mnfst 0.5.225 → 0.5.227

package/lib/manifest.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.225';
+const MANIFEST_BUILD_VERSION = '0.5.227';
 
 /* Manifest Data Sources - Configuration */
 
@@ -1593,6 +1593,7 @@ window.ManifestDataStore = {
         scope: '',
         generation: 0,
         pending: new Map(),    // source -> time its debounced write is due
+        landedIdentity: new Map(), // source -> identity its pending rows were read under
         writeTimer: null,
         hydrated: new Set(),   // sources hydrated (or attempted) this generation
         hydratedIdentity: null, // identity auth-dependent hydration last ran under
@@ -1609,10 +1610,10 @@ window.ManifestDataStore = {
     const liveLocale = () => (typeof document !== 'undefined' && document.documentElement?.lang)
         || (typeof Alpine !== 'undefined' && Alpine.store?.('locale')?.current) || 'en';
 
-    // Auth-dependent sources (scope / $auth. queries) carry the identity they were read under
+    // Auth-dependent sources (Appwrite tables/buckets, scope / $auth. queries) carry the identity they were read under
     function isAuthDependent(source) {
         if (!source || typeof source !== 'object') return false;
-        if (source.scope) return true;
+        if (source.scope || source.appwriteTableId || source.appwriteBucketId) return true;
         try { return JSON.stringify(source.queries || '').includes('$auth.'); } catch { return false; }
     }
 
@@ -1629,6 +1630,19 @@ window.ManifestDataStore = {
         return auth?._sessionUnverified === true;
     }
 
+    // Auth's last recorded identity (cross-tab mirror): '' signed out, null unknown
+    function lastKnownIdentity() {
+        try {
+            const saved = JSON.parse((typeof window !== 'undefined' && window.localStorage?.getItem('manifest:auth:state')) || 'null');
+            if (!saved || typeof saved !== 'object') return null;
+            return saved.isAuthenticated ? (String(saved.user?.$id || saved.user?.id || '') || null) : '';
+        } catch { return null; }
+    }
+
+    // Unconfirmed (booting / offline): hydration trusts the last recorded identity; the data reset covers a mismatch
+    function unconfirmed() { return authIdentity() === null || authUnverified(); }
+    function hydrationIdentity() { return unconfirmed() ? lastKnownIdentity() : authIdentity(); }
+
     function warnOnce(key, message, error) {
         if (state.warned.has(key)) return;
         state.warned.add(key);
@@ -1735,6 +1749,7 @@ window.ManifestDataStore = {
     function register(source, config) {
         const cfg = normalizeConfig(config === undefined ? true : config);
         if (!cfg) { state.sources.delete(source); return false; }
+        cfg.authDependent = isAuthDependent(state.manifest?.data?.[source] || state.manifest?.appwrite?.[source]);
         state.sources.set(source, cfg);
         state.hydrated.delete(source);
         state.fetchKicked.delete(source);
@@ -1819,12 +1834,22 @@ window.ManifestDataStore = {
         if (next !== state.scope) changeScope(next);
     }
 
+    // Pending saves of rows read under an identity that has since changed never land
+    function dropStaleWrites() {
+        if (unconfirmed()) return;
+        const identity = authIdentity();
+        for (const [source, landed] of [...state.landedIdentity]) {
+            if (landed !== null && landed !== identity) cancelWrites(source);
+        }
+    }
+
     function watchScope() {
         if (state.watching || typeof window === 'undefined') return;
         state.watching = true;
         for (const type of AUTH_EVENTS) {
             window.addEventListener(type, () => {
                 if (!state.enabled) return;
+                dropStaleWrites();
                 if (WIPE_EVENTS.has(type)) deleteScope(state.scope);
                 refreshScope();
                 if (!state.scopePending) hydrate(bootSources()).catch(() => { /* disabled */ });
@@ -1998,14 +2023,18 @@ window.ManifestDataStore = {
         return null;
     }
 
-    function snapshotRecord(source) {
+    function snapshotRecord(source, landed) {
         const cfg = state.sources.get(source);
         const ds = dataStore();
         if (!cfg || !ds) return null;
         const raw = ds.getRawData(source);
         if (raw === null || raw === undefined) return null;
-        const identity = cfg.authDependent ? authIdentity() : undefined;
-        if (identity === null) return null;
+        let identity;
+        if (cfg.authDependent) {
+            // Stamped with the identity the rows were read under; skipped if it changed since or was never known
+            identity = authUnverified() ? null : authIdentity();
+            if (identity === null || landed === null || (landed !== undefined && landed !== identity)) return null;
+        }
         try {
             const snapshot = snapshotOf(source, raw, cfg);
             if (snapshot === null) return null;
@@ -2028,9 +2057,10 @@ window.ManifestDataStore = {
 
     // Every source whose debounce has elapsed is written in ONE transaction
     function flush(sources) {
-        for (const source of sources) state.pending.delete(source);
+        const landedIdentity = new Map(sources.map(source => [source, state.landedIdentity.get(source)]));
+        for (const source of sources) { state.pending.delete(source); state.landedIdentity.delete(source); }
         if (!state.enabled || state.disabled) return Promise.resolve();
-        const records = sources.map(snapshotRecord).filter(Boolean);
+        const records = sources.map(source => snapshotRecord(source, landedIdentity.get(source))).filter(Boolean);
         if (!records.length) return Promise.resolve();
         const generation = state.generation;
         return withStore('readwrite', (store) => { for (const record of records) store.put(record); }).then(() => {
@@ -2062,8 +2092,9 @@ window.ManifestDataStore = {
     }
 
     function cancelWrites(source) {
-        if (source !== undefined) { state.pending.delete(source); return; }
+        if (source !== undefined) { state.pending.delete(source); state.landedIdentity.delete(source); return; }
         state.pending.clear();
+        state.landedIdentity.clear();
         if (state.writeTimer !== null) { clearTimeout(state.writeTimer); state.writeTimer = null; }
     }
 
@@ -2071,7 +2102,12 @@ window.ManifestDataStore = {
     function onLanded(sources) {
         if (!state.enabled || state.disabled || state.scopePending) return;   // nothing is keyed under an unresolved scope
         const at = Date.now() + WRITE_DEBOUNCE_MS;
-        for (const source of sources) if (state.sources.has(source)) state.pending.set(source, at);
+        const identity = hydrationIdentity();
+        for (const source of sources) {
+            if (!state.sources.has(source)) continue;
+            state.pending.set(source, at);
+            if (state.sources.get(source).authDependent) state.landedIdentity.set(source, identity);
+        }
         if (state.writeTimer !== null) { clearTimeout(state.writeTimer); state.writeTimer = null; }
         scheduleWrites();
     }
@@ -2085,8 +2121,11 @@ window.ManifestDataStore = {
         if (majorMinor(record.frameworkVersion) !== majorMinor(state.frameworkVersion)) return { ok: false, drop: true };
         if (record.locale && record.locale !== liveLocale()) return { ok: false };
         // Another identity's (or an unstamped) snapshot never hydrates: the scope alone may be '' for everyone
-        // An unverified (offline) signed-out boot keeps it for the session check to come back
-        if (cfg.authDependent && record.identity !== authIdentity()) return authUnverified() ? { ok: false } : { ok: false, drop: true };
+        // Before the session is confirmed (booting / offline) a mismatch is kept for the check to come back
+        if (cfg.authDependent) {
+            const identity = hydrationIdentity();
+            if (identity === null || record.identity !== identity) return unconfirmed() ? { ok: false } : { ok: false, drop: true };
+        }
         return { ok: true };
     }
 
@@ -2095,7 +2134,7 @@ window.ManifestDataStore = {
     async function hydrate(sources) {
         const ds = dataStore();
         // Auth-dependent sources wait for a known identity (re-run on auth events), and retry when it changes
-        const identity = authIdentity();
+        const identity = hydrationIdentity();
         const known = identity !== null;
         if (known && identity !== state.hydratedIdentity) {
             for (const [source, cfg] of state.sources) if (cfg.authDependent) state.hydrated.delete(source);
@@ -8666,10 +8705,8 @@ function createAppwriteMethodsHandler(dataSourceName, reloadDataSource) {
                     }
                     return null;
                 } else if (method === '$remove') {
-                    // Convenience method: delete file with automatic bucket reload and entry unlinking
+                    // Delete file(s), drop them from the source, unlink from table entries
                     // Usage: $x.assets.$remove(fileId)
-                    // Automatically reloads the entire assets bucket and unlinks from table entries
-                    // This is an alias for $delete with the same auto-reload functionality
                     const fileId = args[0];
                     if (!fileId) {
                         throw new Error('[Manifest Data] $remove requires file ID');
@@ -8687,20 +8724,15 @@ function createAppwriteMethodsHandler(dataSourceName, reloadDataSource) {
                         // Continue with delete even if unlink fails
                     }
 
-                    // Delete file(s) and reload in parallel for speed
-                    const deletePromise = Array.isArray(fileId)
-                        ? Promise.all(fileId.map(id => window.ManifestDataAppwrite.deleteFile(bucketId, id.$id || id)))
-                        : window.ManifestDataAppwrite.deleteFile(bucketId, actualFileId);
-
+                    const deletedIds = (Array.isArray(fileId) ? fileId : [fileId]).map(id => id.$id || id);
                     const generation = window.ManifestDataStore?.sourceGeneration?.(dataSourceName);
-                    const reloadPromise = window.ManifestDataAppwrite.listBucketFiles(bucketId, []);
-
-                    // Do delete and reload in parallel
-                    const [result, reloadedData] = await Promise.all([deletePromise, reloadPromise]);
+                    const result = Array.isArray(fileId)
+                        ? await Promise.all(deletedIds.map(id => window.ManifestDataAppwrite.deleteFile(bucketId, id)))
+                        : await window.ManifestDataAppwrite.deleteFile(bucketId, actualFileId);
 
-                    // Network landing: reloaded bucket listing replaces the source (coalesced)
-                    if (reloadedData && window.ManifestDataStore?.landRows) {
-                        await window.ManifestDataStore.landRows(dataSourceName, reloadedData, { mode: 'replace', generation });
+                    // Drop the deleted file(s) locally: a relisting would bypass the source's queries and scope
+                    if (window.ManifestDataStore?.landRemove) {
+                        await window.ManifestDataStore.landRemove(dataSourceName, deletedIds, { generation });
                     }
 
                     // Reload affected table data sources so fileIds arrays and counters
@@ -11427,13 +11459,14 @@ function scheduleAuthRetry(dataSourceName, locale) {
     AUTH_RETRY_EVENTS.forEach(type => window.addEventListener(type, retry));
 }
 
-// Teams known for this identity: login/anonymous dispatch after teams load, teams-loaded after the background load
+// Teams known for this identity: login/anonymous dispatch after teams load, teams-loaded after the background load.
+// A cross-tab login arrives before this tab's team load; its teams-loaded follows.
 let teamsSettledFor = null;
 // A sign-in deadline already answered by an auth event no longer holds sources
 let answeredDeadline = 0;
 if (typeof window !== 'undefined') {
     ['manifest:auth:teams-loaded', 'manifest:auth:login', 'manifest:auth:anonymous'].forEach(type =>
-        window.addEventListener(type, () => { teamsSettledFor = authUserId(currentAuth()); }));
+        window.addEventListener(type, e => { if (!e?.detail?.crossTab) teamsSettledFor = authUserId(currentAuth()); }));
     // Kept only when logout restored the same (guest) identity whose teams already loaded
     ['manifest:auth:logout', 'manifest:auth:session-cleared', 'manifest:auth:initialized'].forEach(type =>
         window.addEventListener(type, () => { if (type === 'manifest:auth:initialized' || teamsSettledFor !== authUserId(currentAuth())) teamsSettledFor = null; }));
@@ -11449,10 +11482,11 @@ function authUserId(auth) {
     return auth?.user?.$id || auth?.user?.id || null;
 }
 
-// Guest-auto or an auth callback is signing in after a signed-out init (bounded by the auth store)
+// Guest-auto or an auth callback is signing in after a signed-out init (bounded by the auth store).
+// Not while the session is unverified (no sign-in follows until Appwrite is reachable).
 // Prerender never waits on (or bakes) a guest's rows
 function signInWaitMs(auth) {
-    if (!auth || auth.isAuthenticated === true || window.__manifestRender) return 0;
+    if (!auth || auth.isAuthenticated === true || auth._sessionUnverified === true || window.__manifestRender) return 0;
     const until = auth._signInPendingUntil || 0;
     if (until === answeredDeadline) return 0;
     return Math.max(0, until - Date.now());
@@ -11489,15 +11523,39 @@ function authSettledUnresolvable(manifest) {
     return auth._initialized === true && auth.isAuthenticated === true && teamsSettled(auth, manifest);
 }
 
-function isAuthDependent(config) {
+// Rows depend on who reads them: scope / $auth. queries, or any Appwrite table/bucket (row/file permissions).
+// Reset on identity change only; whether a read needs an identity is buildAppwriteQueries' call (null = wait).
+function isIdentityBound(config) {
     if (!config || typeof config !== 'object') return false;
+    if (window.ManifestDataConfig?.isAppwriteCollection?.(config)) return true;
     if (window.ManifestDataConfig?.getScope?.(config)) return true;
     try { return JSON.stringify(config.queries || '').includes('$auth.'); } catch { return false; }
 }
 
-// Logout / session cleared: drop the previous identity's rows now, then settle for the new one
+// Auth's last recorded identity (cross-tab mirror): '' signed out, null unknown
+function lastKnownIdentity() {
+    try {
+        const saved = JSON.parse(window.localStorage?.getItem('manifest:auth:state') || 'null');
+        if (!saved || typeof saved !== 'object') return null;
+        return saved.isAuthenticated ? (String(saved.user?.$id || saved.user?.id || '') || null) : '';
+    } catch { return null; }
+}
+
+// Confirmed identity: '' signed out (or no auth plugin), null while booting or offline-unverified
+function confirmedIdentity() {
+    const auth = currentAuth();
+    if (!auth) return '';
+    if (auth._initialized !== true || (auth._sessionUnverified === true && auth.isAuthenticated !== true)) return null;
+    return auth.isAuthenticated === true ? (authUserId(auth) || '') : '';
+}
+
+// Identity change (sign-in, sign-out, account switch): identity-bound sources reload for the new identity.
+// A previous user's rows drop at once; rows read signed out stay live until the reload lands.
 function setupAuthResetListener() {
-    const reset = async () => {
+    let bound = (currentAuth() ? confirmedIdentity() : null) ?? lastKnownIdentity();
+    // Reads under an unverified session failed or came from the snapshot: confirming the same identity still reloads
+    let unverified = currentAuth()?._sessionUnverified === true;
+    const reset = async (clear) => {
         const manifest = await window.ManifestDataConfig?.ensureManifest?.();
         const ds = window.ManifestDataStore;
         const store = typeof Alpine !== 'undefined' ? Alpine.store('data') : null;
@@ -11506,14 +11564,32 @@ function setupAuthResetListener() {
         const configs = { ...(manifest.appwrite || {}), ...(manifest.data || {}) };
         const locale = liveLocale();
         for (const [name, config] of Object.entries(configs)) {
-            if (!isAuthDependent(config) || raw[`_${name}_state`] === undefined) continue;
-            window.ManifestDataRealtime?.unsubscribeFromDataSource?.(name);
-            ds.resetSource(name);
+            if (!isIdentityBound(config) || raw[`_${name}_state`] === undefined) continue;
+            if (clear) {
+                window.ManifestDataRealtime?.unsubscribeFromDataSource?.(name);
+                ds.resetSource(name);
+            }
             loadDataSource(name, locale, { reload: true });
         }
     };
-    window.addEventListener('manifest:auth:logout', reset);
-    window.addEventListener('manifest:auth:session-cleared', reset);
+    const onAuth = (type) => {
+        const ended = type === 'manifest:auth:logout' || type === 'manifest:auth:session-cleared';
+        const next = confirmedIdentity() ?? (ended ? '' : null);
+        if (next === null) { if (currentAuth()?._sessionUnverified === true) unverified = true; return; }
+        const prev = bound;
+        bound = next;
+        const recovered = unverified;
+        unverified = false;
+        // Same identity, or unknown before (rows so far were read under this same session; a sign-out still drops them):
+        // no reset, but an unverified boot's reads are redone with the rows kept live
+        if (prev === next || (prev === null && !ended)) {
+            if (recovered) reset(false);
+            return;
+        }
+        reset(prev !== '');
+    };
+    ['manifest:auth:logout', 'manifest:auth:session-cleared', 'manifest:auth:login', 'manifest:auth:anonymous', 'manifest:auth:initialized']
+        .forEach(type => window.addEventListener(type, () => onAuth(type)));
 }
 
 // Client-side scope filter: Appwrite returns all accessible files, so narrow to

package/lib/manifest.integrity.json

@@ -1,6 +1,6 @@
 {
-  "manifest.appwrite.auth.js": "sha384-eJ46LQV0lAoY48Zy1J8iecrK9azn/407FdeXz9+dwsuAJESUugOzlEBdTCw+i3m5",
-  "manifest.appwrite.data.js": "sha384-uWy++AIY+DZbiEm+Qhkqxc6OJ3E0NSzx5Mq+8TCaAAI+cCV6PSbrS84JRjYV2jNF",
+  "manifest.appwrite.auth.js": "sha384-dsIWnH0qCAGSzAXMGrd8fvOrVl4tOIE6j5tC35JPTrQXZ56qLD36ARyvhR7vi3Id",
+  "manifest.appwrite.data.js": "sha384-gyEWaIe2Vk2k+OZL3d1YHsn2GUzso/3+L0z5a5hsRvc6yisJxCqBu+TCcJaq1qgT",
   "manifest.appwrite.presences.js": "sha384-JyVDWFT69b7Svq8J8p9tNWe2v9PZNQBY5UyhtOl1vnuHFAX0CRQ3MA9SiKq5wzNh",
   "manifest.bindings.js": "sha384-lPtMf8Ykaic9gNVZKq8Scia1881ZeMAyxer3WCIkUNwwrgzGBWto1OXADUwjvORF",
   "manifest.charts.js": "sha384-gEAv/98+29RbhvNkiNWTNyBPbLTFr2Ld15wLu29FLCL57j1cwGChRrL9Pfk7dBtT",
@@ -11,7 +11,7 @@
   "manifest.combobox.js": "sha384-MILTkrgsTzsYUjGo4ZuADqV85Xs4GmfB4xexfe9vbJMIoQTZ42W4zs+DTaVSPEsx",
   "manifest.components.js": "sha384-4bc3HgPvF9DHMiOG08w+nWXI7Hho01RuAPAUL9xyLxOiS2igeZpulCVcvr5aT9v6",
   "manifest.computed.js": "sha384-GYML/e81gQfN+iDbqhPUgny8bINCyL+SrbTofoGk4hlCnLLjv51mCv42JMqq+ku5",
-  "manifest.data.js": "sha384-YljhDHjZ6BCU7qjoeecMvG1mgC7FwR7vw1EWBAyd6ZcMAlc3nmiztv3swRckN320",
+  "manifest.data.js": "sha384-nvTvY+1kswCEbVi8QZIpQHbWVUDipctUqRgv4yZCe2qbGmsGRGA4yK/UHVAEY3N8",
   "manifest.datepicker.js": "sha384-XnbeURni2X91ozVzatQcSjYYIS4MoW12dBRJnYAGBr0nCQ624heH5s+xtQSpLZX6",
   "manifest.defer.js": "sha384-WcCf8YQ1bKIXCLSZ24a0bJwepbYntYc8TzQM50hklo5VMIH8AtzDnwl6WU4prRv1",
   "manifest.device.js": "sha384-g+txmrEszYtuOvRelTp/c1wSNR2AtllVI9rx5NPPD7DzhVUnMNughonZykv2xlBW",
@@ -23,12 +23,11 @@
   "manifest.markdown.js": "sha384-JWUxlUZADxk1hZY7NpDX051UhtXt/ofpfsCDBRcweU6JhLbN8B832yPLgCatxFdl",
   "manifest.native.js": "sha384-g+txmrEszYtuOvRelTp/c1wSNR2AtllVI9rx5NPPD7DzhVUnMNughonZykv2xlBW",
   "manifest.payments.js": "sha384-8pofk2zhxtapPMpwnFyTelPMrYhShNhDCE722uQh/EYFvZFuPLmSdgunqsarVQjv",
-  "manifest.resize.js": "sha384-+0IsyrGP/4gZmNbD6oU8dCgEyhpBsXMm74NIenYeUGuGRWyJDurcG27xE/CA0/aA",
   "manifest.router.js": "sha384-xkQaHO60lMQwtnqGPxPJJ646eyqBjINs4AFesrQbe2dWqPIoIcJ9RD5wsjqjak7w",
   "manifest.slides.js": "sha384-3uRTkyK9XPLmnxI2+igZlpi4EyPlU/7IHj5j3BZJJ2KN455vXyk99fiXV3feO/XY",
   "manifest.status.js": "sha384-MBO345ab7H6Uq1X2dZLt4Ge1Gcra+Z2qYApvlAeIV8CJhDDJrz2FPXpp+Kcp8zcM",
   "manifest.svg.js": "sha384-qr/8H9+2cIhSXNbRWRtIdrDlTOxKlNJqwEefHvCYoiBNW/kKhPTFa109Orv/EBnb",
-  "manifest.sw.js": "sha384-hEYCjpYM1VHGJLc/RnSyUsmhBx/XrGhxCA31U6kW/TpFadcUZ0Uz96Rqm0uFbr+I",
+  "manifest.sw.js": "sha384-T29dPFWytpZW4ijBtvLGT4WZ0YPbF1whjHQbNVRw6RLYs5LMdO6LOcRlLPTC62CM",
   "manifest.tabs.js": "sha384-OIIcyaQnGS0eNYk4zgAFEDboNYect7THvUd9D0V6nqCeDOxQcoiqLrBEmmWVTTet",
   "manifest.tailwind.js": "sha384-r/Jvqb+Piz21jUts10BbVAJoKkShOdJRVFpywyi4HPIi/OfOJq5CtPyWAPbdkMgt",
   "manifest.text.edit.js": "sha384-RzOvLQE8GbmI6gntAwiotDewYT/08OHcd7sJ5hLon8e8u1Xbq1D7VfEGuaRVd2CE",

package/lib/manifest.sw.js

@@ -16,7 +16,7 @@
 
 // Build stamps the published version here; unstamped (dev) falls back to the
 // registration URL's `v`, then 'dev'.
-const BUILD_VERSION = '0.5.225';
+const BUILD_VERSION = '0.5.227';
 const CACHE_PREFIX = 'mnfst-sw:';
 const META_CACHE = CACHE_PREFIX + 'meta';
 // Sized to hold a full precache.json warm-up (PRECACHE_MAX_ENTRIES server-side)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mnfst",
-    "version": "0.5.225",
+    "version": "0.5.227",
     "private": false,
     "workspaces": [
         "templates/starter",
@@ -47,7 +47,8 @@
         "test:e2e:sdk": "node tests/e2e/payments.sdk.e2e.mjs",
         "test:e2e:sw": "node tests/e2e/sw.e2e.mjs",
         "lint": "echo 'No linting configured'",
-        "release:docs": "node scripts/release-bump.mjs packages/docs && cd packages/docs && npm publish --auth-type=web"
+        "release:docs": "node scripts/release-bump.mjs packages/docs && cd packages/docs && npm publish --auth-type=web",
+        "release:check": "node scripts/release-check.mjs"
     },
     "devDependencies": {
         "@rollup/plugin-commonjs": "^28.0.1",

package/lib/manifest.resize.css

@@ -1,194 +0,0 @@
-/* Manifest Resize Handles
-
-   Superseded by x-edit.size (manifest.edit.css) — kept for existing projects.
-   Self-contained: handle geometry lives here, not in a shared snippet. */
-
-@layer base, components, utilities;
-
-@layer utilities {
-
-    :where([x-resize]) {
-        position: relative;
-
-        /* Resize handle area */
-        .resize-handle {
-            position: absolute;
-            display: block;
-            width: var(--h);
-            height: var(--h);
-            z-index: 100;
-            background: transparent;
-            border: none;
-            outline: none;
-            --h: var(--spacing-resize-handle, 1rem);
-
-            /* Visible handle */
-            &::before {
-                content: '';
-                position: absolute;
-                top: 50%;
-                left: 50%;
-                transform: translate(-50%, -50%);
-                width: 1px;
-                height: 1px;
-                background: transparent;
-                transition: background-color 0.2s ease;
-                pointer-events: none
-            }
-
-            &:hover::before,
-            &:active::before {
-                background-color: var(--color-line, color-mix(in oklch, oklch(20.5% 0 0) 10%, transparent));
-            }
-        }
-
-        /* Handle geometry — edges span their axis, corners stay square */
-        .resize-handle-top,
-        .resize-handle-bottom {
-            left: 0;
-            width: 100%;
-            height: var(--h);
-            cursor: ns-resize;
-
-            &::before {
-                width: 100%
-            }
-        }
-
-        .resize-handle-left,
-        .resize-handle-right,
-        .resize-handle-start,
-        .resize-handle-end {
-            top: 0;
-            width: var(--h);
-            height: 100%;
-            cursor: ew-resize;
-
-            &::before {
-                height: 100%
-            }
-        }
-
-        .resize-handle-top {
-            top: calc(var(--h) * -0.5)
-        }
-
-        .resize-handle-bottom {
-            bottom: calc(var(--h) * -0.5)
-        }
-
-        .resize-handle-left,
-        .resize-handle-top-left,
-        .resize-handle-bottom-left {
-            left: calc(var(--h) * -0.5)
-        }
-
-        .resize-handle-right,
-        .resize-handle-top-right,
-        .resize-handle-bottom-right {
-            right: calc(var(--h) * -0.5)
-        }
-
-        /* Logical edges — inset-inline-* auto-flips for RTL */
-        .resize-handle-start,
-        .resize-handle-top-start,
-        .resize-handle-bottom-start {
-            inset-inline-start: calc(var(--h) * -0.5)
-        }
-
-        .resize-handle-end,
-        .resize-handle-top-end,
-        .resize-handle-bottom-end {
-            inset-inline-end: calc(var(--h) * -0.5)
-        }
-
-        .resize-handle-top-left,
-        .resize-handle-top-right,
-        .resize-handle-top-start,
-        .resize-handle-top-end {
-            top: calc(var(--h) * -0.5)
-        }
-
-        .resize-handle-bottom-left,
-        .resize-handle-bottom-right,
-        .resize-handle-bottom-start,
-        .resize-handle-bottom-end {
-            bottom: calc(var(--h) * -0.5)
-        }
-
-        /* Corner cursors */
-        .resize-handle-top-left,
-        .resize-handle-top-start {
-            cursor: nw-resize;
-        }
-
-        .resize-handle-top-right,
-        .resize-handle-top-end {
-            cursor: ne-resize;
-        }
-
-        .resize-handle-bottom-left,
-        .resize-handle-bottom-start {
-            cursor: sw-resize;
-        }
-
-        .resize-handle-bottom-right,
-        .resize-handle-bottom-end {
-            cursor: se-resize;
-        }
-
-        /* Screen overlay to get mouse coordinates */
-        .resize-overlay {
-            position: fixed;
-            top: 0;
-            left: 0;
-            width: 100vw;
-            height: 100vh;
-            z-index: 9999;
-            display: none;
-            background: transparent
-        }
-
-        /* Resize states */
-        .resizable-closing {
-            opacity: 0.5;
-            transition: opacity 0.2s ease
-        }
-
-        .resizable-closed {
-            display: none !important
-        }
-
-        /* Focus states for accessibility — framework ring (manifest.theme.css) */
-        .resize-handle:focus {
-            outline: none;
-            box-shadow: 0 0 0 2px color-mix(in oklch, var(--color-content-stark) 30%, transparent)
-        }
-
-        /* Reduced motion support */
-        @media (prefers-reduced-motion: reduce) {
-
-            :where(.resizable-closing,
-                .resize-handle) {
-                transition: none
-            }
-        }
-    }
-
-    /* RTL cursor flips — placement follows the logical insets in the shared geometry */
-    [dir=rtl] :where([x-resize]) .resize-handle-top-start {
-        cursor: ne-resize;
-    }
-
-    [dir=rtl] :where([x-resize]) .resize-handle-top-end {
-        cursor: nw-resize;
-    }
-
-    [dir=rtl] :where([x-resize]) .resize-handle-bottom-start {
-        cursor: se-resize;
-    }
-
-    [dir=rtl] :where([x-resize]) .resize-handle-bottom-end {
-        cursor: sw-resize;
-    }
-}