meridian-sdk 1.5.0 → 1.7.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # meridian-sdk
 
+## 1.7.0
+
+### Minor Changes
+
+- 664b1e4: Add E2E encryption, BFT signing, and cross-SDK feature parity.
+
+  - AES-GCM-256 envelope encryption and Ed25519 BFT signing in the TypeScript SDK
+  - New `packages/python/` — `meridian-crdt` Python package with full CRDT support (GCounter, PNCounter, LwwRegister, Presence), optional AES-GCM-256 encryption and Ed25519 signing, asyncio-native transport with auto-reconnect
+  - Rust client SDK (`meridian-client`): AES-GCM-256 encryption and Ed25519 BFT signing on LwwRegister and Presence handles (`--features crypto`), HTTP client for REST endpoints (`--features http`), auth token parsing and permission checks
+  - CRDT compactor background task for RGA and Tree tombstone cleanup
+
+## 1.6.0
+
+### Minor Changes
+
+- 0360ecc: Upgrade to TypeScript 6, Effect 3.21.4, and Biome 2.5.1. Fix Effect usage across all packages: `getHistory` now returns `Effect` instead of `Promise`, `parseToken` uses proper `yield* Effect.fail` and `Effect.try` patterns, WebSocket message decoding uses `runFork` instead of orphaned `runPromise`. Full type-safety pass for TypeScript 6 strictness (`Uint8Array<ArrayBuffer>`, `exactOptionalPropertyTypes`, DOM lib explicit).
+
 ## 1.5.0
 
 ### Minor Changes

package/README.md

@@ -83,6 +83,9 @@ await Effect.runPromise(
 | `namespace` | `string` | Namespace to connect to |
 | `token` | `string` | Meridian token |
 | `autoConnect` | `boolean?` | Open WebSocket immediately (default: `true`) |
+| `offline` | `boolean?` | Start without connecting — operate from cache, call `client.connect()` later |
+| `persistence` | `PersistenceConfig?` | Persist CRDT snapshots and the pending op queue across page loads |
+| `tabSync` | `boolean?` | Broadcast deltas to other tabs in the same namespace via `BroadcastChannel` |
 
 ### CRDT handles
 
@@ -203,6 +206,55 @@ unsubDelta();
 
 The queue holds up to 500 ops. If the limit is reached, the oldest op is dropped to make room for the newest.
 
+### Persistence (offline-first)
+
+Enable persistence to cache CRDT state across page loads and survive disconnections:
+
+```ts
+import {
+  MeridianClient,
+  indexedDbStateStorage,
+  localStorageSyncOpsAdapter,
+} from "meridian-sdk";
+
+const client = await Effect.runPromise(
+  MeridianClient.create({
+    url: "http://localhost:3000",
+    namespace: "my-room",
+    token,
+    persistence: {
+      state: indexedDbStateStorage(),      // CRDT snapshots → IndexedDB
+      ops:   localStorageSyncOpsAdapter(), // pending op queue → localStorage (sync, survives tab close)
+    },
+  })
+);
+
+const views = client.gcounter("gc:views");
+const cart  = client.orset("or:cart");
+await client.waitForRestore(); // wait for IndexedDB reads to complete
+
+console.log(views.value()); // populated from cache before the WebSocket connects
+```
+
+The pending op queue is also flushed when the tab becomes hidden (`visibilitychange`), covering most crash and background-kill scenarios.
+
+### Multi-tab sync
+
+Pass `tabSync: true` to broadcast CRDT deltas to other open tabs in the same origin and namespace via the [BroadcastChannel API](https://developer.mozilla.org/en-US/docs/Web/API/BroadcastChannel):
+
+```ts
+const client = await Effect.runPromise(
+  MeridianClient.create({
+    url: "http://localhost:3000",
+    namespace: "my-room",
+    token,
+    tabSync: true,
+  })
+);
+```
+
+When Tab A receives a delta from the server it immediately forwards it to Tab B — Tab B applies it without waiting for its own server round-trip. All CRDTs are convergent so applying the same delta twice is safe.
+
 ### Op latency
 
 `client.getLatencyStats()` returns P50 and P99 round-trip latency in milliseconds, computed from the last 128 acknowledged ops. Returns `null` if fewer than 2 samples have been collected.

package/dist/auth/permissions.d.ts

@@ -25,6 +25,7 @@ export declare const OpMasks: {
     readonly MAP_WRITE: 1;
 };
 export type OpMask = number;
+export declare function globMatch(pattern: string, value: string): boolean;
 /**
  * Check whether the token's permissions allow reading `crdtId`.
  *

package/dist/auth/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/auth/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAa,MAAM,cAAc,CAAC;AAE3D,eAAO,MAAM,OAAO;IAClB,yDAAyD;;;;;;;;;;;;;;;;CA8BjD,CAAC;AAEX,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC;AA4C5B;;;;;;;GAOG;AACH,wBAAgB,OAAO,CACrB,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,SAAa,GACjB,OAAO,CAOT;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CACtB,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,MAAoB,EAC5B,KAAK,SAAa,GACjB,OAAO,CAOT"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/auth/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAa,MAAM,cAAc,CAAC;AAE3D,eAAO,MAAM,OAAO;IAClB,yDAAyD;;;;;;;;;;;;;;;;CA8BjD,CAAC;AAEX,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC;AAE5B,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAcjE;AA4BD;;;;;;;GAOG;AACH,wBAAgB,OAAO,CACrB,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,SAAa,GACjB,OAAO,CAOT;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CACtB,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,MAAoB,EAC5B,KAAK,SAAa,GACjB,OAAO,CAOT"}

package/dist/auth/permissions.js

@@ -30,7 +30,7 @@ export const OpMasks = {
     // CRDTMap
     MAP_WRITE: 0b0000_0001,
 };
-function globMatch(pattern, value) {
+export function globMatch(pattern, value) {
     if (pattern === "*")
         return true;
     const starPos = pattern.indexOf("*");

package/dist/auth/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/auth/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,yDAAyD;IACzD,GAAG,EAAE,CAAC;IAEN,uBAAuB;IACvB,YAAY,EAAE,WAAW;IACzB,YAAY,EAAE,WAAW;IACzB,YAAY,EAAE,WAAW;IAEzB,QAAQ;IACR,MAAM,EAAK,WAAW;IACtB,SAAS,EAAE,WAAW;IAEtB,eAAe;IACf,OAAO,EAAE,WAAW;IAEpB,WAAW;IACX,eAAe,EAAE,WAAW;IAE5B,MAAM;IACN,UAAU,EAAE,WAAW;IACvB,UAAU,EAAE,WAAW;IAEvB,OAAO;IACP,QAAQ,EAAK,WAAW;IACxB,SAAS,EAAI,WAAW;IACxB,WAAW,EAAE,WAAW;IACxB,WAAW,EAAE,WAAW;IAExB,UAAU;IACV,SAAS,EAAE,WAAW;CACd,CAAC;AAIX,SAAS,SAAS,CAAC,OAAe,EAAE,KAAa;IAC/C,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,OAAO,KAAK,KAAK,CAAC;IAE7C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,MAAM,CAAC;AACvC,CAAC;AAED,SAAS,YAAY,CACnB,KAAgB,EAChB,MAAc,EACd,MAAc,EACd,KAAa,EACb,QAAgB;IAEhB,WAAW;IACX,IAAI,KAAK,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5D,gCAAgC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC5C,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAE9C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC;IACtC,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CACrB,WAAwB,EACxB,MAAc,EACd,QAAgB,EAChB,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAElB,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;QACvB,KAAK;QACL,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,KAAK;IACL,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CACtB,WAAwB,EACxB,MAAc,EACd,QAAgB,EAChB,SAAiB,OAAO,CAAC,GAAG,EAC5B,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAElB,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;QACvB,KAAK;QACL,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,KAAK;IACL,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/auth/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,yDAAyD;IACzD,GAAG,EAAE,CAAC;IAEN,uBAAuB;IACvB,YAAY,EAAE,WAAW;IACzB,YAAY,EAAE,WAAW;IACzB,YAAY,EAAE,WAAW;IAEzB,QAAQ;IACR,MAAM,EAAK,WAAW;IACtB,SAAS,EAAE,WAAW;IAEtB,eAAe;IACf,OAAO,EAAE,WAAW;IAEpB,WAAW;IACX,eAAe,EAAE,WAAW;IAE5B,MAAM;IACN,UAAU,EAAE,WAAW;IACvB,UAAU,EAAE,WAAW;IAEvB,OAAO;IACP,QAAQ,EAAK,WAAW;IACxB,SAAS,EAAI,WAAW;IACxB,WAAW,EAAE,WAAW;IACxB,WAAW,EAAE,WAAW;IAExB,UAAU;IACV,SAAS,EAAE,WAAW;CACd,CAAC;AAIX,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,KAAa;IACtD,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,OAAO,KAAK,KAAK,CAAC;IAE7C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,MAAM,CAAC;AACvC,CAAC;AAED,SAAS,YAAY,CACnB,KAAgB,EAChB,MAAc,EACd,MAAc,EACd,KAAa,EACb,QAAgB;IAEhB,WAAW;IACX,IAAI,KAAK,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5D,gCAAgC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC5C,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAE9C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC;IACtC,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CACrB,WAAwB,EACxB,MAAc,EACd,QAAgB,EAChB,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAElB,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;QACvB,KAAK;QACL,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,KAAK;IACL,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CACtB,WAAwB,EACxB,MAAc,EACd,QAAgB,EAChB,SAAiB,OAAO,CAAC,GAAG,EAC5B,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAElB,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;QACvB,KAAK;QACL,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,KAAK;IACL,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/dist/auth/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,eAAe,CA+BjF,CAAC;AAEL,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,WAAW,EACnB,cAAkB,KACjB,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAK9C,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAChC,OAAO,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,eAAe,GAAG,iBAAiB,CACP,CAAC;AAE3D,eAAO,MAAM,UAAU,GAAI,QAAQ,WAAW,EAAE,cAAkB,KAAG,MAC1C,CAAC"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,eAAe,CAwBjF,CAAC;AAEL,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,WAAW,EACnB,cAAkB,KACjB,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAK9C,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAChC,OAAO,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,eAAe,GAAG,iBAAiB,CACP,CAAC;AAE3D,eAAO,MAAM,UAAU,GAAI,QAAQ,WAAW,EAAE,cAAkB,KAAG,MAC1C,CAAC"}

package/dist/auth/token.js

@@ -6,26 +6,17 @@ import { TOKEN_SKEW_MS } from "../constants.js";
 export const parseToken = (token) => Effect.gen(function* () {
     const dotIndex = token.indexOf(".");
     if (dotIndex === -1) {
-        yield* Effect.fail(new TokenParseError({ message: "Invalid token format: missing '.'" }));
-        return undefined;
+        return yield* Effect.fail(new TokenParseError({ message: "Invalid token format: missing '.'" }));
     }
     const payloadB64 = token.slice(0, dotIndex);
-    let bytes;
-    try {
-        bytes = base64urlDecode(payloadB64);
-    }
-    catch {
-        yield* Effect.fail(new TokenParseError({ message: "Invalid token format: base64url decode failed" }));
-        return undefined;
-    }
-    let raw;
-    try {
-        raw = decode(bytes);
-    }
-    catch {
-        yield* Effect.fail(new TokenParseError({ message: "Invalid token format: msgpack decode failed" }));
-        return undefined;
-    }
+    const bytes = yield* Effect.try({
+        try: () => base64urlDecode(payloadB64),
+        catch: () => new TokenParseError({ message: "Invalid token format: base64url decode failed" }),
+    });
+    const raw = yield* Effect.try({
+        try: () => decode(bytes),
+        catch: () => new TokenParseError({ message: "Invalid token format: msgpack decode failed" }),
+    });
     return yield* Schema.decodeUnknown(TokenClaims)(raw).pipe(Effect.mapError((e) => new TokenParseError({ message: `Invalid token format: ${e.message}` })));
 });
 export const checkTokenExpiry = (claims, nowMs = Date.now()) => {

package/dist/auth/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAA+C,EAAE,CACvF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC,CAAC;QAC1F,OAAO,SAAkB,CAAC;IAC5B,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAE5C,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC,CAAC;QACtG,OAAO,SAAkB,CAAC;IAC5B,CAAC;IAED,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC,CAAC,CAAC;QACpG,OAAO,SAAkB,CAAC;IAC5B,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CACvD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CACpB,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACvE,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAAmB,EACnB,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAC6B,EAAE;IACjD,IAAI,KAAK,IAAI,MAAM,CAAC,UAAU,GAAG,aAAa,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,KAAa,EACoD,EAAE,CACnE,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAmB,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAAU,EAAE,CAC5E,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC;AAE5B,MAAM,eAAe,GAAG,CAAC,KAAa,EAAc,EAAE;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAA+C,EAAE,CACvF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAE5C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC9B,GAAG,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC;QACtC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;KAC/F,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;QACxB,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;KAC7F,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CACvD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CACpB,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACvE,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAAmB,EACnB,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAC6B,EAAE;IACjD,IAAI,KAAK,IAAI,MAAM,CAAC,UAAU,GAAG,aAAa,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,KAAa,EACoD,EAAE,CACnE,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAmB,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAAU,EAAE,CAC5E,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC;AAE5B,MAAM,eAAe,GAAG,CAAC,KAAa,EAAc,EAAE;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/dist/client.d.ts

@@ -105,6 +105,43 @@ export interface MeridianClientConfig {
     offline?: boolean;
     /** Persistence configuration for offline-first support. */
     persistence?: PersistenceConfig;
+    /**
+     * If `true`, broadcast CRDT deltas to other tabs in the same origin and namespace
+     * via `BroadcastChannel`. Other tabs with the same namespace apply updates instantly
+     * without a server round-trip. Safe to enable — re-applying a delta is idempotent.
+     */
+    tabSync?: boolean;
+    /**
+     * Client-side AES-256-GCM encryption keys, keyed by CRDT ID pattern (glob supported).
+     * Matching CRDTs encrypt their value fields before sending — the server stores and
+     * forwards ciphertext and never sees plaintext.
+     *
+     * Supported CRDT types: `LwwRegister`, `Presence`.
+     * Not supported: `GCounter`, `PNCounter`, `RGA` (numeric/structural merge requires plaintext).
+     *
+     * @example
+     * ```ts
+     * import { importAesGcmKey } from "meridian-sdk";
+     * const key = await importAesGcmKey(base64Key);
+     * MeridianClient.create({ ..., encryption: { "lw:profile": key, "pr:room-*": key2 } });
+     * ```
+     */
+    encryption?: Record<string, CryptoKey>;
+    /**
+     * If `true`, generate (or load from `localStorage`) a per-client Ed25519 keypair and
+     * sign every outgoing op before sending.
+     *
+     * The server verifies the signature against `client_pubkey` embedded in the token.
+     * This provides Byzantine fault tolerance in cluster mode: a compromised node cannot
+     * forge ops that appear to originate from legitimate clients.
+     *
+     * **Setup**: when issuing the token (via your app server), include `client_pubkey`
+     * (base64url-encoded 32-byte public key) in the token issuance request. Obtain the
+     * public key from `client.publicKeyBytes` after `create()` completes.
+     *
+     * Requires Chrome 113+, Firefox 130+, or Node.js 20+.
+     */
+    signing?: boolean;
 }
 /**
  * The main entry point for the Meridian real-time CRDT SDK.
@@ -138,6 +175,12 @@ export declare class MeridianClient {
     readonly claims: TokenClaims;
     private readonly transport;
     readonly http: HttpClient;
+    /**
+     * Raw 32-byte Ed25519 public key for this client, or `null` if `signing` is disabled.
+     * Pass this (base64url-encoded) to your app server when issuing tokens so the server
+     * can verify op signatures.
+     */
+    readonly publicKeyBytes: Uint8Array | null;
     private readonly gcHandles;
     private readonly pnHandles;
     private readonly orHandles;
@@ -156,6 +199,8 @@ export declare class MeridianClient {
     private readonly snapStore;
     private readonly opsStore;
     private readonly restorePromises;
+    private readonly tabSyncChannel;
+    private readonly encKeys;
     private constructor();
     /** Explicitly connect to the server. Use when `autoConnect: false` or `offline: true`. */
     connect(): void;
@@ -178,6 +223,7 @@ export declare class MeridianClient {
     private scheduleSnapRestore;
     private saveSnap;
     private readonly flushOpsToStorage;
+    private readonly onVisibilityChange;
     /**
      * Creates and validates a new `MeridianClient` from the supplied configuration.
      *
@@ -200,6 +246,8 @@ export declare class MeridianClient {
      * ```
      */
     static create(config: MeridianClientConfig): Effect.Effect<MeridianClient, TokenParseError | TokenExpiredError>;
+    private resolveEncKey;
+    private encryptFnFor;
     /**
      * Returns a handle for a grow-only counter (GCounter) CRDT.
      *
@@ -480,6 +528,12 @@ export declare class MeridianClient {
     private resubscribeLiveQueries;
     private notifyAnyChange;
     private handleServerMsg;
+    /**
+     * Apply a CRDT delta to the appropriate local handle.
+     * Called from the server message handler and from tab-sync broadcasts.
+     * When `broadcast` is true, the delta is forwarded to other tabs via BroadcastChannel.
+     */
+    private applyDelta;
     private notifyDelta;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAQ/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAW3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,KAAK,EAAa,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAItE,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC1C;AACD,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AACD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AACD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACtD;AACD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACpE;AACD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;CAC/B;AACD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,KAAK,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AACD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AACD,MAAM,MAAM,iBAAiB,GACzB,qBAAqB,GACrB,sBAAsB,GACtB,kBAAkB,GAClB,wBAAwB,GACxB,qBAAqB,GACrB,oBAAoB,GACpB,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAClE,4CAA4C;IAC5C,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAChC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,4HAA4H;IAC5H,GAAG,CAAC,EAAE,gBAAgB,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mGAAmG;IACnG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,cAAc;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAE7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;IACxC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAG1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsC;IAChE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2C;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiD;IAC3E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8C;IACxE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+C;IACzE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgC;IAC3D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;IAE7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0C;IACzE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IAGtD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGvB;IACL,OAAO,CAAC,gBAAgB,CAAK;IAG7B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuC;IAEpE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0B;IACnD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAE5D,OAAO;IAgDP,0FAA0F;IAC1F,OAAO,IAAI,IAAI;IAIf;;;;;;;;;;;;;;OAcG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAI/B,OAAO,CAAC,mBAAmB;IAY3B,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAShC;IAEF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,CAAC,MAAM,CACX,MAAM,EAAE,oBAAoB,GAC3B,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,eAAe,GAAG,iBAAiB,CAAC;IAMrE;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc;IAYxC;;;;;;;;;;;;;;;OAeG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe;IAY1C;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC;IAanE;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC;IAa/E;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC;IAazE;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa;IAYtC;;;;;;;;;;;;;;OAcG;IACH,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,aAAa,CAAA;KAAE,GAAG,SAAS;IAYpE;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,aAAa,CAAA;KAAE,GAAG,UAAU;IAYtE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,SAAS,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IASlF,gBAAgB,CAAC,SAAS,SAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,uEAAuE;IACvE,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED,mFAAmF;IACnF,eAAe,IAAI;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAIrE;;;OAGG;IACH,aAAa,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI;IAI7D;;;;;OAKG;IACH,UAAU,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI;IAK1D;;;;OAIG;IACH,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IAIpC;;;;OAIG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAK7C;;;;OAIG;IACH,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,MAAM,IAAI;IAK1D;;;OAGG;IACH,QAAQ,IAAI,cAAc;IA2B1B;;;;;;OAMG;IAEH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIhC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO;IAIlD,KAAK,IAAI,IAAI;IAgBb,mHAAmH;IACnH,MAAM,IAAI,IAAI;IAId;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAI5C;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,IAAI,EAAE,SAAS,GAAG,eAAe;IAkB3C,OAAO,CAAC,kBAAkB;IAmB1B,OAAO,CAAC,sBAAsB;IAM9B,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,eAAe;IAoFvB,OAAO,CAAC,WAAW;CAKpB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAS/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAW3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,KAAK,EAAa,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAMtE,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC1C;AACD,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AACD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AACD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACtD;AACD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACpE;AACD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;CAC/B;AACD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,KAAK,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AACD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AACD,MAAM,MAAM,iBAAiB,GACzB,qBAAqB,GACrB,sBAAsB,GACtB,kBAAkB,GAClB,wBAAwB,GACxB,qBAAqB,GACrB,oBAAoB,GACpB,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAClE,4CAA4C;IAC5C,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAChC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,4HAA4H;IAC5H,GAAG,CAAC,EAAE,gBAAgB,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mGAAmG;IACnG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,cAAc;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAE7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;IACxC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,UAAU,GAAG,IAAI,CAAC;IAG3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsC;IAChE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2C;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiD;IAC3E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8C;IACxE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+C;IACzE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgC;IAC3D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;IAE7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IACtD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0C;IACzE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;IAGtD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGvB;IACL,OAAO,CAAC,gBAAgB,CAAK;IAG7B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuC;IAEpE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0B;IACnD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAEzD,OAAO;IAiEP,0FAA0F;IAC1F,OAAO,IAAI,IAAI;IAIf;;;;;;;;;;;;;;OAcG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAI/B,OAAO,CAAC,mBAAmB;IAY3B,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAShC;IAEF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAIjC;IAEF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,CAAC,MAAM,CACX,MAAM,EAAE,oBAAoB,GAC3B,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,eAAe,GAAG,iBAAiB,CAAC;IAUrE,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,YAAY;IAKpB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc;IAYxC;;;;;;;;;;;;;;;OAeG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe;IAY1C;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC;IAanE;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC;IAc/E;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC;IAczE;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa;IAYtC;;;;;;;;;;;;;;OAcG;IACH,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,aAAa,CAAA;KAAE,GAAG,SAAS;IAYpE;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,aAAa,CAAA;KAAE,GAAG,UAAU;IAYtE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,SAAS,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IASlF,gBAAgB,CAAC,SAAS,SAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,uEAAuE;IACvE,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED,mFAAmF;IACnF,eAAe,IAAI;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAIrE;;;OAGG;IACH,aAAa,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI;IAI7D;;;;;OAKG;IACH,UAAU,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI;IAK1D;;;;OAIG;IACH,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IAIpC;;;;OAIG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAK7C;;;;OAIG;IACH,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,MAAM,IAAI;IAK1D;;;OAGG;IACH,QAAQ,IAAI,cAAc;IA2B1B;;;;;;OAMG;IAEH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIhC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO;IAIlD,KAAK,IAAI,IAAI;IAoBb,mHAAmH;IACnH,MAAM,IAAI,IAAI;IAId;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAI5C;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,IAAI,EAAE,SAAS,GAAG,eAAe;IAkB3C,OAAO,CAAC,kBAAkB;IAmB1B,OAAO,CAAC,sBAAsB;IAM9B,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,eAAe;IA8BvB;;;;OAIG;YACW,UAAU;IA6FxB,OAAO,CAAC,WAAW;CAKpB"}

package/dist/client.js

@@ -1,5 +1,6 @@
 import { Effect } from "effect";
 import { WsTransport } from "./transport/websocket.js";
+import { TabSync } from "./sync/tab-sync.js";
 import { snapshotFromHandle, snapshotToBytes, bytesToSnapshot, restoreSnapshotToHandle, } from "./persistence/snapshot.js";
 import { encode, decode } from "./codec.js";
 import { HttpClient } from "./transport/http.js";
@@ -14,7 +15,9 @@ import { RGAHandle } from "./crdt/rga.js";
 import { TreeHandle } from "./crdt/tree.js";
 import { decodeGCounterDelta, decodePNCounterDelta, decodeORSetDelta, decodeLwwDelta, decodePresenceDelta, decodeCRDTMapDelta, decodeRGADelta, decodeTreeDelta, } from "./sync/delta.js";
 import { parseAndValidateToken } from "./auth/token.js";
-import { canRead as evalCanRead, canWrite as evalCanWrite } from "./auth/permissions.js";
+import { canRead as evalCanRead, canWrite as evalCanWrite, globMatch } from "./auth/permissions.js";
+import { encryptJson, decryptJson, isEncryptedValue } from "./crypto/aes-gcm.js";
+import { signOp, loadOrGenerateKeypair } from "./crypto/ed25519.js";
 /**
  * The main entry point for the Meridian real-time CRDT SDK.
  *
@@ -47,6 +50,12 @@ export class MeridianClient {
     claims;
     transport;
     http;
+    /**
+     * Raw 32-byte Ed25519 public key for this client, or `null` if `signing` is disabled.
+     * Pass this (base64url-encoded) to your app server when issuing tokens so the server
+     * can verify op signatures.
+     */
+    publicKeyBytes;
     // HACK: Generic params are erased at storage level; factories restore them via typed get+cast on retrieval.
     gcHandles = new Map();
     pnHandles = new Map();
@@ -68,10 +77,14 @@ export class MeridianClient {
     snapStore;
     opsStore;
     restorePromises = new Set();
-    constructor(config, claims) {
+    tabSyncChannel;
+    encKeys;
+    constructor(config, claims, keypair) {
         this.namespace = config.namespace;
         this.claims = claims;
         this.clientId = claims.client_id;
+        this.publicKeyBytes = keypair?.publicKeyBytes ?? null;
+        this.encKeys = new Map(Object.entries(config.encryption ?? {}));
         this.snapStore = config.persistence?.state ?? null;
         this.opsStore = config.persistence?.ops ?? null;
         const httpBase = config.url
@@ -83,7 +96,16 @@ export class MeridianClient {
             url: wsUrl,
             token: config.token,
             onMessage: (msg) => { this.handleServerMsg(msg); },
+            ...(keypair !== null && { signFn: (opBytes) => signOp(keypair.privateKey, opBytes) }),
         });
+        this.tabSyncChannel = (config.tabSync === true && typeof BroadcastChannel !== "undefined")
+            ? new TabSync(config.namespace)
+            : null;
+        if (this.tabSyncChannel !== null) {
+            this.tabSyncChannel.onDelta(({ crdtId, deltaBytes }) => {
+                void this.applyDelta(crdtId, deltaBytes, false);
+            });
+        }
         // Restore persisted op queue before connecting.
         if (this.opsStore !== null) {
             const bytes = this.opsStore.load(`ops:${this.namespace}`);
@@ -98,6 +120,10 @@ export class MeridianClient {
                 this.opsStore.delete(`ops:${this.namespace}`);
             }
             globalThis.addEventListener("beforeunload", this.flushOpsToStorage);
+            // Flush when tab is hidden (covers most crash/kill scenarios without IDB complexity).
+            if (typeof document !== "undefined") {
+                document.addEventListener("visibilitychange", this.onVisibilityChange);
+            }
         }
         if (config.autoConnect !== false && config.offline !== true) {
             this.transport.connect();
@@ -161,6 +187,11 @@ export class MeridianClient {
         }
         this.opsStore.save(key, encode(msgs));
     };
+    onVisibilityChange = () => {
+        if (typeof document !== "undefined" && document.visibilityState === "hidden") {
+            this.flushOpsToStorage();
+        }
+    };
     /**
      * Creates and validates a new `MeridianClient` from the supplied configuration.
      *
@@ -183,7 +214,26 @@ export class MeridianClient {
      * ```
      */
     static create(config) {
-        return parseAndValidateToken(config.token).pipe(Effect.map((claims) => new MeridianClient(config, claims)));
+        return Effect.gen(function* () {
+            const claims = yield* parseAndValidateToken(config.token);
+            const keypair = config.signing === true
+                ? yield* Effect.promise(() => loadOrGenerateKeypair())
+                : null;
+            return new MeridianClient(config, claims, keypair);
+        });
+    }
+    resolveEncKey(crdtId) {
+        if (this.encKeys.size === 0)
+            return null;
+        for (const [pattern, key] of this.encKeys) {
+            if (globMatch(pattern, crdtId))
+                return key;
+        }
+        return null;
+    }
+    encryptFnFor(crdtId) {
+        const key = this.resolveEncKey(crdtId);
+        return key !== null ? (v) => encryptJson(key, v) : undefined;
     }
     /**
      * Returns a handle for a grow-only counter (GCounter) CRDT.
@@ -289,7 +339,8 @@ export class MeridianClient {
     lwwregister(crdtId, schema) {
         let handle = this.lwHandles.get(crdtId);
         if (!handle) {
-            const base = { ns: this.namespace, crdtId, clientId: this.clientId, transport: this.transport };
+            const encryptFn = this.encryptFnFor(crdtId);
+            const base = { ns: this.namespace, crdtId, clientId: this.clientId, transport: this.transport, ...(encryptFn !== undefined && { encryptFn }) };
             handle = schema ? new LwwRegisterHandle({ ...base, schema }) : new LwwRegisterHandle(base);
             this.lwHandles.set(crdtId, handle);
             this.transport.subscribe(crdtId);
@@ -320,7 +371,8 @@ export class MeridianClient {
     presence(crdtId, schema) {
         let handle = this.prHandles.get(crdtId);
         if (!handle) {
-            const base = { ns: this.namespace, crdtId, clientId: this.clientId, transport: this.transport };
+            const encryptFn = this.encryptFnFor(crdtId);
+            const base = { ns: this.namespace, crdtId, clientId: this.clientId, transport: this.transport, ...(encryptFn !== undefined && { encryptFn }) };
             handle = schema ? new PresenceHandle({ ...base, schema }) : new PresenceHandle(base);
             this.prHandles.set(crdtId, handle);
             this.transport.subscribe(crdtId);
@@ -570,7 +622,11 @@ export class MeridianClient {
         this.flushOpsToStorage();
         if (this.opsStore !== null) {
             globalThis.removeEventListener("beforeunload", this.flushOpsToStorage);
+            if (typeof document !== "undefined") {
+                document.removeEventListener("visibilitychange", this.onVisibilityChange);
+            }
         }
+        this.tabSyncChannel?.close();
         for (const unsub of this.handleUnsubs)
             unsub();
         this.handleUnsubs.length = 0;
@@ -678,87 +734,136 @@ export class MeridianClient {
             }
             return;
         }
-        if (!("Delta" in msg))
-            return;
-        const { crdt_id, delta_bytes } = msg.Delta;
-        const gcHandle = this.gcHandles.get(crdt_id);
+        if ("Delta" in msg) {
+            const { crdt_id, delta_bytes } = msg.Delta;
+            void this.applyDelta(crdt_id, delta_bytes, true);
+        }
+    }
+    /**
+     * Apply a CRDT delta to the appropriate local handle.
+     * Called from the server message handler and from tab-sync broadcasts.
+     * When `broadcast` is true, the delta is forwarded to other tabs via BroadcastChannel.
+     */
+    async applyDelta(crdtId, deltaBytes, broadcast) {
+        const gcHandle = this.gcHandles.get(crdtId);
         if (gcHandle) {
             try {
-                gcHandle.applyDelta(decodeGCounterDelta(delta_bytes));
+                gcHandle.applyDelta(decodeGCounterDelta(deltaBytes));
             }
             catch { /* stale */ }
-            this.saveSnap(`snap:gc:${this.namespace}:${this.clientId}:${crdt_id}`, gcHandle);
-            this.notifyDelta(crdt_id, "gcounter");
+            this.saveSnap(`snap:gc:${this.namespace}:${this.clientId}:${crdtId}`, gcHandle);
+            this.notifyDelta(crdtId, "gcounter");
+            if (broadcast)
+                this.tabSyncChannel?.broadcast(crdtId, deltaBytes);
             return;
         }
-        const pnHandle = this.pnHandles.get(crdt_id);
+        const pnHandle = this.pnHandles.get(crdtId);
         if (pnHandle) {
             try {
-                pnHandle.applyDelta(decodePNCounterDelta(delta_bytes));
+                pnHandle.applyDelta(decodePNCounterDelta(deltaBytes));
             }
             catch { /* stale */ }
-            this.saveSnap(`snap:pn:${this.namespace}:${this.clientId}:${crdt_id}`, pnHandle);
-            this.notifyDelta(crdt_id, "pncounter");
+            this.saveSnap(`snap:pn:${this.namespace}:${this.clientId}:${crdtId}`, pnHandle);
+            this.notifyDelta(crdtId, "pncounter");
+            if (broadcast)
+                this.tabSyncChannel?.broadcast(crdtId, deltaBytes);
             return;
         }
-        const orHandle = this.orHandles.get(crdt_id);
+        const orHandle = this.orHandles.get(crdtId);
         if (orHandle) {
             try {
-                orHandle.applyDelta(decodeORSetDelta(delta_bytes));
+                orHandle.applyDelta(decodeORSetDelta(deltaBytes));
             }
             catch { /* stale */ }
-            this.saveSnap(`snap:or:${this.namespace}:${this.clientId}:${crdt_id}`, orHandle);
-            this.notifyDelta(crdt_id, "orset");
+            this.saveSnap(`snap:or:${this.namespace}:${this.clientId}:${crdtId}`, orHandle);
+            this.notifyDelta(crdtId, "orset");
+            if (broadcast)
+                this.tabSyncChannel?.broadcast(crdtId, deltaBytes);
             return;
         }
-        const lwHandle = this.lwHandles.get(crdt_id);
+        const lwHandle = this.lwHandles.get(crdtId);
         if (lwHandle) {
             try {
-                lwHandle.applyDelta(decodeLwwDelta(delta_bytes));
+                let delta = decodeLwwDelta(deltaBytes);
+                if (delta.entry !== null && isEncryptedValue(delta.entry.value)) {
+                    const key = this.resolveEncKey(crdtId);
+                    if (key !== null) {
+                        const plain = await decryptJson(key, delta.entry.value);
+                        delta = { entry: { ...delta.entry, value: plain } };
+                    }
+                }
+                lwHandle.applyDelta(delta);
             }
-            catch { /* stale */ }
-            this.saveSnap(`snap:lw:${this.namespace}:${this.clientId}:${crdt_id}`, lwHandle);
-            this.notifyDelta(crdt_id, "lwwregister");
+            catch { /* stale or decrypt failure */ }
+            this.saveSnap(`snap:lw:${this.namespace}:${this.clientId}:${crdtId}`, lwHandle);
+            this.notifyDelta(crdtId, "lwwregister");
+            if (broadcast)
+                this.tabSyncChannel?.broadcast(crdtId, deltaBytes);
             return;
         }
-        const prHandle = this.prHandles.get(crdt_id);
+        const prHandle = this.prHandles.get(crdtId);
         if (prHandle) {
             try {
-                prHandle.applyDelta(decodePresenceDelta(delta_bytes));
+                const delta = decodePresenceDelta(deltaBytes);
+                const key = this.resolveEncKey(crdtId);
+                if (key !== null) {
+                    const decrypted = {};
+                    for (const [clientIdStr, entry] of Object.entries(delta.changes)) {
+                        if (entry !== null && isEncryptedValue(entry.data)) {
+                            const plain = await decryptJson(key, entry.data);
+                            decrypted[clientIdStr] = { ...entry, data: plain };
+                        }
+                        else {
+                            decrypted[clientIdStr] = entry;
+                        }
+                    }
+                    prHandle.applyDelta({ changes: decrypted });
+                }
+                else {
+                    prHandle.applyDelta(delta);
+                }
             }
-            catch { /* stale */ }
-            this.saveSnap(`snap:pr:${this.namespace}:${this.clientId}:${crdt_id}`, prHandle);
-            this.notifyDelta(crdt_id, "presence");
+            catch { /* stale or decrypt failure */ }
+            this.saveSnap(`snap:pr:${this.namespace}:${this.clientId}:${crdtId}`, prHandle);
+            this.notifyDelta(crdtId, "presence");
+            if (broadcast)
+                this.tabSyncChannel?.broadcast(crdtId, deltaBytes);
             return;
         }
-        const cmHandle = this.cmHandles.get(crdt_id);
+        const cmHandle = this.cmHandles.get(crdtId);
         if (cmHandle) {
             try {
-                cmHandle.applyDelta(decodeCRDTMapDelta(delta_bytes));
+                cmHandle.applyDelta(decodeCRDTMapDelta(deltaBytes));
             }
             catch { /* stale */ }
-            this.saveSnap(`snap:cm:${this.namespace}:${this.clientId}:${crdt_id}`, cmHandle);
-            this.notifyDelta(crdt_id, "crdtmap");
+            this.saveSnap(`snap:cm:${this.namespace}:${this.clientId}:${crdtId}`, cmHandle);
+            this.notifyDelta(crdtId, "crdtmap");
+            if (broadcast)
+                this.tabSyncChannel?.broadcast(crdtId, deltaBytes);
             return;
         }
-        const rgaHandle = this.rgaHandles.get(crdt_id);
+        const rgaHandle = this.rgaHandles.get(crdtId);
         if (rgaHandle) {
             try {
-                rgaHandle.applyDelta(decodeRGADelta(delta_bytes));
+                rgaHandle.applyDelta(decodeRGADelta(deltaBytes));
             }
             catch { /* stale */ }
-            this.saveSnap(`snap:rg:${this.namespace}:${this.clientId}:${crdt_id}`, rgaHandle);
-            this.notifyDelta(crdt_id, "rga");
+            this.saveSnap(`snap:rg:${this.namespace}:${this.clientId}:${crdtId}`, rgaHandle);
+            this.notifyDelta(crdtId, "rga");
+            if (broadcast)
+                this.tabSyncChannel?.broadcast(crdtId, deltaBytes);
             return;
         }
-        const treeHandle = this.treeHandles.get(crdt_id);
+        const treeHandle = this.treeHandles.get(crdtId);
         if (treeHandle) {
             try {
-                treeHandle.applyDelta(decodeTreeDelta(delta_bytes));
+                treeHandle.applyDelta(decodeTreeDelta(deltaBytes));
             }
             catch { /* stale */ }
-            this.saveSnap(`snap:tr:${this.namespace}:${this.clientId}:${crdt_id}`, treeHandle);
-            this.notifyDelta(crdt_id, "tree");
+            this.saveSnap(`snap:tr:${this.namespace}:${this.clientId}:${crdtId}`, treeHandle);
+            this.notifyDelta(crdtId, "tree");
+            if (broadcast)
+                this.tabSyncChannel?.broadcast(crdtId, deltaBytes);
         }
     }
     notifyDelta(crdtId, type) {