mnfst 0.5.222 → 0.5.224

package/lib/manifest.appwrite.auth.js

@@ -218,6 +218,32 @@ function initializeAuthStore() {
 
     // Cross-tab synchronization using localStorage events
     const STORAGE_KEY = 'manifest:auth:state';
+    // Cap on holding scoped data for a guest/callback sign-in that may fail
+    const SIGN_IN_PENDING_MS = 5000;
+    ['manifest:auth:login', 'manifest:auth:anonymous', 'manifest:auth:logout', 'manifest:auth:session-cleared'].forEach(type =>
+        window.addEventListener(type, () => { const store = Alpine.store('auth'); if (store) { store._signInPendingUntil = 0; store._authEpoch++; markVerified(store); } }));
+
+    // Unverified session: recheck on reconnect, on return to the tab, and on a bounded backoff
+    const RECHECK_DELAYS_MS = [2000, 5000, 15000, 60000];
+    const recheck = () => { Alpine.store('auth')?._recheckSession?.(); };
+    window.addEventListener('online', recheck);
+    if (typeof document !== 'undefined') document.addEventListener('visibilitychange', () => { if (document.visibilityState === 'visible') recheck(); });
+
+    function markVerified(store) {
+        store._sessionUnverified = false;
+        store._recheckAttempt = 0;
+        if (store._recheckTimer) { clearTimeout(store._recheckTimer); store._recheckTimer = null; }
+    }
+
+    function scheduleRecheck(store) {
+        if (!store._sessionUnverified || store._recheckTimer) return;
+        const delay = RECHECK_DELAYS_MS[Math.min(store._recheckAttempt++, RECHECK_DELAYS_MS.length - 1)];
+        store._recheckTimer = setTimeout(() => { store._recheckTimer = null; store._recheckSession(); }, delay);
+    }
+
+    // Appwrite's "no session" answer; anything else (offline, 5xx) leaves the session unknown
+    const NO_SESSION_TYPES = ['general_unauthorized_scope', 'user_unauthorized', 'user_session_not_found', 'user_jwt_invalid', 'user_not_found', 'user_blocked'];
+    const isNoSession = error => error?.code === 401 || NO_SESSION_TYPES.includes(error?.type);
 
     // Session fields safe to mirror across tabs. Excludes `secret` and provider
     // tokens — this copy is only for UI cross-tab sync, not the auth of record.
@@ -243,7 +269,10 @@ function initializeAuthStore() {
                 const state = JSON.parse(e.newValue);
                 const store = Alpine.store('auth');
                 if (store) {
+                    const prevId = store.user?.$id || null;
                     // Update store state from other tab
+                    store._authEpoch++;
+                    if (state.isAuthenticated) markVerified(store);
                     store.isAuthenticated = state.isAuthenticated;
                     store.isAnonymous = state.isAnonymous;
                     store.user = state.user;
@@ -253,6 +282,15 @@ function initializeAuthStore() {
                     store.otpSent = state.otpSent || false;
                     store.otpExpired = state.otpExpired || false;
                     store.error = state.error;
+                    // Identity ended or changed in another tab: scoped data must drop this tab's rows
+                    const nextId = state.isAuthenticated ? (state.user?.$id || null) : null;
+                    if (prevId && nextId !== prevId) {
+                        if (!nextId) {
+                            store.teams = [];
+                            store.currentTeam = null;
+                        }
+                        window.dispatchEvent(new CustomEvent('manifest:auth:session-cleared'));
+                    }
                 }
             } catch (error) {
                 // Failed to sync state from other tab
@@ -262,6 +300,8 @@ function initializeAuthStore() {
 
     // Helper to sync state to localStorage (for cross-tab communication)
     function syncStateToStorage(store) {
+        // An unverified signed-out state must not sign other tabs out
+        if (store._sessionUnverified && !store.isAuthenticated) return;
         try {
             const state = {
                 isAuthenticated: store.isAuthenticated,
@@ -340,6 +380,11 @@ function initializeAuthStore() {
         _appwrite: null,
         _guestAuto: false,
         _guestManual: false,
+        _signInPendingUntil: 0, // signed-out init with guest-auto or an auth callback still to sign in
+        _sessionUnverified: false, // init could not reach Appwrite: signed out locally, never broadcast
+        _authEpoch: 0, // bumped by every identity change; an in-flight recheck from an older epoch is dropped
+        _recheckTimer: null,
+        _recheckAttempt: 0,
         guestManualEnabled: false,
         _oauthProvider: null, // Store OAuth provider name (google, github, etc.) when login is initiated
         _syncStateToStorage: syncStateToStorage,
@@ -545,57 +590,18 @@ function initializeAuthStore() {
 
                 // Try to restore existing session
                 try {
-                    this.user = await appwrite.account.get();
-                    const sessionsResponse = await appwrite.account.listSessions();
-                    const allSessions = sessionsResponse.sessions || [];
-                    const currentSession = allSessions.find(s => s.current === true) || allSessions[0];
-
-                    if (currentSession) {
-                        this.session = currentSession;
-                        this.isAuthenticated = true;
-                        this.isAnonymous = currentSession.provider === 'anonymous';
-
-                        // Restore OAuth provider from storage (persists across redirects/refresh)
-                        if (!this.isAnonymous && currentSession.provider !== 'magic-url') {
-                            try {
-                                // Try localStorage first (persists across redirects), fallback to sessionStorage
-                                let storedProvider = localStorage.getItem('manifest:oauth:provider');
-                                if (!storedProvider) {
-                                    storedProvider = sessionStorage.getItem('manifest:oauth:provider');
-                                }
-                                if (storedProvider) {
-                                    this._oauthProvider = storedProvider;
-                                }
-                            } catch (e) {
-                                // Storage error
-                            }
-                        }
-
-                        // If guest is disabled but we have anonymous session, clear it
-                        if (this.isAnonymous && !this._guestAuto && !this._guestManual) {
-                            try {
-                                await appwrite.account.deleteSession(this.session.$id);
-                                this.isAuthenticated = false;
-                                this.isAnonymous = false;
-                                this.user = null;
-                                this.session = null;
-                            } catch (deleteError) {
-                                // Failed to delete guest session
-                            }
-                        }
-                    } else {
-                        this.isAuthenticated = true; // User exists, session might be managed by cookies
-                        this.isAnonymous = false;
-                    }
+                    await this._restoreSession(appwrite);
 
                     // Team loading is deferred (not awaited) — runs in the background after
                     // manifest:auth:initialized so a session gate isn't held up by it.
                 } catch (error) {
-                    // No existing session - this is expected
-                    this.isAuthenticated = false;
-                    this.isAnonymous = false;
-                    this.user = null;
-                    this.session = null;
+                    this._clearIdentity();
+                    // Signed out for now; other tabs keep their session
+                    if (!isNoSession(error)) {
+                        this._sessionUnverified = true;
+                        scheduleRecheck(this);
+                        console.warn('[Manifest Appwrite Auth] Session check failed (signed out until reachable):', error?.message || error);
+                    }
                 }
 
                 // Sync state to localStorage
@@ -611,6 +617,17 @@ function initializeAuthStore() {
                 this._initialized = true;
                 this._initializing = false;
 
+                // Guest-auto / callback sign-in follows: scoped data holds instead of flashing signed-out
+                if (!this.isAuthenticated) {
+                    let callback = false;
+                    try {
+                        // Team invites need an existing session (acceptInvite refuses signed-out), so they don't sign in
+                        const info = window.ManifestAppwriteAuthCallbacks?.detect?.();
+                        callback = !!(info?.hasCallback && !info.isTeamInvite);
+                    } catch (e) { /* no-op */ }
+                    if (this._guestAuto || callback) this._signInPendingUntil = Date.now() + SIGN_IN_PENDING_MS;
+                }
+
                 // Fire as soon as identity is known, before teams load, so a session
                 // gate / splash clears in a few hundred ms.
                 window.dispatchEvent(new CustomEvent('manifest:auth:initialized', {
@@ -633,6 +650,95 @@ function initializeAuthStore() {
             }
         },
 
+        // Adopt the session Appwrite reports (throws when there is none or it is unreachable)
+        async _restoreSession(appwrite, isCurrent = () => true) {
+            const user = await appwrite.account.get();
+            const sessionsResponse = await appwrite.account.listSessions();
+            if (!isCurrent()) return false;
+            this.user = user;
+            const allSessions = sessionsResponse.sessions || [];
+            const currentSession = allSessions.find(s => s.current === true) || allSessions[0];
+
+            if (currentSession) {
+                this.session = currentSession;
+                this.isAuthenticated = true;
+                this.isAnonymous = currentSession.provider === 'anonymous';
+
+                // Restore OAuth provider from storage (persists across redirects/refresh)
+                if (!this.isAnonymous && currentSession.provider !== 'magic-url') {
+                    try {
+                        // Try localStorage first (persists across redirects), fallback to sessionStorage
+                        let storedProvider = localStorage.getItem('manifest:oauth:provider');
+                        if (!storedProvider) {
+                            storedProvider = sessionStorage.getItem('manifest:oauth:provider');
+                        }
+                        if (storedProvider) {
+                            this._oauthProvider = storedProvider;
+                        }
+                    } catch (e) {
+                        // Storage error
+                    }
+                }
+
+                // If guest is disabled but we have anonymous session, clear it
+                if (this.isAnonymous && !this._guestAuto && !this._guestManual) {
+                    try {
+                        await appwrite.account.deleteSession(this.session.$id);
+                        this.isAuthenticated = false;
+                        this.isAnonymous = false;
+                        this.user = null;
+                        this.session = null;
+                    } catch (deleteError) {
+                        // Failed to delete guest session
+                    }
+                }
+            } else {
+                this.isAuthenticated = true; // User exists, session might be managed by cookies
+                this.isAnonymous = false;
+            }
+            return true;
+        },
+
+        // Offline-booted tab: re-run the session check once Appwrite is reachable
+        async _recheckSession() {
+            if (!this._sessionUnverified || this._rechecking || !this._appwrite) return;
+            if (this._recheckTimer) { clearTimeout(this._recheckTimer); this._recheckTimer = null; }
+            this._rechecking = true;
+            const epoch = this._authEpoch;
+            const current = () => this._authEpoch === epoch && this._sessionUnverified && !this.isAuthenticated;
+            try {
+                if (!await this._restoreSession(this._appwrite, current)) return;
+            } catch (error) {
+                if (!current()) return;
+                if (!isNoSession(error)) { scheduleRecheck(this); return; }
+                this._clearIdentity();
+                markVerified(this);
+                syncStateToStorage(this);
+                if (this._guestAuto && this._createAnonymousSession) await this._createAnonymousSession();
+                return;
+            } finally {
+                this._rechecking = false;
+            }
+            markVerified(this);
+            const cfg = await config.getAppwriteConfig();
+            if (this._authEpoch !== epoch) return;
+            if (this.isAuthenticated && cfg?.teams && (!this.isAnonymous || cfg.guestTeams)) {
+                try { await this._loadTeamsAndSeed(cfg); } catch (e) { console.warn('[Manifest Appwrite Auth] Team load failed:', e?.message || e); }
+                if (this._authEpoch !== epoch) return;
+            }
+            syncStateToStorage(this);
+            if (this.isAuthenticated) {
+                window.dispatchEvent(new CustomEvent(this.isAnonymous ? 'manifest:auth:anonymous' : 'manifest:auth:login', { detail: { user: this.user } }));
+            }
+        },
+
+        _clearIdentity() {
+            this.isAuthenticated = false;
+            this.isAnonymous = false;
+            this.user = null;
+            this.session = null;
+        },
+
         // Clear team state when the identity changes to a different user (e.g. guest
         // replaced on OTP sign-in). Otherwise stale currentTeam/teams cause 404s.
         _resetTeamsState() {
@@ -804,6 +910,8 @@ function initializeAuthStore() {
                 return { success: true };
             }
 
+            this._authEpoch++;
+            markVerified(this);
             this.inProgress = true;
 
             try {
@@ -847,15 +955,12 @@ function initializeAuthStore() {
 
                 // Restore to guest state after logout (guest-auto only, and not when
                 // already a guest — don't mint a new guest on top).
+                let restored = false;
                 if (!this.isAnonymous && this._guestAuto && this._createAnonymousSession) {
                     await this._createAnonymousSession();
-                } else {
-                    // Clear auth state completely
-                    this.isAuthenticated = false;
-                    this.isAnonymous = false;
-                    this.user = null;
-                    this.session = null;
+                    restored = this.isAuthenticated && this.isAnonymous;
                 }
+                if (!restored) this._clearIdentity();
 
                 syncStateToStorage(this);
                 window.dispatchEvent(new CustomEvent('manifest:auth:logout'));
@@ -893,6 +998,10 @@ function initializeAuthStore() {
                 // Clear teams on logout error too
                 this.teams = [];
                 this.currentTeam = null;
+                if (!this.isAuthenticated) this._clearIdentity();
+                // Expired session (401) is still a logout: scoped data must drop the old rows
+                syncStateToStorage(this);
+                window.dispatchEvent(new CustomEvent('manifest:auth:logout'));
                 return { success: false, error: error.message };
             } finally {
                 this.inProgress = false;
@@ -905,6 +1014,8 @@ function initializeAuthStore() {
                 return { success: false, error: 'Appwrite not configured' };
             }
 
+            this._authEpoch++;
+            markVerified(this);
             this.inProgress = true;
 
             try {
@@ -944,6 +1055,10 @@ function initializeAuthStore() {
                 this.session = null;
                 this.magicLinkSent = false;
                 this.magicLinkExpired = false;
+                this.teams = [];
+                this.currentTeam = null;
+                syncStateToStorage(this);
+                window.dispatchEvent(new CustomEvent('manifest:auth:session-cleared'));
                 return { success: false, error: error.message };
             } finally {
                 this.inProgress = false;
@@ -958,10 +1073,12 @@ function initializeAuthStore() {
 
             try {
                 this.user = await this._appwrite.account.get();
+                if (this.isAuthenticated) markVerified(this);
                 syncStateToStorage(this);
                 return this.user;
             } catch (error) {
-                // Session may have expired
+                if (!isNoSession(error)) throw error;
+                markVerified(this);
                 this.isAuthenticated = false;
                 this.isAnonymous = false;
                 this.user = null;
@@ -1038,8 +1155,8 @@ async function initializeAppwriteAuthPlugin() {
                     }
                 }
 
-                // If no session and guest-auto is enabled, create guest session
-                if (!store.isAuthenticated && store._guestAuto && store._createAnonymousSession) {
+                // If no session and guest-auto is enabled, create guest session (not while the session check is unreachable)
+                if (!store.isAuthenticated && !store._sessionUnverified && store._guestAuto && store._createAnonymousSession) {
                     store._createAnonymousSession();
                 }
             }, { once: true });

package/lib/manifest.appwrite.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.222';
+const MANIFEST_BUILD_VERSION = '0.5.224';
 
 /* Manifest Data Sources - Appwrite Integration */
 
@@ -671,7 +671,8 @@ window.ManifestDataAppwrite = {
 const subscriptions = new Map(); // Map<dataSourceName, unsubscribeFunction>
 
 // Subscribe to storage bucket file changes
-async function subscribeToStorageBucket(dataSourceName, bucketId, scope, onEvent) {
+// isCurrent: false once the requesting load is superseded (logout) — skip, never touch a newer entry
+async function subscribeToStorageBucket(dataSourceName, bucketId, scope, onEvent, isCurrent) {
     // Unsubscribe from existing subscription if any
     if (subscriptions.has(dataSourceName)) {
         const unsubscribe = subscriptions.get(dataSourceName);
@@ -682,6 +683,7 @@ async function subscribeToStorageBucket(dataSourceName, bucketId, scope, onEvent
     }
 
     const services = await window.ManifestDataAppwrite.getAppwriteDataServices();
+    if (isCurrent && !isCurrent()) return null;
     if (!services?.realtime) {
         console.warn('[Manifest Data] Realtime service not available for', dataSourceName);
         return null;
@@ -751,7 +753,7 @@ function unsubscribeAll() {
 }
 
 // Subscribe to database table row changes
-async function subscribeToTable(dataSourceName, databaseId, tableId, scope, onEvent) {
+async function subscribeToTable(dataSourceName, databaseId, tableId, scope, onEvent, isCurrent) {
     // Unsubscribe from existing subscription if any
     if (subscriptions.has(dataSourceName)) {
         const unsubscribe = subscriptions.get(dataSourceName);
@@ -762,6 +764,7 @@ async function subscribeToTable(dataSourceName, databaseId, tableId, scope, onEv
     }
 
     const services = await window.ManifestDataAppwrite.getAppwriteDataServices();
+    if (isCurrent && !isCurrent()) return null;
     if (!services?.realtime) {
         console.warn('[Manifest Data] Realtime service not available for', dataSourceName);
         return null;

package/lib/manifest.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.222';
+const MANIFEST_BUILD_VERSION = '0.5.224';
 
 /* Manifest Data Sources - Configuration */
 
@@ -590,8 +590,14 @@ function writeSource(dataSourceName, data, options = {}) {
 }
 
 // Synchronous replace: local writes ($register, init preload, state-only updates)
+// A write captured under an older generation (scope reset since, e.g. logout) never lands
+function isStaleWrite(dataSourceName, options) {
+    return !!options && options.generation !== undefined && options.generation !== sourceGeneration(dataSourceName);
+}
+
 function updateStore(dataSourceName, data, options = {}) {
     if (isInitializing && !options.allowDuringInit) return;
+    if (isStaleWrite(dataSourceName, options)) return;
     const state = writeSource(dataSourceName, data, { ...options, mode: 'replace' });
     if (!state) return;
     touchSource(dataSourceName);
@@ -601,10 +607,12 @@ function updateStore(dataSourceName, data, options = {}) {
 // Network landing (page load, paged append, realtime batch): buffered, applied
 // with every other landing of the same frame in ONE flush. Resolves once visible.
 function landRows(dataSourceName, rows, options = {}) {
+    if (isStaleWrite(dataSourceName, options)) return Promise.resolve();
     return queueLanding({ source: dataSourceName, rows, options: { mode: 'replace', ...options } });
 }
 
 function landRemove(dataSourceName, ids, options = {}) {
+    if (isStaleWrite(dataSourceName, options)) return Promise.resolve();
     return queueLanding({ source: dataSourceName, remove: Array.isArray(ids) ? ids : [ids], options });
 }
 
@@ -1132,6 +1140,11 @@ function setupTeamChangeListener() {
         }
     };
 
+    // Logout already reset scoped sources (data main); don't reload them again as a team change
+    const syncTeam = () => { lastTeamId = Alpine.store('auth')?.currentTeam?.$id || null; };
+    window.addEventListener('manifest:auth:logout', syncTeam);
+    window.addEventListener('manifest:auth:session-cleared', syncTeam);
+
     if (document.readyState === 'loading') {
         document.addEventListener('DOMContentLoaded', startPolling);
     } else {
@@ -1188,10 +1201,15 @@ function checkAndDispatchRenderReady() {
     }, RENDER_READY_QUIET_MS);
 }
 
+// Latest locale change owns _localeChanging; an older one finishing must not clear it
+let localeChangeSeq = 0;
+
 // Listen for locale changes to reload data
 function setupLocaleChangeListener() {
     window.addEventListener('localechange', async (event) => {
         const newLocale = event.detail.locale;
+        const seq = ++localeChangeSeq;
+        const latest = () => seq === localeChangeSeq;
 
         // Set loading state to prevent flicker
         const store = Alpine.store('data');
@@ -1293,7 +1311,7 @@ function setupLocaleChangeListener() {
                     delete store[dataSourceName];
                     delete store[`_${dataSourceName}_state`];
                 });
-                store._localeChanging = false;
+                if (latest()) store._localeChanging = false;
                 touchSources(store, localizedDataSources);
             }
 
@@ -1308,7 +1326,7 @@ function setupLocaleChangeListener() {
 
             // All localized sources have reloaded — check if everything is settled.
             // This fires manifest:render-ready after a locale change completes end-to-end.
-            checkAndDispatchRenderReady();
+            if (latest()) checkAndDispatchRenderReady();
 
         } catch (error) {
             console.error('[Manifest Data] Error handling locale change:', error);
@@ -1323,13 +1341,13 @@ function setupLocaleChangeListener() {
                     if (!key.startsWith('_') && typeof raw[key] !== 'function') delete store[key];
                 }
                 store._initialized = true;
-                store._localeChanging = false;
+                if (latest()) store._localeChanging = false;
                 bumpAllVersions();
             }
         } finally {
             // Early exits (no manifest.data) must not strand the render-ready gate
             const store = Alpine.store('data');
-            if (store?._localeChanging) {
+            if (latest() && store?._localeChanging) {
                 store._localeChanging = false;
                 checkAndDispatchRenderReady();
             }
@@ -1506,6 +1524,7 @@ window.ManifestDataStore = {
     sourceFreshness,
     // Persistence (§12.2)
     sourceGeneration,
+    isStaleWrite,
     resetSource,
     touchSource,
     bumpAllVersions,
@@ -1576,6 +1595,7 @@ window.ManifestDataStore = {
         pending: new Map(),    // source -> time its debounced write is due
         writeTimer: null,
         hydrated: new Set(),   // sources hydrated (or attempted) this generation
+        hydratedIdentity: null, // identity auth-dependent hydration last ran under
         fetchKicked: new Set(),
         watching: false,
         deployment: null,
@@ -1589,6 +1609,26 @@ window.ManifestDataStore = {
     const liveLocale = () => (typeof document !== 'undefined' && document.documentElement?.lang)
         || (typeof Alpine !== 'undefined' && Alpine.store?.('locale')?.current) || 'en';
 
+    // Auth-dependent sources (scope / $auth. queries) carry the identity they were read under
+    function isAuthDependent(source) {
+        if (!source || typeof source !== 'object') return false;
+        if (source.scope) return true;
+        try { return JSON.stringify(source.queries || '').includes('$auth.'); } catch { return false; }
+    }
+
+    // Current identity: '' signed out (or no auth plugin), null while auth is still booting
+    function authIdentity() {
+        const auth = (typeof Alpine !== 'undefined' && Alpine.store) ? Alpine.store('auth') : null;
+        if (!auth) return '';
+        if (auth._initialized !== true) return null;
+        return auth.isAuthenticated === true ? String(auth.user?.$id || auth.user?.id || '') : '';
+    }
+
+    function authUnverified() {
+        const auth = (typeof Alpine !== 'undefined' && Alpine.store) ? Alpine.store('auth') : null;
+        return auth?._sessionUnverified === true;
+    }
+
     function warnOnce(key, message, error) {
         if (state.warned.has(key)) return;
         state.warned.add(key);
@@ -1657,7 +1697,7 @@ window.ManifestDataStore = {
         for (const [name, source] of Object.entries(manifest?.data || {})) {
             if (!source || typeof source !== 'object') continue;
             const cfg = normalizeConfig(source.persist);
-            if (cfg) state.sources.set(name, cfg);
+            if (cfg) { cfg.authDependent = isAuthDependent(source); state.sources.set(name, cfg); }
         }
         state.scopeExpr = typeof manifest?.persistence?.scope === 'string' && manifest.persistence.scope.trim()
             ? manifest.persistence.scope.trim() : null;
@@ -1787,6 +1827,7 @@ window.ManifestDataStore = {
                 if (!state.enabled) return;
                 if (WIPE_EVENTS.has(type)) deleteScope(state.scope);
                 refreshScope();
+                if (!state.scopePending) hydrate(bootSources()).catch(() => { /* disabled */ });
             });
         }
         // Reactive re-evaluation (team switches that fire no event); the switch itself runs outside the effect
@@ -1963,6 +2004,8 @@ window.ManifestDataStore = {
         if (!cfg || !ds) return null;
         const raw = ds.getRawData(source);
         if (raw === null || raw === undefined) return null;
+        const identity = cfg.authDependent ? authIdentity() : undefined;
+        if (identity === null) return null;
         try {
             const snapshot = snapshotOf(source, raw, cfg);
             if (snapshot === null) return null;
@@ -1974,7 +2017,8 @@ window.ManifestDataStore = {
                 savedAt: Date.now(),
                 frameworkVersion: state.frameworkVersion,
                 deployment: state.deployment,
-                locale: liveLocale()
+                locale: liveLocale(),
+                ...(cfg.authDependent ? { identity } : {})
             };
         } catch (error) {
             warnOnce(`snapshot:${source}`, `persistence skipped "${source}" (rows are not serialisable)`, error);
@@ -2040,6 +2084,9 @@ window.ManifestDataStore = {
         if (typeof record.savedAt !== 'number' || Date.now() - record.savedAt > cfg.ttl) return { ok: false, drop: true };
         if (majorMinor(record.frameworkVersion) !== majorMinor(state.frameworkVersion)) return { ok: false, drop: true };
         if (record.locale && record.locale !== liveLocale()) return { ok: false };
+        // Another identity's (or an unstamped) snapshot never hydrates: the scope alone may be '' for everyone
+        // An unverified (offline) signed-out boot keeps it for the session check to come back
+        if (cfg.authDependent && record.identity !== authIdentity()) return authUnverified() ? { ok: false } : { ok: false, drop: true };
         return { ok: true };
     }
 
@@ -2047,7 +2094,15 @@ window.ManifestDataStore = {
     // fresh landing (or after a scope change) is discarded
     async function hydrate(sources) {
         const ds = dataStore();
-        const pending = sources.filter(source => state.sources.has(source) && !state.hydrated.has(source));
+        // Auth-dependent sources wait for a known identity (re-run on auth events), and retry when it changes
+        const identity = authIdentity();
+        const known = identity !== null;
+        if (known && identity !== state.hydratedIdentity) {
+            for (const [source, cfg] of state.sources) if (cfg.authDependent) state.hydrated.delete(source);
+            state.hydratedIdentity = identity;
+        }
+        const pending = sources.filter(source => state.sources.has(source) && !state.hydrated.has(source)
+            && (known || !state.sources.get(source).authDependent));
         if (!ds || !pending.length || !state.enabled || state.disabled || state.scopePending) return;
         for (const source of pending) state.hydrated.add(source);
         const generation = state.generation;
@@ -2853,6 +2908,7 @@ function updateEntryInStore(dataSourceName, entryId, updates, options = {}) {
     if (typeof Alpine === 'undefined' || !Alpine.store) {
         return false;
     }
+    if (window.ManifestDataStore?.isStaleWrite?.(dataSourceName, options)) return false;
 
     const { store, arr, index } = findRawIndex(dataSourceName, entryId);
     if (!store || !arr || index === -1) {
@@ -2884,6 +2940,7 @@ function addEntryToStore(dataSourceName, entry, options = {}) {
     if (typeof Alpine === 'undefined' || !Alpine.store) {
         return false;
     }
+    if (window.ManifestDataStore?.isStaleWrite?.(dataSourceName, options)) return false;
 
     const ds = window.ManifestDataStore;
     const target = ds?.ensureSourceArray?.(dataSourceName);
@@ -2915,6 +2972,7 @@ function removeEntryFromStore(dataSourceName, entryId, options = {}) {
     if (typeof Alpine === 'undefined' || !Alpine.store) {
         return false;
     }
+    if (window.ManifestDataStore?.isStaleWrite?.(dataSourceName, options)) return false;
 
     const { store, arr, index } = findRawIndex(dataSourceName, entryId);
     if (!store || !arr || index === -1) {
@@ -2991,6 +3049,8 @@ async function executeMutation(mutationConfig) {
     } = mutationConfig;
 
     const mutationId = generateMutationId();
+    // Writes after the API call carry this; a logout/scope reset meanwhile drops them
+    const writeOptions = { ...options, generation: window.ManifestDataStore?.sourceGeneration?.(dataSourceName) };
     let originalData = null;
     let optimisticData = null;
     let resolvedEntryId = entryId;
@@ -3083,12 +3143,12 @@ async function executeMutation(mutationConfig) {
                         clearSourceCaches(dataSourceName);
                     } else {
                         // Temporary entry not found, just add the real one
-                        addEntryToStore(dataSourceName, result, options);
+                        addEntryToStore(dataSourceName, result, writeOptions);
                     }
                 }
             } else if (type === 'update') {
                 // Update with server response (may have additional fields)
-                updateEntryInStore(dataSourceName, entryId, result, options);
+                updateEntryInStore(dataSourceName, entryId, result, writeOptions);
             }
             // For delete, entry is already removed optimistically, nothing to sync
         }
@@ -3123,11 +3183,11 @@ async function executeMutation(mutationConfig) {
 
         const rollbackFn = () => {
             if (type === 'create' && optimisticData) {
-                removeEntryFromStore(dataSourceName, optimisticData.$id);
+                removeEntryFromStore(dataSourceName, optimisticData.$id, writeOptions);
             } else if (type === 'update' && originalData) {
-                updateEntryInStore(dataSourceName, entryId, originalData);
+                updateEntryInStore(dataSourceName, entryId, originalData, writeOptions);
             } else if (type === 'delete' && originalData) {
-                addEntryToStore(dataSourceName, originalData);
+                addEntryToStore(dataSourceName, originalData, writeOptions);
             }
         };
 
@@ -3151,10 +3211,11 @@ async function executeMutation(mutationConfig) {
 
 // Sync entry from server (background reconciliation)
 async function syncEntryFromServer(dataSourceName, entryId, syncFunction) {
+    const generation = window.ManifestDataStore?.sourceGeneration?.(dataSourceName);
     try {
         const serverData = await syncFunction();
         if (serverData && serverData.$id) {
-            updateEntryInStore(dataSourceName, entryId, serverData);
+            updateEntryInStore(dataSourceName, entryId, serverData, { generation });
             return serverData;
         }
     } catch (error) {
@@ -7112,6 +7173,7 @@ async function linkFileToEntry(tableName, entryId, fileId, fileIdsColumn = 'file
 
             if (executeMutation && updateEntryInStore) {
                 // Optimistic update: immediately update store
+                const generation = window.ManifestDataStore?.sourceGeneration?.(tableName);
                 updateEntryInStore(tableName, entryId, { [fileIdsColumn]: fileIds });
 
                 // Background sync: update server
@@ -7135,7 +7197,7 @@ async function linkFileToEntry(tableName, entryId, fileId, fileIdsColumn = 'file
                         if (originalEntry) {
                             const originalFileIds = originalEntry[fileIdsColumn] || [];
                             const rolledBackFileIds = originalFileIds.filter(id => id !== fileId);
-                            updateEntryInStore(tableName, entryId, { [fileIdsColumn]: rolledBackFileIds });
+                            updateEntryInStore(tableName, entryId, { [fileIdsColumn]: rolledBackFileIds }, { generation });
                         }
                     }
                     throw updateError;
@@ -7301,6 +7363,7 @@ async function unlinkFileFromEntry(tableName, entryId, fileId, fileIdsColumn = '
 
         if (updateEntryInStore) {
             // Optimistic update: immediately update store
+            const generation = window.ManifestDataStore?.sourceGeneration?.(tableName);
             updateEntryInStore(tableName, entryId, { [fileIdsColumn]: fileIds });
 
             // Background sync: update server
@@ -7322,7 +7385,7 @@ async function unlinkFileFromEntry(tableName, entryId, fileId, fileIdsColumn = '
                         if (!originalFileIds.includes(fileId)) {
                             originalFileIds.push(fileId);
                         }
-                        updateEntryInStore(tableName, entryId, { [fileIdsColumn]: originalFileIds });
+                        updateEntryInStore(tableName, entryId, { [fileIdsColumn]: originalFileIds }, { generation });
                     }
                 }
                 throw updateError;
@@ -7922,7 +7985,8 @@ function createAppwriteMethodsHandler(dataSourceName, reloadDataSource) {
                     }
                     // Dedupe key: source + serialized queries (never across different queries)
                     const key = `${dataSourceName}:$query:${JSON.stringify(appwriteQueries.map(q => String(q)))}`;
-                    const { runDeduped, landRows } = window.ManifestDataStore || {};
+                    const { runDeduped, landRows, sourceGeneration } = window.ManifestDataStore || {};
+                    const generation = sourceGeneration?.(dataSourceName);
                     const run = async () => {
                         const result = await window.ManifestDataAppwrite.loadTableRows(
                             appwriteConfig.databaseId,
@@ -7931,7 +7995,7 @@ function createAppwriteMethodsHandler(dataSourceName, reloadDataSource) {
                         );
                         // Network landing: query result replaces the source (coalesced, identity-preserving)
                         if (result !== undefined && landRows) {
-                            await landRows(dataSourceName, result, { mode: 'replace', fresh: true });
+                            await landRows(dataSourceName, result, { mode: 'replace', fresh: true, generation });
                         }
                         return result;
                     };
@@ -8100,6 +8164,7 @@ function createAppwriteMethodsHandler(dataSourceName, reloadDataSource) {
                     // Use optimistic update via mutation system
                     const addEntryToStore = window.ManifestDataMutations?.addEntryToStore;
                     const removeEntryFromStore = window.ManifestDataMutations?.removeEntryFromStore;
+                    const writeOptions = { generation: window.ManifestDataStore?.sourceGeneration?.(dataSourceName) };
                     const manifest = await window.ManifestDataConfig.ensureManifest();
                     const dataSource = manifest?.data?.[dataSourceName];
                     const scope = window.ManifestDataConfig.getScope(dataSource);
@@ -8147,7 +8212,7 @@ function createAppwriteMethodsHandler(dataSourceName, reloadDataSource) {
                             _optimistic: true // Mark as optimistic
                         };
                         // Optimistic update: immediately add file to store
-                        addEntryToStore(dataSourceName, optimisticFile);
+                        addEntryToStore(dataSourceName, optimisticFile, writeOptions);
                     }
 
                     let result;
@@ -8171,7 +8236,7 @@ function createAppwriteMethodsHandler(dataSourceName, reloadDataSource) {
                         }
                         // Rollback optimistic update on error
                         if (optimisticFile && removeEntryFromStore) {
-                            removeEntryFromStore(dataSourceName, optimisticFile.$id);
+                            removeEntryFromStore(dataSourceName, optimisticFile.$id, writeOptions);
                         }
                         throw error;
                     }
@@ -8179,12 +8244,12 @@ function createAppwriteMethodsHandler(dataSourceName, reloadDataSource) {
                     // Replace optimistic file with real one from server
                     if (optimisticFile && addEntryToStore && removeEntryFromStore) {
                         // Remove optimistic entry
-                        removeEntryFromStore(dataSourceName, optimisticFile.$id);
+                        removeEntryFromStore(dataSourceName, optimisticFile.$id, writeOptions);
                         // Add real entry
-                        addEntryToStore(dataSourceName, result);
+                        addEntryToStore(dataSourceName, result, writeOptions);
                     } else if (addEntryToStore) {
                         // If no optimistic update was done, add now
-                        addEntryToStore(dataSourceName, result);
+                        addEntryToStore(dataSourceName, result, writeOptions);
                     }
 
                     // Link the uploaded file to a table entry, resolved from the
@@ -8627,6 +8692,7 @@ function createAppwriteMethodsHandler(dataSourceName, reloadDataSource) {
                         ? Promise.all(fileId.map(id => window.ManifestDataAppwrite.deleteFile(bucketId, id.$id || id)))
                         : window.ManifestDataAppwrite.deleteFile(bucketId, actualFileId);
 
+                    const generation = window.ManifestDataStore?.sourceGeneration?.(dataSourceName);
                     const reloadPromise = window.ManifestDataAppwrite.listBucketFiles(bucketId, []);
 
                     // Do delete and reload in parallel
@@ -8634,7 +8700,7 @@ function createAppwriteMethodsHandler(dataSourceName, reloadDataSource) {
 
                     // Network landing: reloaded bucket listing replaces the source (coalesced)
                     if (reloadedData && window.ManifestDataStore?.landRows) {
-                        await window.ManifestDataStore.landRows(dataSourceName, reloadedData, { mode: 'replace' });
+                        await window.ManifestDataStore.landRows(dataSourceName, reloadedData, { mode: 'replace', generation });
                     }
 
                     // Reload affected table data sources so fileIds arrays and counters
@@ -11361,11 +11427,93 @@ function scheduleAuthRetry(dataSourceName, locale) {
     AUTH_RETRY_EVENTS.forEach(type => window.addEventListener(type, retry));
 }
 
+// Teams known for this identity: login/anonymous dispatch after teams load, teams-loaded after the background load
+let teamsSettledFor = null;
+// A sign-in deadline already answered by an auth event no longer holds sources
+let answeredDeadline = 0;
+if (typeof window !== 'undefined') {
+    ['manifest:auth:teams-loaded', 'manifest:auth:login', 'manifest:auth:anonymous'].forEach(type =>
+        window.addEventListener(type, () => { teamsSettledFor = authUserId(currentAuth()); }));
+    // Kept only when logout restored the same (guest) identity whose teams already loaded
+    ['manifest:auth:logout', 'manifest:auth:session-cleared', 'manifest:auth:initialized'].forEach(type =>
+        window.addEventListener(type, () => { if (type === 'manifest:auth:initialized' || teamsSettledFor !== authUserId(currentAuth())) teamsSettledFor = null; }));
+    ['manifest:auth:login', 'manifest:auth:anonymous', 'manifest:auth:logout', 'manifest:auth:session-cleared'].forEach(type =>
+        window.addEventListener(type, () => { answeredDeadline = currentAuth()?._signInPendingUntil || 0; }));
+}
+
+function currentAuth() {
+    return typeof Alpine !== 'undefined' ? Alpine.store('auth') : null;
+}
+
+function authUserId(auth) {
+    return auth?.user?.$id || auth?.user?.id || null;
+}
+
+// Guest-auto or an auth callback is signing in after a signed-out init (bounded by the auth store)
+// Prerender never waits on (or bakes) a guest's rows
+function signInWaitMs(auth) {
+    if (!auth || auth.isAuthenticated === true || window.__manifestRender) return 0;
+    const until = auth._signInPendingUntil || 0;
+    if (until === answeredDeadline) return 0;
+    return Math.max(0, until - Date.now());
+}
+
+// Drop only this load's subscription; a newer one under the same name stays
+function dropSubscription(dataSourceName, unsubscribe) {
+    if (typeof unsubscribe !== 'function') return;
+    unsubscribe();
+    const subs = window.ManifestDataRealtime?.subscriptions;
+    if (subs?.get?.(dataSourceName) === unsubscribe) subs.delete(dataSourceName);
+}
+
 // Auth settled with no identity (or no auth plugin): a scoped read can't resolve until sign-in
 function authSettledSignedOut() {
-    const auth = typeof Alpine !== 'undefined' ? Alpine.store('auth') : null;
+    const auth = currentAuth();
     if (!auth) return true;
-    return auth._initialized === true && auth.isAuthenticated !== true;
+    return auth._initialized === true && auth.isAuthenticated !== true && signInWaitMs(auth) === 0;
+}
+
+function teamsSettled(auth, manifest) {
+    const id = authUserId(auth);
+    if (id && teamsSettledFor === id) return true;
+    const teams = manifest?.appwrite?.auth?.teams;
+    if (!teams) return true;
+    const guests = typeof teams.guests === 'string' ? /^(true|1|yes|on)$/i.test(teams.guests.trim()) : !!teams.guests;
+    return auth.isAnonymous === true && !guests;
+}
+
+// Auth fully settled (identity + teams) yet the scoped read still can't resolve: it never will
+function authSettledUnresolvable(manifest) {
+    if (authSettledSignedOut()) return true;
+    const auth = currentAuth();
+    return auth._initialized === true && auth.isAuthenticated === true && teamsSettled(auth, manifest);
+}
+
+function isAuthDependent(config) {
+    if (!config || typeof config !== 'object') return false;
+    if (window.ManifestDataConfig?.getScope?.(config)) return true;
+    try { return JSON.stringify(config.queries || '').includes('$auth.'); } catch { return false; }
+}
+
+// Logout / session cleared: drop the previous identity's rows now, then settle for the new one
+function setupAuthResetListener() {
+    const reset = async () => {
+        const manifest = await window.ManifestDataConfig?.ensureManifest?.();
+        const ds = window.ManifestDataStore;
+        const store = typeof Alpine !== 'undefined' ? Alpine.store('data') : null;
+        if (!manifest || !ds?.resetSource || !store) return;
+        const raw = ds.rawOf ? ds.rawOf(store) : store;
+        const configs = { ...(manifest.appwrite || {}), ...(manifest.data || {}) };
+        const locale = liveLocale();
+        for (const [name, config] of Object.entries(configs)) {
+            if (!isAuthDependent(config) || raw[`_${name}_state`] === undefined) continue;
+            window.ManifestDataRealtime?.unsubscribeFromDataSource?.(name);
+            ds.resetSource(name);
+            loadDataSource(name, locale, { reload: true });
+        }
+    };
+    window.addEventListener('manifest:auth:logout', reset);
+    window.addEventListener('manifest:auth:session-cleared', reset);
 }
 
 // Client-side scope filter: Appwrite returns all accessible files, so narrow to
@@ -11468,7 +11616,7 @@ async function filterFilesByScope(files, scope) {
 }
 
 // Handle real-time storage events
-async function handleStorageRealtimeEvent(dataSourceName, bucketId, scope, eventType, payload) {
+async function handleStorageRealtimeEvent(dataSourceName, bucketId, scope, eventType, payload, generation) {
 
     // Deduplicate events
     const eventKey = getEventKey(eventType, payload);
@@ -11495,7 +11643,7 @@ async function handleStorageRealtimeEvent(dataSourceName, bucketId, scope, event
         if (file && file.$id) {
             const fileMatchesScope = await checkFileMatchesScope(file, scope);
             if (fileMatchesScope) {
-                landRows(dataSourceName, [file], { mode: 'append' });
+                landRows(dataSourceName, [file], { mode: 'append', generation });
 
                 // Emit custom event for new file creation so UI can refresh project files
                 window.dispatchEvent(new CustomEvent('manifest:file-created', {
@@ -11510,16 +11658,16 @@ async function handleStorageRealtimeEvent(dataSourceName, bucketId, scope, event
         if (file && file.$id) {
             const fileMatchesScope = await checkFileMatchesScope(file, scope);
             if (fileMatchesScope) {
-                landRows(dataSourceName, [file], { mode: 'append' });
+                landRows(dataSourceName, [file], { mode: 'append', generation });
             } else {
                 // File no longer matches scope, remove it
-                landRemove(dataSourceName, [file.$id]);
+                landRemove(dataSourceName, [file.$id], { generation });
             }
         }
     } else if (eventType === 'delete') {
         const fileId = payload?.$id || payload?.file?.$id || payload?.fileId || payload;
         if (fileId) {
-            landRemove(dataSourceName, [fileId.$id || fileId]);
+            landRemove(dataSourceName, [fileId.$id || fileId], { generation });
         }
     }
 }
@@ -11570,7 +11718,7 @@ function markEventProcessed(eventKey) {
 }
 
 // Handle real-time events for database tables
-async function handleTableRealtimeEvent(dataSourceName, databaseId, tableId, scope, scopeColumns, eventType, payload) {
+async function handleTableRealtimeEvent(dataSourceName, databaseId, tableId, scope, scopeColumns, eventType, payload, generation) {
 
     // Deduplicate events
     const eventKey = getEventKey(eventType, payload);
@@ -11599,7 +11747,7 @@ async function handleTableRealtimeEvent(dataSourceName, databaseId, tableId, sco
         if (row && row.$id) {
             const rowMatchesScope = await checkRowMatchesScope(row, scope, scopeColumns);
             if (rowMatchesScope) {
-                landRows(dataSourceName, [row], { mode: 'append' });
+                landRows(dataSourceName, [row], { mode: 'append', generation });
             }
         } else {
             console.warn('[Manifest Data] Invalid row payload in create event:', payload);
@@ -11611,12 +11759,12 @@ async function handleTableRealtimeEvent(dataSourceName, databaseId, tableId, sco
             const rowMatchesScope = await checkRowMatchesScope(row, scope, scopeColumns);
             if (!rowMatchesScope) {
                 // Row no longer matches scope, remove it
-                if (existingRow) landRemove(dataSourceName, [row.$id]);
+                if (existingRow) landRemove(dataSourceName, [row.$id], { generation });
                 return;
             }
             if (!existingRow) {
                 // Row not in list, but matches scope now - add it
-                landRows(dataSourceName, [row], { mode: 'append' });
+                landRows(dataSourceName, [row], { mode: 'append', generation });
                 return;
             }
 
@@ -11676,7 +11824,7 @@ async function handleTableRealtimeEvent(dataSourceName, databaseId, tableId, sco
                 const fileIdsChanged = isProjectWithFiles &&
                     JSON.stringify(existingFileIds) !== JSON.stringify(incomingFileIds);
 
-                landRows(dataSourceName, [row], { mode: 'append' });
+                landRows(dataSourceName, [row], { mode: 'append', generation });
 
                 // Emit custom event for project file updates so UI can refresh
                 if (fileIdsChanged && dataSourceName === 'projects') {
@@ -11689,7 +11837,7 @@ async function handleTableRealtimeEvent(dataSourceName, databaseId, tableId, sco
     } else if (eventType === 'delete') {
         const rowId = payload?.$id || payload?.row?.$id || payload?.rowId || payload;
         if (rowId) {
-            landRemove(dataSourceName, [rowId.$id || rowId]);
+            landRemove(dataSourceName, [rowId.$id || rowId], { generation });
         }
     }
 
@@ -11871,9 +12019,20 @@ async function loadDataSource(dataSourceName, locale = 'en', options = {}) {
     const generation = sourceGeneration ? sourceGeneration(dataSourceName) : 0;
     const superseded = () => sourceGeneration && sourceGeneration(dataSourceName) !== generation;
 
-    // Signed out: settle empty (not $loading forever); sign-in reloads via the auth retry
-    const settleSignedOut = () => {
-        if (isInitializing || superseded() || !authSettledSignedOut()) return false;
+    // Unresolvable scope (signed out, or teamless): settle empty, not $loading forever; auth events reload.
+    // A pending sign-in holds the source unsettled (one render-ready), bounded by its deadline.
+    const settleUnresolved = (manifest) => {
+        if (isInitializing || superseded()) return false;
+        const wait = signInWaitMs(currentAuth());
+        if (wait > 0) {
+            setTimeout(() => {
+                const state = Alpine.store('data')?.[`_${dataSourceName}_state`];
+                if (state?.ready || superseded() || !authSettledSignedOut()) return;
+                updateStore(dataSourceName, [], { loading: false, error: null, ready: true });
+            }, wait + 10);
+            return false;
+        }
+        if (!authSettledUnresolvable(manifest)) return false;
         updateStore(dataSourceName, [], { loading: false, error: null, ready: true });
         return true;
     };
@@ -11957,7 +12116,7 @@ async function loadDataSource(dataSourceName, locale = 'en', options = {}) {
                     // Not ready (auth/scope unresolved): skip this read, retry on an auth event
                     if (queries === null) {
                         scheduleAuthRetry(dataSourceName, locale);
-                        if (settleSignedOut()) landed = true;
+                        if (settleUnresolved(manifest)) landed = true;
                         return null;
                     }
 
@@ -11970,19 +12129,21 @@ async function loadDataSource(dataSourceName, locale = 'en', options = {}) {
                         tableId,
                         queries
                     );
+                    if (superseded()) { landed = true; return null; }
 
-                    // Subscribe to real-time updates for this table
+                    // Subscribe to real-time updates for this table (events from a superseded identity drop)
                     if (window.ManifestDataRealtime && window.ManifestDataRealtime.subscribeToTable) {
-                        await window.ManifestDataRealtime.subscribeToTable(
+                        const unsubscribe = await window.ManifestDataRealtime.subscribeToTable(
                             dataSourceName,
                             appwriteConfig.databaseId,
                             tableId,
                             scope,
                             async (eventType, payload) => {
-                                // Handle real-time events
-                                await handleTableRealtimeEvent(dataSourceName, appwriteConfig.databaseId, tableId, scope, scopeColumns, eventType, payload);
-                            }
+                                await handleTableRealtimeEvent(dataSourceName, appwriteConfig.databaseId, tableId, scope, scopeColumns, eventType, payload, generation);
+                            },
+                            () => !superseded()
                         );
+                        if (superseded()) { dropSubscription(dataSourceName, unsubscribe); landed = true; return null; }
                     }
                 } else if (bucketId) {
                     // Load from Appwrite storage bucket
@@ -11996,7 +12157,7 @@ async function loadDataSource(dataSourceName, locale = 'en', options = {}) {
                     // Not ready (a $auth. arg in queriesConfig unresolved): skip, retry on an auth event
                     if (queries === null) {
                         scheduleAuthRetry(dataSourceName, locale);
-                        if (settleSignedOut()) landed = true;
+                        if (settleUnresolved(manifest)) landed = true;
                         return null;
                     }
 
@@ -12017,17 +12178,21 @@ async function loadDataSource(dataSourceName, locale = 'en', options = {}) {
 
                     data = files;
 
-                    // Subscribe to real-time updates for this bucket
+                    if (superseded()) { landed = true; return null; }
+
+                    // Subscribe to real-time updates for this bucket (events from a superseded identity drop)
                     if (window.ManifestDataRealtime && window.ManifestDataRealtime.subscribeToStorageBucket) {
-                        await window.ManifestDataRealtime.subscribeToStorageBucket(
+                        const unsubscribe = await window.ManifestDataRealtime.subscribeToStorageBucket(
                             dataSourceName,
                             bucketId,
                             scope,
                             async (eventType, payload) => {
-                                // Handle real-time events
-                                await handleStorageRealtimeEvent(dataSourceName, bucketId, scope, eventType, payload);
-                            }
+                                if (superseded()) return;
+                                await handleStorageRealtimeEvent(dataSourceName, bucketId, scope, eventType, payload, generation);
+                            },
+                            () => !superseded()
                         );
+                        if (superseded()) { dropSubscription(dataSourceName, unsubscribe); landed = true; return null; }
                     }
                 } else {
                     console.warn(`[Manifest Data] Appwrite data source "${dataSourceName}" missing tableId or bucketId`);
@@ -12161,7 +12326,7 @@ async function loadDataSource(dataSourceName, locale = 'en', options = {}) {
             // Network landing (coalesced per frame, merges by $id); resolves once visible
             if (!isInitializing && !staleLocale) {
                 landed = true;
-                await landRows(dataSourceName, enhancedData, { mode: 'replace', loading: false, error: null, ready: true, fresh: true });
+                await landRows(dataSourceName, enhancedData, { mode: 'replace', loading: false, error: null, ready: true, fresh: true, generation });
             }
 
             // Return unsealed version for our proxy system
@@ -12307,6 +12472,8 @@ async function initializeDataSourcesPlugin() {
     // Setup URL change listeners
     setupUrlChangeListeners();
 
+    setupAuthResetListener();
+
     // Register $x magic method (only if Alpine is available)
 
     if (typeof Alpine !== 'undefined' && window.ManifestDataProxies) {

package/lib/manifest.integrity.json

@@ -1,6 +1,6 @@
 {
-  "manifest.appwrite.auth.js": "sha384-X30RFvbwT9qEIaMsMUumnW54ZzcnY5aY9QQeXPG8/0sI6VAbAw3+FZ6iuZb6b4cu",
-  "manifest.appwrite.data.js": "sha384-dSnLE73aoJkrLXQ3EYSNgmMLJ8WZn6dGcZOKx6bY007Qnl/vY2JK75q/leiZXe7s",
+  "manifest.appwrite.auth.js": "sha384-tcpyR3WJvAL3TenZRsevGCGCHUrGgbU5wHuOYG5Emvny/wukRiaPEagrXiH5v7R6",
+  "manifest.appwrite.data.js": "sha384-gnniX4ojmePGmJsC3KRZqP+jdIGe852Sr/XSkO+HJWljiNMeZVph5LYgYdcwoRNf",
   "manifest.appwrite.presences.js": "sha384-JyVDWFT69b7Svq8J8p9tNWe2v9PZNQBY5UyhtOl1vnuHFAX0CRQ3MA9SiKq5wzNh",
   "manifest.bindings.js": "sha384-lPtMf8Ykaic9gNVZKq8Scia1881ZeMAyxer3WCIkUNwwrgzGBWto1OXADUwjvORF",
   "manifest.charts.js": "sha384-gEAv/98+29RbhvNkiNWTNyBPbLTFr2Ld15wLu29FLCL57j1cwGChRrL9Pfk7dBtT",
@@ -11,7 +11,7 @@
   "manifest.combobox.js": "sha384-MILTkrgsTzsYUjGo4ZuADqV85Xs4GmfB4xexfe9vbJMIoQTZ42W4zs+DTaVSPEsx",
   "manifest.components.js": "sha384-4bc3HgPvF9DHMiOG08w+nWXI7Hho01RuAPAUL9xyLxOiS2igeZpulCVcvr5aT9v6",
   "manifest.computed.js": "sha384-GYML/e81gQfN+iDbqhPUgny8bINCyL+SrbTofoGk4hlCnLLjv51mCv42JMqq+ku5",
-  "manifest.data.js": "sha384-ixpU7pvJhlPBvT7in0HonHQLdNOabbpqik6IVsMNNzAY3UhCVAf8BRno2niTkZK1",
+  "manifest.data.js": "sha384-5kg35XDQb/nTD4oED1HxAkyAhCpfieoUhaY1oCO/vLTc6oPXiPATzyW6/95KSPLw",
   "manifest.datepicker.js": "sha384-XnbeURni2X91ozVzatQcSjYYIS4MoW12dBRJnYAGBr0nCQ624heH5s+xtQSpLZX6",
   "manifest.defer.js": "sha384-WcCf8YQ1bKIXCLSZ24a0bJwepbYntYc8TzQM50hklo5VMIH8AtzDnwl6WU4prRv1",
   "manifest.device.js": "sha384-g+txmrEszYtuOvRelTp/c1wSNR2AtllVI9rx5NPPD7DzhVUnMNughonZykv2xlBW",
@@ -28,7 +28,7 @@
   "manifest.slides.js": "sha384-3uRTkyK9XPLmnxI2+igZlpi4EyPlU/7IHj5j3BZJJ2KN455vXyk99fiXV3feO/XY",
   "manifest.status.js": "sha384-MBO345ab7H6Uq1X2dZLt4Ge1Gcra+Z2qYApvlAeIV8CJhDDJrz2FPXpp+Kcp8zcM",
   "manifest.svg.js": "sha384-qr/8H9+2cIhSXNbRWRtIdrDlTOxKlNJqwEefHvCYoiBNW/kKhPTFa109Orv/EBnb",
-  "manifest.sw.js": "sha384-P5M9kT06bquAyIK8aLQK6ujNn5rnaJ2Lw8f/ZsDx1yLVPWYeIOwa6Y06eEWmc5ry",
+  "manifest.sw.js": "sha384-AQB+zglu9/quyKkdAo2oIiWzfgCH7UqiOmFwrS2hqfzYsaSpYeDpmjb5d2tl/RTB",
   "manifest.tabs.js": "sha384-OIIcyaQnGS0eNYk4zgAFEDboNYect7THvUd9D0V6nqCeDOxQcoiqLrBEmmWVTTet",
   "manifest.tailwind.js": "sha384-r/Jvqb+Piz21jUts10BbVAJoKkShOdJRVFpywyi4HPIi/OfOJq5CtPyWAPbdkMgt",
   "manifest.text.edit.js": "sha384-RzOvLQE8GbmI6gntAwiotDewYT/08OHcd7sJ5hLon8e8u1Xbq1D7VfEGuaRVd2CE",

package/lib/manifest.sw.js

@@ -16,7 +16,7 @@
 
 // Build stamps the published version here; unstamped (dev) falls back to the
 // registration URL's `v`, then 'dev'.
-const BUILD_VERSION = '0.5.222';
+const BUILD_VERSION = '0.5.224';
 const CACHE_PREFIX = 'mnfst-sw:';
 const META_CACHE = CACHE_PREFIX + 'meta';
 // Sized to hold a full precache.json warm-up (PRECACHE_MAX_ENTRIES server-side)
@@ -28,6 +28,8 @@ const PRECACHE_CONCURRENCY = 4;
 const STATIC_EXT = /\.(css|js|mjs|json|csv|tsv|ya?ml|md|txt|xml|svg|png|jpe?g|gif|webp|avif|ico|bmp|woff2?|ttf|otf|eot|mp3|mp4|webm|ogg|wav|flac|m4a|wasm|webmanifest|map)$/i;
 const SKIP_PATH = /^\/(sw\.js$|precache\.json$|v1\/|_appwrite\/|_ai\/|__mnfst|__edit)/;
 const CDN_HOST = /^(cdn\.manifestx\.dev|cdn\.jsdelivr\.net|unpkg\.com|esm\.run)$/;
+const PRIMARY_CDN = 'https://cdn.manifestx.dev/npm/';
+const MIRROR_CDN = 'https://cdn.jsdelivr.net/npm/';
 const ICONIFY_HOST = /^api\.(iconify\.design|simplesvg\.com|unisvg\.com)$/;
 const EXACT_PIN = /@\d+\.\d+\.\d+[^/]*(\/|$)/;
 const ANY_PIN = /@[^/]+(\/|$)/;
@@ -127,10 +129,20 @@ function cacheable(response) {
 
 // Cross-origin script tags fetch no-cors (opaque, uncheckable); refetch with
 // CORS so only real 200s are cached. A CORS failure falls back to pass-through.
+// Primary-CDN requests that reject or come back non-ok retry once against the
+// jsDelivr mirror (same /npm/ path), so a blocked or wedged cdn host can't
+// dead-end the boot assets; a good mirror response caches under the original URL.
 function cacheFetch(request) {
 	const url = new URL(request.url);
-	if (url.origin === self.location.origin || request.mode === 'cors') return fetch(request);
-	return fetch(new Request(request.url, { mode: 'cors', credentials: 'omit', redirect: 'follow' }));
+	const direct = url.origin === self.location.origin || request.mode === 'cors'
+		? fetch(request)
+		: fetch(new Request(request.url, { mode: 'cors', credentials: 'omit', redirect: 'follow' }));
+	if (request.url.indexOf(PRIMARY_CDN) !== 0) return direct;
+	const mirror = () => fetch(new Request(MIRROR_CDN + request.url.slice(PRIMARY_CDN.length), { mode: 'cors', credentials: 'omit', redirect: 'follow' }));
+	return direct.then(
+		(res) => (res.ok ? res : mirror().then((alt) => (alt.ok ? alt : res)).catch(() => res)),
+		() => mirror(),
+	);
 }
 
 async function trimSwr(cache) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mnfst",
-    "version": "0.5.222",
+    "version": "0.5.224",
     "private": false,
     "workspaces": [
         "templates/starter",