mnfst 0.5.254 → 0.5.256

package/lib/manifest.appwrite.presences.js

@@ -6,6 +6,284 @@
 /*  Requires Alpine JS (alpinejs.dev) to operate
 */
 
+// mnfst:realtime.hub:start
+/* Shared Appwrite Realtime hub — ONE Realtime instance (one socket) per tab
+   across the data, auth and presences plugins. The first carrier to load
+   defines it; the build syncs this block byte-identical into each carrier
+   from scripts/snippets/manifest.realtime.hub.js.
+
+   Subscriptions are keyed by a caller-chosen name and ref-counted by
+   (channel + canonical server-filter key); server-side realtime queries ride
+   per subscription where the instance supports them (verified SDK/server
+   contract: see the manifest.data.realtime.js header). Messages are
+   classified ONCE — Appwrite sends ~20 event-name variants per change —
+   so each handler gets one (action, payload, response) call per message. */
+if (!window.ManifestRealtimeHub) {
+    window.ManifestRealtimeHub = (function () {
+        // Identity events drop the instance memo (the socket re-authenticates
+        // as the new session) and re-bind live subscriptions
+        const AUTH_EVENTS = ['manifest:auth:login', 'manifest:auth:logout', 'manifest:auth:anonymous', 'manifest:auth:session-cleared', 'manifest:auth:initialized'];
+
+        // One Realtime (one socket) per tab, keyed to the client it wraps
+        let realtimeCache = null;
+        let realtimeClient = null;
+        function acquire(client) {
+            if (!client || !window.Appwrite?.Realtime) return null;
+            if (!realtimeCache || realtimeClient !== client) {
+                realtimeCache = new window.Appwrite.Realtime(client);
+                realtimeClient = client;
+            }
+            return realtimeCache;
+        }
+
+        // Map<subKey, { channel, queries, refs, unsubscribe, handlers: Map<name, handler> }>
+        const entries = new Map();
+        // Map<name, { subKey, channel, token, handler, getFilters, getRealtime }>
+        const sources = new Map();
+        // Map<name, fn(action, payload, response)> — pre-filters, run once per message per name
+        const filters = new Map();
+        // Map<name, n> — explicit teardowns; aborts a subscribe in flight
+        const tombstones = new Map();
+        // Instance the current subscriptions live on
+        let activeRealtime = null;
+
+        // Reduce a message's event-name variants to the single most specific
+        // action: delete > update (upsert counts: presences) > create
+        function classify(events) {
+            const list = Array.isArray(events) ? events : (events ? [events] : []);
+            let action = null;
+            for (const event of list) {
+                if (typeof event !== 'string') continue;
+                // Verbs match as path segments only — event names embed
+                // user-chosen ids (a table named deleted_posts is not a delete)
+                const parts = event.split('.');
+                if (parts.includes('delete')) return 'delete';
+                if (parts.includes('update') || parts.includes('upsert')) action = 'update';
+                else if (!action && parts.includes('create')) action = 'create';
+            }
+            return action;
+        }
+
+        // Query-capable Realtime service: detect per instance, never assume
+        function supportsQueries(realtime) {
+            return !!(realtime && (realtime.pendingSubscribes || realtime.slotToSubscriptionId));
+        }
+
+        // (channel, resolved filter set) → stable subscription key; resolved.key
+        // is already canonical so equivalent filter sets share one subscription
+        function subKeyFor(channel, resolved) {
+            if (!resolved || !resolved.key) return channel;
+            return `${channel}\u001f${resolved.key}`;
+        }
+
+        // Fan one SDK message out, classified once: each registered handler gets
+        // ONE (action, payload, response) call per message, after that name's
+        // pre-filter (setFilter) — before any merge/dedup work
+        function dispatch(subKey, response) {
+            const entry = entries.get(subKey);
+            if (!entry || !response || !response.events) return;
+            const action = classify(response.events);
+            if (!action) return;
+            let payload = response.payload;
+            if (!payload || (!payload.$id && !payload.row)) payload = response;
+            for (const [name, handler] of entry.handlers) {
+                const filter = filters.get(name);
+                if (filter && filter(action, payload, response) === false) continue;
+                handler(action, payload, response);
+            }
+        }
+
+        // subscribe() returns an unsubscribe function (legacy client) or a
+        // Promise<RealtimeSubscription> (Realtime service): normalize teardown
+        function dropSub(sub) {
+            if (typeof sub === 'function') sub();
+            else if (sub && typeof sub.unsubscribe === 'function') sub.unsubscribe(); // per-subscription; never risks the shared socket
+            else if (sub && typeof sub.close === 'function') sub.close();
+        }
+
+        function makeUnsubscriber(result) {
+            if (!result || typeof result.then !== 'function') {
+                return () => { try { dropSub(result); } catch (e) { /* socket already gone */ } };
+            }
+            const settled = result.catch(() => null);
+            return () => { settled.then(dropSub).catch(() => { /* socket already gone */ }); };
+        }
+
+        function sdkSubscribe(realtime, subKey, channel, queries) {
+            const cb = response => dispatch(subKey, response);
+            const result = (queries && queries.length)
+                ? realtime.subscribe(channel, cb, queries)
+                : realtime.subscribe(channel, cb);
+            return makeUnsubscriber(result);
+        }
+
+        // Get or create the shared entry for (channel, filters); registered in the
+        // map before the SDK call so an event arriving mid-subscribe already dispatches
+        function ensureEntry(realtime, subKey, channel, queries) {
+            let entry = entries.get(subKey);
+            if (entry) return entry;
+            entry = { channel, queries: queries || [], refs: 0, unsubscribe: null, handlers: new Map() };
+            entries.set(subKey, entry);
+            try {
+                entry.unsubscribe = sdkSubscribe(realtime, subKey, channel, queries);
+            } catch (error) {
+                entries.delete(subKey);
+                throw error;
+            }
+            return entry;
+        }
+
+        function removeFromEntry(name, subKey) {
+            const entry = entries.get(subKey);
+            if (!entry) return;
+            entry.handlers.delete(name);
+            entry.refs = entry.handlers.size;
+            if (entry.refs === 0) {
+                entries.delete(subKey);
+                if (typeof entry.unsubscribe === 'function') {
+                    try { entry.unsubscribe(); } catch (e) { /* socket already gone */ }
+                }
+            }
+        }
+
+        // Drop a name's registration; tear the subscription down when the last one leaves
+        function detach(name, token) {
+            const cur = sources.get(name);
+            if (!cur || (token && cur.token !== token)) return;
+            sources.delete(name);
+            removeFromEntry(name, cur.subKey);
+        }
+
+        // Instance changed (rebuilt on identity change): re-resolve each name's
+        // filters ($auth. values are stale) and regroup subscriptions on the new
+        // instance. Chained so overlapping rebuilds run in order; superseded stops.
+        let syncChain = Promise.resolve();
+        function syncInstance(realtime) {
+            if (activeRealtime === realtime) return syncChain;
+            activeRealtime = realtime;
+            syncChain = syncChain
+                .then(() => rebindAll(realtime))
+                .catch(error => console.error('[Manifest Realtime] Rebind failed:', error));
+            return syncChain;
+        }
+
+        async function rebindAll(realtime) {
+            for (const [, entry] of entries) {
+                if (typeof entry.unsubscribe === 'function') {
+                    try { entry.unsubscribe(); } catch (e) { /* old instance */ }
+                }
+            }
+            entries.clear();
+            const canQuery = supportsQueries(realtime);
+            for (const [name, src] of sources) {
+                if (activeRealtime !== realtime) return; // superseded by a newer instance
+                try {
+                    // Inside the try: one source's failing getFilters must not
+                    // strand the sources after it unsubscribed
+                    const resolved = (canQuery && src.getFilters) ? await src.getFilters() : null;
+                    if (activeRealtime !== realtime) return;
+                    const subKey = subKeyFor(src.channel, resolved);
+                    const entry = ensureEntry(realtime, subKey, src.channel, resolved?.queries);
+                    entry.handlers.set(name, src.handler);
+                    entry.refs = entry.handlers.size;
+                    src.subKey = subKey;
+                } catch (error) {
+                    console.error('[Manifest Realtime] Failed to re-subscribe channel:', src.channel, error);
+                }
+            }
+        }
+
+        // One SDK subscribe per distinct (channel, filter set); names sharing both
+        // share it. getRealtime: async () => instance (re-run on identity rebuilds).
+        // isCurrent: false once the requesting load is superseded — skip, never
+        // touch a newer entry. getFilters: async () => ({ queries, key }) | null,
+        // re-run per (re)subscribe; null → channel-only subscribe. A replaced
+        // registration detaches only after the new subscription is live (no event
+        // gap); overlap double-delivery is the consumer's dedupe to absorb.
+        async function subscribe({ name, channel, onEvent, isCurrent, getFilters, getRealtime }) {
+            const epoch = tombstones.get(name) || 0;
+            const realtime = getRealtime ? await getRealtime() : null;
+            if (isCurrent && !isCurrent()) return null;
+            if (!realtime) {
+                detach(name);
+                return null;
+            }
+            await syncInstance(realtime);
+            if (isCurrent && !isCurrent()) return null;
+
+            const resolved = (supportsQueries(realtime) && getFilters) ? await getFilters() : null;
+            if (isCurrent && !isCurrent()) return null;
+            // Torn down while resolving: land nothing
+            if ((tombstones.get(name) || 0) !== epoch) return null;
+            // Instance replaced while resolving (identity rebuild): re-run against the live one
+            if (activeRealtime !== realtime) return subscribe({ name, channel, onEvent, isCurrent, getFilters, getRealtime });
+            const subKey = subKeyFor(channel, resolved);
+
+            const prev = sources.get(name);
+            let entry;
+            try {
+                entry = ensureEntry(realtime, subKey, channel, resolved?.queries);
+            } catch (error) {
+                console.error('[Manifest Realtime] Failed to subscribe:', channel, error);
+                detach(name);
+                return null;
+            }
+            const token = Symbol(name);
+            entry.handlers.set(name, onEvent);
+            entry.refs = entry.handlers.size;
+            sources.set(name, { subKey, channel, token, handler: onEvent, getFilters, getRealtime });
+            if (prev && prev.subKey !== subKey) removeFromEntry(name, prev.subKey);
+
+            return () => detach(name, token);
+        }
+
+        // Explicit teardown by name; also aborts a subscribe in flight and
+        // drops the name's pre-filter (a replacement re-registers its own)
+        function unsubscribe(name) {
+            tombstones.set(name, (tombstones.get(name) || 0) + 1);
+            filters.delete(name);
+            detach(name);
+        }
+
+        // Programmatic pre-filter: fn(action, payload, response) runs once per
+        // message per name BEFORE the handler; false drops it. null clears.
+        function setFilter(name, fn) {
+            if (fn == null) filters.delete(name);
+            else if (typeof fn === 'function') filters.set(name, fn);
+        }
+
+        // Identity events: drop the memo, then re-bind live subscriptions on a
+        // fresh instance from any registered source's getter
+        if (typeof window !== 'undefined') {
+            AUTH_EVENTS.forEach(type => window.addEventListener(type, async () => {
+                realtimeCache = null;
+                realtimeClient = null;
+                if (!sources.size) return;
+                try {
+                    const src = [...sources.values()].find(s => s.getRealtime);
+                    const realtime = src ? await src.getRealtime() : null;
+                    if (realtime) syncInstance(realtime);
+                } catch (error) {
+                    console.error('[Manifest Realtime] Identity rebuild failed:', error);
+                }
+            }));
+        }
+
+        return {
+            AUTH_EVENTS,
+            acquire,
+            subscribe,
+            unsubscribe,
+            setFilter,
+            classify,
+            supportsQueries,
+            _entries: entries, // Expose for debugging (keyed by channel + filter set)
+            _sources: sources
+        };
+    })();
+}
+// mnfst:realtime.hub:end
+
 (function () {
     'use strict';
 
@@ -14,12 +292,14 @@
     const ctx = {
         client: null,
         presences: null,
-        realtime: null,
         sub: null,
         heartbeat: null,
         started: false,
         status: 'online',
         metadata: null,
+        scope: 'auto',          // 'auto'/'team' = current team, 'global', or an explicit team id
+        teamsEnabled: false,    // manifest.appwrite.auth.teams (read at start)
+        settleTimer: null,      // bounded wait for teams to settle
         auto: true,             // focus/blur auto-flip
         heartbeatMs: 25000,     // TTL refresh cadence
         onFocus: null,
@@ -37,19 +317,14 @@
         });
     }
 
-    async function getConfig() {
+    // manifest.json appwrite.presences block ({ scope } today; true = defaults)
+    async function getPresencesConfig() {
         try {
-            const manifest = await window.ManifestDataConfig?.ensureManifest?.();
-            const aw = manifest?.appwrite;
-            if (!aw) return null;
-            const endpoint = resolveEnv(aw.endpoint);
-            const projectId = resolveEnv(aw.projectId);
-            if (!endpoint || !projectId) return null;
-            let devKey = aw.devKey ? resolveEnv(aw.devKey) : null;
-            if (devKey && /\$\{/.test(devKey)) devKey = null;
-            return { endpoint, projectId, devKey };
+            const manifest = await (window.ManifestDataConfig?.ensureManifest?.() || window.ManifestAppwriteAuthConfig?.ensureManifest?.());
+            const block = manifest?.appwrite?.presences ?? manifest?.appwrite?.presence;
+            return (block && typeof block === 'object') ? block : {};
         } catch (e) {
-            return null;
+            return {};
         }
     }
 
@@ -79,20 +354,62 @@
         return `hsl(${Math.abs(hash) % 360}, 70%, 50%)`;
     }
 
-    // Appwrite client + services — authed via the session cookie, not the dev key (which is the guests principal for user ops)
+    // Shared Appwrite client via the auth plugin (a hard dependency) + the
+    // realtime hub: presences never constructs its own Client or Realtime, so
+    // data + auth + presence ride one socket per tab
     async function ensureServices() {
-        if (ctx.presences && ctx.realtime) return true;
+        if (ctx.presences && ctx.client) return true;
         const A = window.Appwrite;
-        if (!A || !A.Presences || !A.Realtime) return false;
-        const cfg = await getConfig();
-        if (!cfg) return false;
-        const client = new A.Client().setEndpoint(cfg.endpoint).setProject(cfg.projectId);
-        ctx.client = client;
-        ctx.presences = new A.Presences(client);
-        ctx.realtime = new A.Realtime(client);
+        if (!A || !A.Presences || !A.Realtime || !window.ManifestRealtimeHub) return false;
+        const services = await window.ManifestAppwriteAuthConfig?.getAppwriteClient?.();
+        if (!services?.client) return false;
+        ctx.client = services.client;
+        ctx.presences = new A.Presences(services.client);
         return true;
     }
 
+    /* Scope */
+
+    // Teams load in the background after auth init; until they settle, a scoped
+    // write must not fall back to read(users()) — that is the cross-tenant
+    // broadcast window. Settles on the auth event, or after a bounded wait for
+    // sessions the background load never covers (e.g. guests without guestTeams).
+    let teamsSettled = false;
+    window.addEventListener('manifest:auth:teams-loaded', () => { settleTeams(); });
+    ['manifest:auth:logout', 'manifest:auth:session-cleared', 'manifest:auth:login', 'manifest:auth:anonymous'].forEach(type =>
+        window.addEventListener(type, () => { teamsSettled = false; }));
+    function settleTeams() {
+        if (teamsSettled) return;
+        teamsSettled = true;
+        if (ctx.settleTimer) { clearTimeout(ctx.settleTimer); ctx.settleTimer = null; }
+        // Settled with a team: the team-switch effect rescopes. Settled with
+        // none: rewrite here, from self-only to the global users() grant.
+        if (ctx.started && !scopeTeamId()) { hydrate(); rescope(); }
+    }
+
+    // Roster scope as a team id: explicit id > current team ('auto'/'team') > none ('global')
+    function scopeTeamId() {
+        const s = ctx.scope;
+        if (s === 'global' || s === false || s == null) return null;
+        if (typeof s === 'string' && s !== 'auto' && s !== 'team') return s;
+        return currentTeamId();
+    }
+
+    // Client-side scope filter (always on, defense in depth): a team scope is
+    // not expressible as a server-side realtime query — the payload has no team
+    // field and $permissions is an array the server's strict equal can't match —
+    // so out-of-scope records drop here, before the store. Matches the plugin's
+    // own write convention: read(Role.team(teamId)).
+    function inScope(raw, userId) {
+        const team = scopeTeamId();
+        if (!team) return true;
+        const meId = authUser()?.$id;
+        if (meId && userId === meId) return true;
+        const perms = Array.isArray(raw?.$permissions) ? raw.$permissions : [];
+        // read("any") is explicitly world-readable: in every scope
+        return perms.some(p => p === 'read("any")' || p === `read("team:${team}")` || p.startsWith(`read("team:${team}/`));
+    }
+
     /* Records */
 
     function normalize(rec) {
@@ -129,7 +446,7 @@
             const res = await ctx.presences.list();
             const rows = res?.presences || res?.rows || res?.documents || [];
             const map = {};
-            rows.forEach(r => { const n = normalize(r); if (n) map[n.userId] = n; });
+            rows.forEach(r => { const n = normalize(r); if (n && inScope(r, n.userId)) map[n.userId] = n; });
             if (s) s.records = map;
         } catch (e) {
             if (s) s.error = e?.message || String(e);
@@ -138,30 +455,28 @@
 
     function subscribe() {
         const A = window.Appwrite;
-        try {
-            const handle = ctx.realtime.subscribe(A.Channel.presences(), (response) => {
-                if (!response) return;
-                const events = Array.isArray(response.events) ? response.events : (response.events ? [response.events] : []);
-                const rec = normalize(response.payload || response);
+        const hub = window.ManifestRealtimeHub;
+        const channel = (A.Channel && typeof A.Channel.presences === 'function') ? A.Channel.presences() : 'presences';
+        hub.subscribe({
+            name: 'presence:roster',
+            channel,
+            getRealtime: async () => hub.acquire(ctx.client),
+            // One classified call per message (presence upserts classify as update)
+            onEvent: (action, payload) => {
+                const rec = normalize(payload);
                 if (!rec) return;
                 // Ignore echoes of our own presence (tracked locally; delayed echoes would clobber newer status)
                 const meId = authUser()?.$id;
                 if (meId && rec.userId === meId) return;
-                if (events.some(e => typeof e === 'string' && e.includes('delete'))) removeRecord(rec.userId);
+                // A known record that LEAVES scope is removed, not just ignored
+                if (!inScope(payload, rec.userId)) { removeRecord(rec.userId); return; }
+                if (action === 'delete') removeRecord(rec.userId);
                 else putRecord(rec);
-            });
-            // Normalise the unsubscribe handle
-            if (handle && typeof handle.then === 'function') {
-                handle.then(r => { ctx.sub = typeof r === 'function' ? r : (r && r.close ? () => r.close() : null); });
-                ctx.sub = () => { handle.then(r => { if (typeof r === 'function') r(); else if (r && r.close) r.close(); }); };
-            } else if (typeof handle === 'function') {
-                ctx.sub = handle;
-            } else if (handle && typeof handle.close === 'function') {
-                ctx.sub = () => handle.close();
             }
-        } catch (e) {
+        }).catch(e => {
             const s = store(); if (s) s.error = e?.message || String(e);
-        }
+        });
+        ctx.sub = () => hub.unsubscribe('presence:roster');
     }
 
     /* Operations */
@@ -175,10 +490,16 @@
         ctx.status = status != null ? status : ctx.status;
         ctx.metadata = metadata !== undefined ? metadata : ctx.metadata;
 
-        // Read-scope + owner write (owner update/delete required, else updates 401)
-        const teamId = currentTeamId();
+        // Read-scope + owner write (owner update/delete required, else updates 401).
+        // Reads follow the roster scope: team role when scoped, all users when
+        // global. Scoped with teams NOT yet settled: self-only — never the
+        // users() broadcast (the leak window); settle/team-switch rewrites it.
+        const teamId = scopeTeamId();
+        const pending = !teamId && ctx.teamsEnabled && !teamsSettled
+            && ctx.scope !== 'global' && ctx.scope !== false;
+        const readRole = teamId ? A.Role.team(teamId) : (pending ? A.Role.user(user.$id) : A.Role.users());
         const permissions = [
-            teamId ? A.Permission.read(A.Role.team(teamId)) : A.Permission.read(A.Role.users()),
+            A.Permission.read(readRole),
             A.Permission.update(A.Role.user(user.$id)),
             A.Permission.delete(A.Role.user(user.$id))
         ];
@@ -202,6 +523,15 @@
         }
     }
 
+    // Scope change: old-scope rosters never receive a perms rewrite (delivery
+    // follows the OLD read grant), so delete first — the delete event still
+    // carries it — then re-upsert under the new scope
+    async function rescope() {
+        const user = authUser();
+        if (user && ctx.presences) { try { await ctx.presences.delete({ presenceId: user.$id }); } catch (e) { } }
+        await set(ctx.status, ctx.metadata);
+    }
+
     async function clear() {
         const user = authUser();
         if (!user || !ctx.presences) return;
@@ -226,10 +556,28 @@
         if (typeof opts.heartbeatMs === 'number') ctx.heartbeatMs = opts.heartbeatMs;
         if (typeof opts.status === 'string') ctx.status = opts.status;
 
+        // Scope: start() option > manifest appwrite.presences.scope > 'auto'
+        const cfg = await getPresencesConfig();
+        if (cfg.scope != null) ctx.scope = resolveEnv(cfg.scope);
+        if (opts.scope != null) ctx.scope = opts.scope;
+
         const s = store();
         if (!authUser()) { if (s) s.error = 'sign in required'; return false; }
         if (!(await ensureServices())) { if (s) s.error = 'Appwrite Presences unavailable'; return false; }
         if (ctx.started) return true;
+
+        // Teams settle via the auth plugin's background load; disabled teams or
+        // an already-active team settle now, and a bounded wait covers sessions
+        // the load never fires for (e.g. guests without guestTeams)
+        try {
+            const authCfg = await window.ManifestAppwriteAuthConfig?.getAppwriteConfig?.();
+            ctx.teamsEnabled = !!authCfg?.teams;
+        } catch (e) { ctx.teamsEnabled = false; }
+        if (!ctx.teamsEnabled || currentTeamId()) settleTeams();
+        else if (!teamsSettled && !ctx.settleTimer) {
+            ctx.settleTimer = setTimeout(() => { ctx.settleTimer = null; settleTeams(); }, 8000);
+        }
+
         ctx.started = true;
 
         await hydrate();
@@ -252,6 +600,7 @@
     }
 
     function stop() {
+        if (ctx.settleTimer) { clearTimeout(ctx.settleTimer); ctx.settleTimer = null; }
         if (ctx.heartbeat) { clearInterval(ctx.heartbeat); ctx.heartbeat = null; }
         if (ctx.onBlur) { window.removeEventListener('blur', ctx.onBlur); ctx.onBlur = null; }
         if (ctx.onFocus) { window.removeEventListener('focus', ctx.onFocus); ctx.onFocus = null; }
@@ -273,6 +622,21 @@
             });
         } catch (e) { }
 
+        // Re-scope on team switch: refilter the roster, delete + rewrite own
+        // presence (old teammates only see the delete; the rewrite isn't
+        // delivered to them once the read grant moves)
+        let lastTeam;
+        try {
+            Alpine.effect(() => {
+                const team = currentTeamId();
+                if (team === lastTeam) return;
+                lastTeam = team;
+                if (!ctx.started) return;
+                hydrate();
+                rescope();
+            });
+        } catch (e) { }
+
         const api = {
             start, stop, set, clear, of, all,
             get records() { return store()?.records || {}; },

package/lib/manifest.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.254';
+const MANIFEST_BUILD_VERSION = '0.5.256';
 
 /* Manifest Data Sources - Configuration */
 

package/lib/manifest.device.js

@@ -15,6 +15,11 @@ function manifestNativePlugin(name) {
     const cap = window.Capacitor;
     return (cap && cap.Plugins && cap.Plugins[name]) || null;
 }
+// Whether a plugin is in the native header list (no list: assume installed)
+function manifestNativeInstalled(name) {
+    const headers = window.Capacitor && window.Capacitor.PluginHeaders;
+    return !Array.isArray(headers) || headers.some(h => h && h.name === name);
+}
 // Whether a plugin exposes a native method. Bundled apps get a registerPlugin
 // Proxy where every property is a function, so prefer the native header; a
 // header list without this plugin means it isn't installed natively.
@@ -158,6 +163,7 @@ function initManifestNativeNetwork() {
 // namespaced localStorage fallback on the web. Intended for session tokens etc.
 // Native: a plugin registered as SecureStorage (@aparajita/capacitor-secure-storage,
 // or any getItem/setItem or get/set shape); $secure.use(adapter) overrides.
+// Native without a plugin rejects; never localStorage.
 // The web fallback is NOT encrypted — it degrades honestly, not securely.
 
 const MANIFEST_SECURE_NS = 'mnfst:';
@@ -228,25 +234,32 @@ function manifestSecureNativeBackend(plugin, name) {
     };
 }
 
-// Registered in JS but absent from the native header list
-function manifestSecureInstalled(name) {
-    const headers = window.Capacitor && window.Capacitor.PluginHeaders;
-    return !Array.isArray(headers) || headers.some(h => h && h.name === name);
-}
+const MANIFEST_SECURE_NONE = 'No secure-storage plugin is installed; install @aparajita/capacitor-secure-storage and run npx cap sync, or provide one with $secure.use(adapter)';
+const MANIFEST_SECURE_UNSYNCED = 'SecureStorage plugin is not installed natively; run npx cap sync';
 
-// Rejects every call; never falls back to unencrypted web storage
-function manifestSecureMissingBackend(name) {
-    const fail = (op) => async () => manifestSecureFail(op, new Error(name + ' plugin is not installed natively; run npx cap sync'));
+// Rejects every call, logs once; never falls back to unencrypted web storage
+let _manifestSecureMissingLogged = false;
+function manifestSecureMissingBackend(msg) {
+    const fail = (op) => async () => {
+        const e = new Error(msg);
+        if (!_manifestSecureMissingLogged) {
+            _manifestSecureMissingLogged = true;
+            try { console.error('[Manifest] $secure.' + op + ' failed', e); } catch (_) {}
+        }
+        throw e;
+    };
     return { get: fail('get'), set: fail('set'), remove: fail('remove'), keys: fail('keys'), clear: fail('clear') };
 }
 
+// Missing backends aren't cached, so a later-registered plugin is picked up
 let _manifestSecureBackend = null;
 function manifestSecureBackend() {
     if (_manifestSecureBackend) return _manifestSecureBackend;
-    const plugin = manifestNativeIsNative() ? manifestNativePlugin('SecureStorage') : null;
-    if (plugin && !manifestSecureInstalled('SecureStorage')) return manifestSecureMissingBackend('SecureStorage');
-    _manifestSecureBackend = plugin ? manifestSecureNativeBackend(plugin, 'SecureStorage') : manifestSecureWebBackend();
-    return _manifestSecureBackend;
+    if (!manifestNativeIsNative()) return (_manifestSecureBackend = manifestSecureWebBackend());
+    const plugin = manifestNativePlugin('SecureStorage');
+    if (!plugin) return manifestSecureMissingBackend(MANIFEST_SECURE_NONE);
+    if (!manifestNativeInstalled('SecureStorage')) return manifestSecureMissingBackend(MANIFEST_SECURE_UNSYNCED);
+    return (_manifestSecureBackend = manifestSecureNativeBackend(plugin, 'SecureStorage'));
 }
 
 function initManifestSecure() {

package/lib/manifest.integrity.json

@@ -1,7 +1,7 @@
 {
-  "manifest.appwrite.auth.js": "sha384-dsIWnH0qCAGSzAXMGrd8fvOrVl4tOIE6j5tC35JPTrQXZ56qLD36ARyvhR7vi3Id",
-  "manifest.appwrite.data.js": "sha384-2emZSbGBrkbdSTRNOsctnzbJ/wd8onhdPH5pKh99u6QwIQ3tl7C4Pc47kEFeTerJ",
-  "manifest.appwrite.presences.js": "sha384-JyVDWFT69b7Svq8J8p9tNWe2v9PZNQBY5UyhtOl1vnuHFAX0CRQ3MA9SiKq5wzNh",
+  "manifest.appwrite.auth.js": "sha384-9WNhIeSEzxxJm+yP7cV41kV2xyzyXgFCNpThqiREcNbb6tnIW6O7VRZPL2jwy9Nk",
+  "manifest.appwrite.data.js": "sha384-ot7BHrPKWwiWjT10bvg7/hVKHADiMVTG0zoC0zlG389de40O/L7YFzd3ZzDnKXN5",
+  "manifest.appwrite.presences.js": "sha384-qsRtzFCtW7pS+I95EQuZQoPAeZvBsNDSMFwDFBJriyCWcNv2Jo2KFvOweClJhowJ",
   "manifest.bindings.js": "sha384-lPtMf8Ykaic9gNVZKq8Scia1881ZeMAyxer3WCIkUNwwrgzGBWto1OXADUwjvORF",
   "manifest.charts.js": "sha384-G+huD7UvjF9zDovdVVlh4I5X1Mq4oNnJfoFg4NnGdP3R/4Skq9hy5cGuHNYLxDYm",
   "manifest.chat.js": "sha384-88DfMfJLoi2oxclVD2iIMDkIGAExMXq5k47mekUredlicLaP3oZY5bwtwqs+TqDF",
@@ -11,24 +11,24 @@
   "manifest.combobox.js": "sha384-MILTkrgsTzsYUjGo4ZuADqV85Xs4GmfB4xexfe9vbJMIoQTZ42W4zs+DTaVSPEsx",
   "manifest.components.js": "sha384-BUFA8h+G5Plr82sV7bKzO42pPoiRZwRQcKj1lt2ROFiKjjlkayU/vmkAFqEsdBA+",
   "manifest.computed.js": "sha384-GYML/e81gQfN+iDbqhPUgny8bINCyL+SrbTofoGk4hlCnLLjv51mCv42JMqq+ku5",
-  "manifest.data.js": "sha384-mDAMnK8WbWh2J33JtpcKA5rqNUXmqvVp7KRqgbRc2TGcPB8La78OIhmWAn+/sEgv",
+  "manifest.data.js": "sha384-1BIeRvJ8LOJLtCX4uPCepikXSOaSisgTTwfdRYAbChowEGJX1WGC7cfSSBsld0sM",
   "manifest.datepicker.js": "sha384-2XwFFnS4Bg5FDvG/v8x6KUvrjcBQEOYyTxynX2K/D/Qb3PI6+Y04lEwCnVDJLzwL",
   "manifest.defer.js": "sha384-GK9qJkYtchtyzSQ+3zmDQUJE3+au4qthT2M8JnFjXxgfwCH5IVKc2r3tackgMryU",
-  "manifest.device.js": "sha384-EYHIplzx+GmWqm3fgARB9BxtmJsNv9k+avS1RQo3PrIGku4shsMR7JtykWc3g2y1",
+  "manifest.device.js": "sha384-AWismZl/UjR/NqH7z4Sfg0DZLPpySDuS0tL34ZsbHdNYDD14JzBW9xp/ScmQKilQ",
   "manifest.dropdowns.js": "sha384-acufUps7R9WjqB4XXW5JLACqniuHJGM4CNTb2rF4B2Q/jv7ZRmsAwfr2McanOz3s",
   "manifest.edit.js": "sha384-MOgQNdNLeHijhR0u2W6ntoOulKFglsATCFDqkinesOU15tHoILk/JNzHKkGi5dUG",
   "manifest.export.js": "sha384-Rx6XvqBZc4apzP/FwcDr6yIln4/zNa08Q4ZqBZcEqUz1aNZQfl4h0+Ae7mqCQyuG",
   "manifest.icons.js": "sha384-kKOINpX70YzNO3FvkV6umrmO3f0KIu0DNbwB+ej55a7y/lhU7v/myQtXL0bwCTbt",
   "manifest.localization.js": "sha384-EImsIw8Z3l13V5eH9ZJF/yfsOfIvR1oPRNSArANkPji7V8O3IRf6zMwsNiAGj3Hk",
   "manifest.markdown.js": "sha384-heyDR40LXHaAmAuA+fa381uFwShk1oAqpFFY6E2Qq4T3VN0TQfRqyc++MF40K5Hj",
-  "manifest.native.js": "sha384-EYHIplzx+GmWqm3fgARB9BxtmJsNv9k+avS1RQo3PrIGku4shsMR7JtykWc3g2y1",
+  "manifest.native.js": "sha384-AWismZl/UjR/NqH7z4Sfg0DZLPpySDuS0tL34ZsbHdNYDD14JzBW9xp/ScmQKilQ",
   "manifest.payments.js": "sha384-8pofk2zhxtapPMpwnFyTelPMrYhShNhDCE722uQh/EYFvZFuPLmSdgunqsarVQjv",
   "manifest.rich.text.js": "sha384-ZBV9jXmu2nmprEHicddRE/m7nR4RPZtVc969Jte0+EJYBcVph7itkjcgN/61PyeC",
   "manifest.router.js": "sha384-9LMIkwrgnxmmFDv70TND2MRJF1z6Nl4yqG7fH5DbJ8oUIhdu/u4yUPSime1/EYhP",
   "manifest.slides.js": "sha384-3uRTkyK9XPLmnxI2+igZlpi4EyPlU/7IHj5j3BZJJ2KN455vXyk99fiXV3feO/XY",
   "manifest.status.js": "sha384-MBO345ab7H6Uq1X2dZLt4Ge1Gcra+Z2qYApvlAeIV8CJhDDJrz2FPXpp+Kcp8zcM",
   "manifest.svg.js": "sha384-qr/8H9+2cIhSXNbRWRtIdrDlTOxKlNJqwEefHvCYoiBNW/kKhPTFa109Orv/EBnb",
-  "manifest.sw.js": "sha384-tUvpqn6eVfGDN0UN1JJP/lNhiE6O4tukafpJdrWXt7jqO1WSSbCbcVMLTAKeozCG",
+  "manifest.sw.js": "sha384-BQY7u/VfJ7DZ23QutEXo4OU+EO646rWLdHPTLRB3JzwIY5InbZEtxAPYKMlQGu35",
   "manifest.tabs.js": "sha384-otU09H7jnawVKQdLAYpMCd3jx00tgyPVr42D2hLIBzN5dG4se505YesavdnMqEi1",
   "manifest.tailwind.js": "sha384-r/Jvqb+Piz21jUts10BbVAJoKkShOdJRVFpywyi4HPIi/OfOJq5CtPyWAPbdkMgt",
   "manifest.toasts.js": "sha384-3zkWxzw693pxg3QDFsoYCA3CqYaLKmBaMArULXODD66Utolpewl0OAeTB92aWUVv",