mnfst 0.5.225 → 0.5.227

package/lib/manifest.appwrite.auth.js

@@ -255,6 +255,19 @@ function initializeAuthStore() {
         'deviceBrand', 'deviceModel', 'countryCode', 'countryName'
     ];
 
+    // User id in a mirrored state ('' / null when signed out)
+    function mirroredUserId(raw) {
+        try { const saved = JSON.parse(raw || 'null'); return saved?.isAuthenticated ? (saved.user?.$id || null) : null; } catch { return null; }
+    }
+
+    // Identity this tab is showing data for: while unverified, the last one mirrored
+    function shownUserId(store, mirrored) {
+        if (store.user?.$id) return store.user.$id;
+        if (!store._sessionUnverified) return null;
+        if (mirrored === undefined) { try { mirrored = localStorage.getItem(STORAGE_KEY); } catch { mirrored = null; } }
+        return mirroredUserId(mirrored);
+    }
+
     function sanitizeSessionForStorage(session) {
         if (!session || typeof session !== 'object') return session;
         const safe = {};
@@ -271,7 +284,8 @@ function initializeAuthStore() {
                 const state = JSON.parse(e.newValue);
                 const store = Alpine.store('auth');
                 if (store) {
-                    const prevId = store.user?.$id || null;
+                    const prevId = shownUserId(store, e.oldValue);
+                    const wasAuthenticated = store.isAuthenticated === true;
                     // Update store state from other tab
                     store._authEpoch++;
                     if (state.isAuthenticated) markVerified(store);
@@ -283,15 +297,19 @@ function initializeAuthStore() {
                     store.magicLinkExpired = state.magicLinkExpired || false;
                     store.otpSent = state.otpSent || false;
                     store.otpExpired = state.otpExpired || false;
+                    // A code row shown here must be verifiable here
+                    if (state.otpSent && state.otpUserId) store._otpUserId = state.otpUserId;
                     store.error = state.error;
                     // Identity ended or changed in another tab: scoped data must drop this tab's rows
                     const nextId = state.isAuthenticated ? (state.user?.$id || null) : null;
                     if (prevId && nextId !== prevId) {
-                        if (!nextId) {
-                            store.teams = [];
-                            store.currentTeam = null;
-                        }
+                        store._resetTeamsState();
                         window.dispatchEvent(new CustomEvent('manifest:auth:session-cleared'));
+                        if (nextId) store._adoptCrossTabTeams(nextId);
+                    } else if (nextId && !wasAuthenticated) {
+                        // Signed in from another tab: this tab's identity-bound data reloads
+                        window.dispatchEvent(new CustomEvent(state.isAnonymous ? 'manifest:auth:anonymous' : 'manifest:auth:login', { detail: { user: state.user, crossTab: true } }));
+                        store._adoptCrossTabTeams(nextId);
                     }
                 }
             } catch (error) {
@@ -314,6 +332,7 @@ function initializeAuthStore() {
                 magicLinkExpired: store.magicLinkExpired,
                 otpSent: store.otpSent,
                 otpExpired: store.otpExpired,
+                otpUserId: store.otpSent ? store._otpUserId : null,
                 error: store.error
             };
             localStorage.setItem(STORAGE_KEY, JSON.stringify(state));
@@ -335,6 +354,7 @@ function initializeAuthStore() {
         otpExpired: false, // OTP (email/phone): the entered code was wrong/expired
         otpPhrase: null, // Email OTP: security phrase to display (when enabled; phone has none)
         _otpUserId: null, // OTP: userId returned by createEmailToken/createPhoneToken, used by verifyOTP
+        _otpMigrationTicket: null, // OTP: { ticket, userId } guest-migration ticket, kept across failed verify attempts
         teams: [], // List of user's teams
         currentTeam: null, // Currently selected/active team
         _teamsPollInterval: null, // Interval ID for teams polling (deprecated, use realtime instead)
@@ -384,6 +404,8 @@ function initializeAuthStore() {
         _guestManual: false,
         _signInPendingUntil: 0, // signed-out init with guest-auto or an auth callback still to sign in
         _sessionUnverified: false, // init could not reach Appwrite: signed out locally, never broadcast
+        _crossTabTeams: null, // latest cross-tab team load; older ones skip their writes
+        _teamsEpoch: 0, // bumped by every team reset; an in-flight listTeams from an older one is discarded
         _authEpoch: 0, // bumped by every identity change; an in-flight recheck from an older epoch is dropped
         _recheckTimer: null,
         _recheckAttempt: 0,
@@ -619,8 +641,9 @@ function initializeAuthStore() {
                 this._initialized = true;
                 this._initializing = false;
 
-                // Guest-auto / callback sign-in follows: scoped data holds instead of flashing signed-out
-                if (!this.isAuthenticated) {
+                // Guest-auto / callback sign-in follows: scoped data holds instead of flashing signed-out.
+                // Not while unverified: nothing signs in until Appwrite is reachable (the recheck handles it)
+                if (!this.isAuthenticated && !this._sessionUnverified) {
                     let callback = false;
                     try {
                         // Team invites need an existing session (acceptInvite refuses signed-out), so they don't sign in
@@ -644,10 +667,14 @@ function initializeAuthStore() {
             // manifest:auth:teams-loaded for anything needing the full set.
             if (appwriteConfig && this.isAuthenticated && appwriteConfig.teams
                 && (!this.isAnonymous || appwriteConfig.guestTeams)) {
+                const owner = this.user?.$id;
                 this._loadTeamsAndSeed(appwriteConfig)
-                    .then(() => window.dispatchEvent(new CustomEvent('manifest:auth:teams-loaded', {
-                        detail: { teams: this.teams, currentTeam: this.currentTeam }
-                    })))
+                    .then(() => {
+                        if (!this.isAuthenticated || this.user?.$id !== owner) return;
+                        window.dispatchEvent(new CustomEvent('manifest:auth:teams-loaded', {
+                            detail: { teams: this.teams, currentTeam: this.currentTeam }
+                        }));
+                    })
                     .catch(e => console.warn('[Manifest Appwrite Auth] Background team load failed:', e?.message || e));
             }
         },
@@ -713,9 +740,12 @@ function initializeAuthStore() {
             } catch (error) {
                 if (!current()) return;
                 if (!isNoSession(error)) { scheduleRecheck(this); return; }
+                const prevId = shownUserId(this);
                 this._clearIdentity();
                 markVerified(this);
                 syncStateToStorage(this);
+                // Rows shown for the last-known user drop
+                if (prevId) window.dispatchEvent(new CustomEvent('manifest:auth:session-cleared'));
                 if (this._guestAuto && this._createAnonymousSession) await this._createAnonymousSession();
                 return;
             } finally {
@@ -750,9 +780,34 @@ function initializeAuthStore() {
             this.deletedTemplateTeams = [];
             this.deletedTemplateRoles = [];
             this._teamImmutableCache = {};
+            this._teamsEpoch++;
             if (this.stopTeamsRealtime) {
                 try { this.stopTeamsRealtime(); } catch (e) { /* ignore */ }
             }
+            if (this.stopTeamsPolling) {
+                try { this.stopTeamsPolling(); } catch (e) { /* ignore */ }
+            }
+        },
+
+        // Teams for an identity adopted from another tab. That tab seeds; this one
+        // only lists. A newer adoption or identity change supersedes this load.
+        _adoptCrossTabTeams(userId) {
+            const token = {};
+            this._crossTabTeams = token;
+            const current = () => this._crossTabTeams === token && this.isAuthenticated === true && this.user?.$id === userId;
+            (async () => {
+                try {
+                    const cfg = await config.getAppwriteConfig();
+                    if (!cfg?.teams || (this.isAnonymous && !cfg.guestTeams) || !current()) return;
+                    await this._loadTeamsAndSeed(cfg, { seed: false });
+                } catch (e) {
+                    console.warn('[Manifest Appwrite Auth] Cross-tab team load failed:', e?.message || e);
+                }
+                if (!current()) return;
+                window.dispatchEvent(new CustomEvent('manifest:auth:teams-loaded', {
+                    detail: { teams: this.teams, currentTeam: this.currentTeam }
+                }));
+            })();
         },
 
         // Call the deployed guest-migration function; the current session authenticates it.
@@ -777,14 +832,14 @@ function initializeAuthStore() {
 
         // Load the user's teams and seed configured defaults. Shared by the guest,
         // magic-link, OAuth, and init/restore paths.
-        async _loadTeamsAndSeed(appwriteConfig) {
+        async _loadTeamsAndSeed(appwriteConfig, { seed = true } = {}) {
             const cfg = appwriteConfig || await config.getAppwriteConfig();
             if (!cfg?.teams) {
                 return;
             }
             // Startup race: we can arrive before teams.core/defaults wire listTeams +
             // ensureDefaultTeams onto the store. Wait briefly rather than skip.
-            const needsSeed = !!(cfg.permanentTeams || cfg.templateTeams);
+            const needsSeed = seed && !!(cfg.permanentTeams || cfg.templateTeams);
             const ready = () => typeof this.listTeams === 'function'
                 && (!needsSeed || typeof window.ManifestAppwriteAuthTeamsDefaults?.ensureDefaultTeams === 'function');
             for (let i = 0; i < 40 && !ready(); i++) {
@@ -907,6 +962,9 @@ function initializeAuthStore() {
                 return { success: false, error: 'Appwrite not configured' };
             }
 
+            // A ticket kept from a failed guest OTP must not outlive an explicit logout
+            this._otpMigrationTicket = null;
+
             // If not authenticated, nothing to logout from
             if (!this.isAuthenticated) {
                 return { success: true };
@@ -941,19 +999,8 @@ function initializeAuthStore() {
                 this.otpPhrase = null;
                 this._otpUserId = null;
 
-                // Stop teams realtime subscription if active
-                if (this.stopTeamsRealtime) {
-                    this.stopTeamsRealtime();
-                }
-
-                // Stop teams polling if active (fallback)
-                if (this.stopTeamsPolling) {
-                    this.stopTeamsPolling();
-                }
-
-                // Clear teams on logout
-                this.teams = [];
-                this.currentTeam = null;
+                // Clear teams (stops realtime/polling, discards in-flight lists)
+                this._resetTeamsState();
 
                 // Restore to guest state after logout (guest-auto only, and not when
                 // already a guest — don't mint a new guest on top).
@@ -987,19 +1034,8 @@ function initializeAuthStore() {
                     this.user = null;
                     this.session = null;
                 }
-                // Stop teams realtime subscription if active
-                if (this.stopTeamsRealtime) {
-                    this.stopTeamsRealtime();
-                }
-
-                // Stop teams polling if active (fallback)
-                if (this.stopTeamsPolling) {
-                    this.stopTeamsPolling();
-                }
-
                 // Clear teams on logout error too
-                this.teams = [];
-                this.currentTeam = null;
+                this._resetTeamsState();
                 if (!this.isAuthenticated) this._clearIdentity();
                 // Expired session (401) is still a logout: scoped data must drop the old rows
                 syncStateToStorage(this);
@@ -1035,8 +1071,7 @@ function initializeAuthStore() {
                 this._oauthProvider = null;
 
                 // Clear teams
-                this.teams = [];
-                this.currentTeam = null;
+                this._resetTeamsState();
 
                 // Clear OAuth provider from storage
                 try {
@@ -1057,8 +1092,7 @@ function initializeAuthStore() {
                 this.session = null;
                 this.magicLinkSent = false;
                 this.magicLinkExpired = false;
-                this.teams = [];
-                this.currentTeam = null;
+                this._resetTeamsState();
                 syncStateToStorage(this);
                 window.dispatchEvent(new CustomEvent('manifest:auth:session-cleared'));
                 return { success: false, error: error.message };
@@ -1080,12 +1114,18 @@ function initializeAuthStore() {
                 return this.user;
             } catch (error) {
                 if (!isNoSession(error)) throw error;
+                const prevId = shownUserId(this);
                 markVerified(this);
                 this.isAuthenticated = false;
                 this.isAnonymous = false;
                 this.user = null;
                 this.session = null;
                 syncStateToStorage(this);
+                if (prevId) {
+                    this.teams = [];
+                    this.currentTeam = null;
+                    window.dispatchEvent(new CustomEvent('manifest:auth:session-cleared'));
+                }
                 throw error;
             }
         }
@@ -1487,6 +1527,12 @@ function initializeTeamsCore() {
                     return { success: false, error: 'You must be signed in to list teams' };
                 }
 
+                // Answer for this identity only: a reset or identity change discards it
+                const owner = this.user?.$id || null;
+                const generation = this._teamsEpoch;
+                const stale = () => !this.isAuthenticated || (this.user?.$id || null) !== owner || this._teamsEpoch !== generation;
+                const discarded = { success: false, error: 'Identity changed during team load', stale: true };
+
                 try {
                     const params = {
                         queries: queries
@@ -1495,6 +1541,7 @@ function initializeTeamsCore() {
                         params.search = search;
                     }
                     const result = await this._appwrite.teams.list(params);
+                    if (stale()) return discarded;
 
                     // Update store with teams
                     this.teams = result.teams || [];
@@ -1514,19 +1561,24 @@ function initializeTeamsCore() {
                     if (window.ManifestAppwriteAuthTeamsDefaults && this.isTeamImmutable) {
                         for (const team of this.teams) {
                             if (!this._teamImmutableCache[team.$id]) {
-                                this._teamImmutableCache[team.$id] = await this.isTeamImmutable(team.$id);
+                                const immutable = await this.isTeamImmutable(team.$id);
+                                if (stale()) return discarded;
+                                this._teamImmutableCache[team.$id] = immutable;
                             }
                         }
                     }
 
                     // Load deleted template teams (if defaults module is loaded)
                     if (window.ManifestAppwriteAuthTeamsDefaults && this.getDeletedTemplateTeams) {
-                        this.deletedTemplateTeams = await this.getDeletedTemplateTeams();
+                        const deletedTemplateTeams = await this.getDeletedTemplateTeams();
+                        if (stale()) return discarded;
+                        this.deletedTemplateTeams = deletedTemplateTeams;
                     }
 
                     // Clean up duplicate default teams (permanent/template) if any exist
                     if (window.ManifestAppwriteAuthTeamsDefaults && this.cleanupDuplicateDefaultTeams) {
                         const cleanupResult = await this.cleanupDuplicateDefaultTeams();
+                        if (stale()) return discarded;
                         if (cleanupResult.cleaned > 0) {
                             if (cleanupResult.errors && cleanupResult.errors.length > 0) {
                                 console.warn('[Manifest Appwrite Auth] Some duplicate teams could not be deleted:', cleanupResult.errors);
@@ -1535,12 +1587,15 @@ function initializeTeamsCore() {
                             if (this.listTeams) {
                                 await this.listTeams();
                             }
+                            if (stale()) return discarded;
                         }
                     }
 
                     // Load deleted template roles for current team (if roles defaults module is loaded)
                     if (this.currentTeam && this.currentTeam.$id && window.ManifestAppwriteAuthTeamsRolesDefaults && this.getDeletedTemplateRoles) {
-                        this.deletedTemplateRoles = await this.getDeletedTemplateRoles(this.currentTeam.$id);
+                        const deletedTemplateRoles = await this.getDeletedTemplateRoles(this.currentTeam.$id);
+                        if (stale()) return discarded;
+                        this.deletedTemplateRoles = deletedTemplateRoles;
                     }
 
                     // Set currentTeam to first default team if available and not already set
@@ -1549,8 +1604,10 @@ function initializeTeamsCore() {
                         const hasDefaultTeams = (appwriteConfig?.permanentTeams && Array.isArray(appwriteConfig.permanentTeams) && appwriteConfig.permanentTeams.length > 0) ||
                             (appwriteConfig?.templateTeams && Array.isArray(appwriteConfig.templateTeams) && appwriteConfig.templateTeams.length > 0);
 
+                        if (stale()) return discarded;
                         if (hasDefaultTeams && window.ManifestAppwriteAuthTeamsDefaults && this.getDefaultTeams) {
                             const defaultTeams = await this.getDefaultTeams();
+                            if (stale()) return discarded;
                             if (defaultTeams.length > 0) {
                                 this.currentTeam = defaultTeams[0];
                             } else {
@@ -1565,12 +1622,14 @@ function initializeTeamsCore() {
                     if (this.currentTeam && this.currentTeam.$id && window.ManifestAppwriteAuthTeamsMembers && this.listMemberships) {
                         try {
                             const membershipsResult = await this.listMemberships(this.currentTeam.$id);
+                            if (stale()) return discarded;
                             if (membershipsResult.success) {
                                 this.currentTeamMemberships = membershipsResult.memberships || [];
                             }
                         } catch (error) {
                             // Silently handle errors (e.g., team was deleted)
                             // listMemberships already handles "team not found" gracefully
+                            if (stale()) return discarded;
                             this.currentTeamMemberships = [];
                         }
                     }
@@ -1580,6 +1639,7 @@ function initializeTeamsCore() {
                     // Check for any truthy value (function, object, or true flag)
                     if (!this._teamsRealtimeUnsubscribe && !this._teamsRealtimeSubscribing) {
                         const appwriteConfig = await config.getAppwriteConfig();
+                        if (stale()) return discarded;
                         if (this._appwrite?.realtime && this.startTeamsRealtime) {
                             this.startTeamsRealtime();
                         } else if (appwriteConfig?.teamsPollInterval && typeof appwriteConfig.teamsPollInterval === 'number' && appwriteConfig.teamsPollInterval > 0) {
@@ -1593,6 +1653,7 @@ function initializeTeamsCore() {
 
                     return { success: true, teams: result.teams || [], total: result.total || 0 };
                 } catch (error) {
+                    if (stale()) return discarded;
                     this.error = error.message;
                     return { success: false, error: error.message };
                 }
@@ -6474,26 +6535,33 @@ function initializeEmailOTP() {
 
                 this.inProgress = true;
                 this.error = null;
+                let guestEnded = false;
 
                 try {
                     const appwriteConfig = await config.getAppwriteConfig();
                     const wasGuest = this.isAnonymous;
 
-                    // Guest team carryover: issue the migration ticket now, while the guest
-                    // session is still authenticated; redeemed after the new session exists.
-                    let migrationTicket = null;
+                    // Guest team carryover: issue the migration ticket while the guest session
+                    // still authenticates. Kept on the store, bound to this code's account, so a
+                    // retry after a wrong code redeems it and no other sign-in can.
                     if (wasGuest && appwriteConfig?.guestMigrationFunctionId && this._callGuestMigration) {
                         const prep = await this._callGuestMigration('/prepare', {});
-                        if (prep?.ok && prep.ticket) migrationTicket = prep.ticket;
+                        if (prep?.ok && prep.ticket) {
+                            this._otpMigrationTicket = { ticket: prep.ticket, userId: this._otpUserId };
+                        }
                     }
+                    const kept = this._otpMigrationTicket;
+                    const migrationTicket = kept?.userId === this._otpUserId ? kept.ticket : null;
 
-                    // Appwrite can't convert anonymous accounts via OTP, so delete the
-                    // guest session first to avoid a "session prohibited" conflict.
+                    // Appwrite refuses createSession while any session is active, before it
+                    // checks the code, so the guest session must go first.
                     if (this.session && this.isAnonymous) {
                         try {
                             await this._appwrite.account.deleteSession(this.session.$id);
+                            guestEnded = true;
                         } catch (deleteError) {
-                            // Could not delete anonymous session
+                            const status = deleteError?.code || deleteError?.statusCode;
+                            guestEnded = status === 401 || status === 404;
                         }
                     }
 
@@ -6516,6 +6584,7 @@ function initializeEmailOTP() {
 
                     // Redeem the migration ticket as the new account to carry teams over.
                     // Best-effort; failure never blocks the already-successful sign-in.
+                    this._otpMigrationTicket = null;
                     if (migrationTicket && this._callGuestMigration) {
                         await this._callGuestMigration('/commit', { ticket: migrationTicket });
                     }
@@ -6541,7 +6610,7 @@ function initializeEmailOTP() {
                 } catch (error) {
                     const errorMessage = error.message || '';
                     const errorCode = error.code || error.statusCode || '';
-                    const isExpiredOrInvalid = errorMessage && (
+                    const isExpiredOrInvalid = error.type !== 'user_session_already_exists' && errorMessage && (
                         errorMessage.includes('expired') ||
                         errorMessage.includes('Invalid token') ||
                         errorMessage.includes('invalid') ||
@@ -6551,14 +6620,30 @@ function initializeEmailOTP() {
 
                     this.otpExpired = !!isExpiredOrInvalid;
                     this.error = isExpiredOrInvalid ? null : error.message;
-                    this.isAuthenticated = false;
-                    this.isAnonymous = false;
+
+                    // Guest session is gone though sign-in failed: drop its identity and teams.
+                    // otpSent, the code's userId and the migration ticket stay for a retry.
+                    if (guestEnded) {
+                        this.isAuthenticated = false;
+                        this.isAnonymous = false;
+                        this.user = null;
+                        this.session = null;
+                        if (this._resetTeamsState) {
+                            this._resetTeamsState();
+                        }
+                    }
 
                     if (this._syncStateToStorage) {
                         this._syncStateToStorage(this);
                     }
 
-                    return { success: false, error: error.message };
+                    if (guestEnded) {
+                        window.dispatchEvent(new CustomEvent('manifest:auth:session-cleared', {
+                            detail: { reason: 'otp-failed' }
+                        }));
+                    }
+
+                    return { success: false, error: error.message, guestEnded };
                 } finally {
                     this.inProgress = false;
                 }

package/lib/manifest.appwrite.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.225';
+const MANIFEST_BUILD_VERSION = '0.5.227';
 
 /* Manifest Data Sources - Appwrite Integration */
 

package/lib/manifest.d.ts

@@ -434,7 +434,7 @@ export interface ManifestTextEdit {
 export type ManifestDirective =
     | 'x-route' | 'x-anchors'
     | 'x-icon' | 'x-svg' | 'x-markdown' | 'x-code' | 'x-code-group'
-    | 'x-toast' | 'x-tooltip' | 'x-carousel' | 'x-virtual' | 'x-resize' | 'x-computed' | 'x-defer'
+    | 'x-toast' | 'x-tooltip' | 'x-carousel' | 'x-virtual' | 'x-computed' | 'x-defer'
     | 'x-chart' | 'x-date' | 'x-color' | 'x-colorpicker' | 'x-combobox'
     | 'x-export' | 'x-import' | 'x-pay' | 'x-files' | 'x-data-files'
     | 'x-edit' | 'x-text-edit';