gBAAgB;IAQxB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,GAAG,MAAM,IAAI;IAqBxE,UAAU,IAAI,IAAI;CAQnB"}
+{"version":3,"file":"realtime.d.ts","sourceRoot":"","sources":["../src/realtime.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC,qBAAa,eAAe;IAC1B,OAAO,CAAC,EAAE,CAA0B;IAEpC,OAAO,CAAC,SAAS,CAAoD;IACrE,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,oBAAoB,CAAM;IAClC,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,qBAAqB,CAAyB;IAEtD;;;;OAIG;gBACS,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAO;IAM/E,OAAO,IAAI,IAAI;IAmDf,OAAO,CAAC,gBAAgB;IASxB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,GAAG,MAAM,IAAI;IAqBxE,mFAAmF;IACnF,cAAc,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAKhD,UAAU,IAAI,IAAI;CAQnB"}

package/dist/realtime.js

@@ -1,17 +1,36 @@
+/**
+ * The engine closes a socket with this code when the session or API key it
+ * opened with is no longer valid (signed out, revoked, expired, user
+ * deactivated). Reconnecting is refused with 401, so clients stop instead.
+ */
+export const WS_UNAUTHORIZED = 4001;
 export class ZveltioRealtime {
     ws = null;
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     listeners = new Map();
     baseUrl;
     reconnectAttempts = 0;
     maxReconnectAttempts = 10;
     reconnectTimer = null;
-    constructor(baseUrl) {
+    headers;
+    unauthorizedCallbacks = new Set();
+    /**
+     * @param options.headers Sent with the upgrade — e.g. `{ 'X-API-Key': key }`
+     *   for a server-side client. Bun and Node (undici) accept them; a browser
+     *   cannot set headers on a WebSocket and authenticates by session cookie.
+     */
+    constructor(baseUrl, options = {}) {
         // Convert http(s) to ws(s)
         this.baseUrl = baseUrl.replace(/^http/, 'ws');
+        this.headers = options.headers;
     }
     connect() {
         const wsUrl = `${this.baseUrl}/api/ws`;
-        this.ws = new WebSocket(wsUrl);
+        // The two-argument form with `{ headers }` is the Bun/undici extension; the
+        // standard constructor stays in use when there is nothing to send.
+        this.ws = this.headers
+            ? new WebSocket(wsUrl, { headers: this.headers })
+            : new WebSocket(wsUrl);
         this.ws.onopen = () => {
             this.reconnectAttempts = 0;
             // Re-subscribe to all existing collections using the server's expected protocol
@@ -40,7 +59,13 @@ export class ZveltioRealtime {
                 /* invalid JSON — ignore */
             }
         };
-        this.ws.onclose = () => {
+        this.ws.onclose = (event) => {
+            if (event?.code === WS_UNAUTHORIZED) {
+                // No retry: every attempt would be refused. `connect()` again once the
+                // app holds a valid session or key.
+                this.unauthorizedCallbacks.forEach((cb) => cb());
+                return;
+            }
             this.attemptReconnect();
         };
         this.ws.onerror = () => {
@@ -55,6 +80,7 @@ export class ZveltioRealtime {
         this.reconnectAttempts++;
         this.reconnectTimer = setTimeout(() => this.connect(), delay);
     }
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     subscribe(collection, callback) {
         if (!this.listeners.has(collection))
             this.listeners.set(collection, new Set());
@@ -74,6 +100,11 @@ export class ZveltioRealtime {
             }
         };
     }
+    /** Called when the engine ends the socket because its credentials were revoked. */
+    onUnauthorized(callback) {
+        this.unauthorizedCallbacks.add(callback);
+        return () => this.unauthorizedCallbacks.delete(callback);
+    }
     disconnect() {
         if (this.reconnectTimer)
             clearTimeout(this.reconnectTimer);

package/dist/rpc/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rpc/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAC3D,IAAI,EAAE,gBAAgB,GACrB,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAoB1B;AAID,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rpc/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;;;GAMG;AAGH,wBAAgB,eAAe,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAC3D,IAAI,EAAE,gBAAgB,GACrB,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAqB1B;AAID,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC"}

package/dist/rpc/index.js

@@ -38,9 +38,11 @@ import { hc } from 'hono/client';
  *               `ZveltioApi` from `@zveltio/engine/api-types`. For an
  *               extension's own routes, pass `typeof yourApp`.
  */
+// biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
 export function createRpcClient(opts) {
     const baseUrl = opts.baseUrl.replace(/\/$/, '');
     const includeCredentials = opts.includeCredentials !== false;
+    // biome-ignore lint/suspicious/noExplicitAny: legacy any; tracked in hardening plan item H-01
     const customFetch = (async (input, init) => {
         const dynHeaders = opts.getHeaders ? await opts.getHeaders() : {};
         const merged = new Headers(init?.headers ?? {});

package/dist/schema-codegen.d.ts

@@ -8,7 +8,9 @@
  * column names in editors and `tsc` catches typos.
  *
  * Scope intentionally narrow:
- *   - Handles `CREATE TABLE [IF NOT EXISTS]` and `ALTER TABLE … ADD COLUMN`.
+ *   - Reads only the UP half of each file (everything before `-- DOWN`).
+ *   - Handles `CREATE TABLE [IF NOT EXISTS]`, `ALTER TABLE … ADD COLUMN`
+ *     and `ALTER TABLE … DROP COLUMN`.
  *   - Maps the common Postgres types we see in extension migrations to TS.
  *   - Ignores constraint-only ALTER TABLE statements (PRIMARY KEY, FK).
  *   - Ignores CREATE INDEX, CREATE TYPE, CREATE FUNCTION, etc.

package/dist/schema-codegen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-codegen.d.ts","sourceRoot":"","sources":["../src/schema-codegen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAsMD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA+BtD;AA6BD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,CA+C7D;AAID,MAAM,WAAW,cAAc;IAC7B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,GAAE,cAAmB,GAAG,MAAM,CA0BtF"}
+{"version":3,"file":"schema-codegen.d.ts","sourceRoot":"","sources":["../src/schema-codegen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAoND;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA+BtD;AA6BD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,CAoE7D;AAID,MAAM,WAAW,cAAc;IAC7B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,GAAE,cAAmB,GAAG,MAAM,CA0BtF"}

package/dist/schema-codegen.js

@@ -8,7 +8,9 @@
  * column names in editors and `tsc` catches typos.
  *
  * Scope intentionally narrow:
- *   - Handles `CREATE TABLE [IF NOT EXISTS]` and `ALTER TABLE … ADD COLUMN`.
+ *   - Reads only the UP half of each file (everything before `-- DOWN`).
+ *   - Handles `CREATE TABLE [IF NOT EXISTS]`, `ALTER TABLE … ADD COLUMN`
+ *     and `ALTER TABLE … DROP COLUMN`.
  *   - Maps the common Postgres types we see in extension migrations to TS.
  *   - Ignores constraint-only ALTER TABLE statements (PRIMARY KEY, FK).
  *   - Ignores CREATE INDEX, CREATE TYPE, CREATE FUNCTION, etc.
@@ -90,6 +92,19 @@ function mapPgTypeToTs(pgType) {
     return isArray ? `${tsBase}[]` : tsBase;
 }
 // ─── SQL parsing ───────────────────────────────────────────────────────────
+/**
+ * Keep only the UP half of a migration file. Extension migrations carry their
+ * rollback in the same file, after a line that is exactly `-- DOWN`; the
+ * engine's runner (`parseMigrationSql`) splits on that marker and only ever
+ * executes the UP half. Codegen read both halves, so a `DROP TABLE` /
+ * `ADD COLUMN` written for rollback described the generated types as much as
+ * the real schema did. Same anchored regex as the runner — a loose `-- DOWN`
+ * prefix match once cost the engine half a schema.
+ */
+function upSection(sql) {
+    const i = sql.search(/^--\s*DOWN\s*$/im);
+    return i < 0 ? sql : sql.slice(0, i);
+}
 /**
  * Strip line comments (`-- …`) and block comments (`/* … * /`) so they don't
  * confuse the table/column regexes. Dollar-quoted blocks are preserved
@@ -301,13 +316,18 @@ export function parseSchema(sqlChunks) {
         }
         return tables.get(name);
     };
-    const allSql = sqlChunks.map(stripComments).join('\n');
+    const allSql = sqlChunks.map(upSection).map(stripComments).join('\n');
     // CREATE TABLE [IF NOT EXISTS] <name> ( <body> )
     const createRe = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))\s*\(/gi;
-    let m;
-    while ((m = createRe.exec(allSql)) !== null) {
+    for (const m of allSql.matchAll(createRe)) {
         const tableName = m[1] ?? m[2];
-        const openIdx = createRe.lastIndex - 1; // position of '('
+        // From the MATCH, not from the regex's `lastIndex`.
+        //
+        // `matchAll` clones the regex internally, so `createRe.lastIndex` stays 0
+        // here — it is only advanced by `exec`. Converting this loop from
+        // `while ((m = createRe.exec(...)))` and keeping `lastIndex` silently made
+        // every table body start at the top of the file; five tests caught it.
+        const openIdx = m.index + m[0].length - 1; // position of '('
         const closeIdx = findMatchingParen(allSql, openIdx);
         if (closeIdx < 0)
             continue; // unbalanced — skip
@@ -316,11 +336,10 @@ export function parseSchema(sqlChunks) {
         const tableCols = ensureTable(tableName);
         for (const c of columns)
             tableCols.set(c.name, c);
-        createRe.lastIndex = closeIdx + 1;
     }
     // ALTER TABLE <name> ADD COLUMN [IF NOT EXISTS] <col> <type> <rest>
     const alterRe = /ALTER\s+TABLE\s+(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))\s+ADD\s+COLUMN\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))\s+([^;]+?)(?=;|$)/gi;
-    while ((m = alterRe.exec(allSql)) !== null) {
+    for (const m of allSql.matchAll(alterRe)) {
         const tableName = m[1] ?? m[2];
         const colName = m[3] ?? m[4];
         const tail = m[5];
@@ -330,6 +349,21 @@ export function parseSchema(sqlChunks) {
             tableCols.set(col.name, col);
         }
     }
+    // ALTER TABLE <name> DROP COLUMN [IF EXISTS] <col>
+    //
+    // Run last, after every CREATE and ADD COLUMN: a column the migrations
+    // removed used to stay in the generated types, so `ctx.db` promised a
+    // column Postgres no longer has — the silent runtime failure this module
+    // exists to prevent.
+    //
+    // ponytail: a third pass, not an ordered walk of the statements. A column
+    // dropped and then re-added by a later migration would be lost; no
+    // extension does that today. Make the parser statement-ordered if one does.
+    const dropRe = /ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))\s+DROP\s+COLUMN\s+(?:IF\s+EXISTS\s+)?(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))/gi;
+    for (const m of allSql.matchAll(dropRe)) {
+        // Never `ensureTable` here — a DROP alone must not invent a table.
+        tables.get(m[1] ?? m[2])?.delete(m[3] ?? m[4]);
+    }
     return {
         tables: order.map((name) => ({ name, columns: [...tables.get(name).values()] })),
     };

package/dist/schema-watcher.d.ts

@@ -6,7 +6,7 @@
  * updated, or deleted.
  *
  * Usage (in `zveltio dev --watch`):
- *   import { watchSchema } from '@zveltio/sdk/schema-watcher';
+ *   import { watchSchema } from '@zveltio/sdk';
  *   await watchSchema('http://localhost:3000', './src/zveltio-types.d.ts');
  */
 export interface CollectionField {
@@ -20,8 +20,16 @@ export interface CollectionSchema {
     fields: CollectionField[];
 }
 export interface WatchSchemaOptions {
-    /** API token for the engine (admin key) */
+    /**
+     * A root-tenant API key holding the explicit scope
+     * `{ collection: '$schema', actions: ['read'] }` — a `*` scope does not include it.
+     */
     apiKey?: string;
+    /**
+     * Extra headers for the collections fetch and the socket upgrade — e.g. a
+     * `cookie` carrying the session of a user who may alter collections.
+     */
+    headers?: Record<string, string>;
     /** Reconnect delay in ms (default: 3000) */
     reconnectDelay?: number;
     /** Called after each successful type regeneration */

package/dist/schema-watcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-watcher.d.ts","sourceRoot":"","sources":["../src/schema-watcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,IAAI,CAAC;IACrD,kCAAkC;IAClC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;CAChC;AA0GD;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,MAAM,IAAI,CAAC,CAyErB;AAED,iDAAiD;AACjD,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAKf"}
+{"version":3,"file":"schema-watcher.d.ts","sourceRoot":"","sources":["../src/schema-watcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,4CAA4C;IAC5C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,IAAI,CAAC;IACrD,kCAAkC;IAClC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;CAChC;AA8GD;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,MAAM,IAAI,CAAC,CA4FrB;AAED,iDAAiD;AACjD,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/dist/schema-watcher.js

@@ -6,9 +6,10 @@
  * updated, or deleted.
  *
  * Usage (in `zveltio dev --watch`):
- *   import { watchSchema } from '@zveltio/sdk/schema-watcher';
+ *   import { watchSchema } from '@zveltio/sdk';
  *   await watchSchema('http://localhost:3000', './src/zveltio-types.d.ts');
  */
+import { WS_UNAUTHORIZED } from './realtime.js';
 const TYPE_MAP = {
     text: 'string',
     textarea: 'string',
@@ -81,8 +82,8 @@ function toPascalCase(str) {
         .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
         .join('');
 }
-async function fetchCollections(engineUrl, apiKey) {
-    const headers = { 'Content-Type': 'application/json' };
+async function fetchCollections(engineUrl, apiKey, extra) {
+    const headers = { 'Content-Type': 'application/json', ...extra };
     if (apiKey)
         headers['Authorization'] = `Bearer ${apiKey}`;
     const res = await fetch(`${engineUrl}/api/collections`, { headers });
@@ -108,10 +109,10 @@ async function writeTypes(outputPath, content) {
  * Returns a cleanup function that closes the WebSocket.
  */
 export async function watchSchema(engineUrl, outputPath, options = {}) {
-    const { apiKey, reconnectDelay = 3000, onUpdate, onError } = options;
+    const { apiKey, headers, reconnectDelay = 3000, onUpdate, onError } = options;
     // Generate initial types on startup
     try {
-        const collections = await fetchCollections(engineUrl, apiKey);
+        const collections = await fetchCollections(engineUrl, apiKey, headers);
         const content = generateTypesFile(collections);
         await writeTypes(outputPath, content);
         console.log(`[zveltio] ✓ Types generated at ${outputPath} (${collections.length} collections)`);
@@ -128,21 +129,34 @@ export async function watchSchema(engineUrl, outputPath, options = {}) {
     function connect() {
         if (stopped)
             return;
-        ws = new WebSocket(wsUrl);
+        // The key `fetchCollections` sends, on the upgrade too: without it the
+        // engine refuses the socket (401) and the watcher only ever reconnected.
+        // The two-argument form is the Bun/undici extension; a browser cannot set it.
+        const upgradeHeaders = { ...headers, ...(apiKey ? { 'X-API-Key': apiKey } : {}) };
+        ws =
+            Object.keys(upgradeHeaders).length > 0
+                ? new WebSocket(wsUrl, { headers: upgradeHeaders })
+                : new WebSocket(wsUrl);
         ws.onopen = () => {
             console.log('[zveltio] Schema watcher connected.');
-            // Subscribe to all schema change events
-            ws.send(JSON.stringify({ type: 'subscribe', channel: 'schema' }));
+            // The engine's schema channel: `$` cannot start a collection name, so it
+            // never collides with a collection's record events.
+            ws.send(JSON.stringify({ type: 'subscribe', channel: '$schema' }));
         };
         ws.onmessage = async (event) => {
             try {
                 const msg = JSON.parse(event.data);
+                // The subscribe was refused: this principal may not alter collections.
+                if (msg.type === 'error') {
+                    onError?.(new Error(`Schema watcher: ${msg.message ?? 'subscribe refused'}`));
+                    return;
+                }
                 const isSchemaChange = msg.event === 'schema:changed' ||
                     msg.type === 'schema:changed' ||
                     ['create_collection', 'drop_collection', 'add_field', 'drop_field'].includes(msg.event);
                 if (!isSchemaChange)
                     return;
-                const collections = await fetchCollections(engineUrl, apiKey);
+                const collections = await fetchCollections(engineUrl, apiKey, headers);
                 const content = generateTypesFile(collections);
                 await writeTypes(outputPath, content);
                 const changed = msg.collection ?? msg.data?.collection ?? '?';
@@ -153,7 +167,13 @@ export async function watchSchema(engineUrl, outputPath, options = {}) {
                 // Non-fatal: keep watching
             }
         };
-        ws.onclose = () => {
+        ws.onclose = (event) => {
+            if (!stopped && event?.code === WS_UNAUTHORIZED) {
+                // The API key was revoked or expired: every retry would be refused.
+                stopped = true;
+                onError?.(new Error('Schema watcher stopped: the engine revoked its credentials.'));
+                return;
+            }
             if (!stopped) {
                 console.log(`[zveltio] Schema watcher disconnected. Reconnecting in ${reconnectDelay}ms…`);
                 setTimeout(connect, reconnectDelay);