mnfst 0.5.256 → 0.5.258

package/lib/manifest.appwrite.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.256';
+const MANIFEST_BUILD_VERSION = '0.5.258';
 
 /* Manifest Data Sources - Appwrite Integration */
 

package/lib/manifest.appwrite.presences.js

@@ -298,8 +298,7 @@ if (!window.ManifestRealtimeHub) {
         status: 'online',
         metadata: null,
         scope: 'auto',          // 'auto'/'team' = current team, 'global', or an explicit team id
-        teamsEnabled: false,    // manifest.appwrite.auth.teams (read at start)
-        settleTimer: null,      // bounded wait for teams to settle
+        teamsEnabled: false,    // manifest.appwrite.auth.teams (read in ensureServices)
         auto: true,             // focus/blur auto-flip
         heartbeatMs: 25000,     // TTL refresh cadence
         onFocus: null,
@@ -363,6 +362,12 @@ if (!window.ManifestRealtimeHub) {
         if (!A || !A.Presences || !A.Realtime || !window.ManifestRealtimeHub) return false;
         const services = await window.ManifestAppwriteAuthConfig?.getAppwriteClient?.();
         if (!services?.client) return false;
+        // teamsEnabled gates the scoped (never-users()) grant: resolve it here
+        // so pre-start set() writes are covered, not only start()
+        try {
+            const authCfg = await window.ManifestAppwriteAuthConfig?.getAppwriteConfig?.();
+            ctx.teamsEnabled = !!authCfg?.teams;
+        } catch (e) { ctx.teamsEnabled = false; }
         ctx.client = services.client;
         ctx.presences = new A.Presences(services.client);
         return true;
@@ -370,23 +375,6 @@ if (!window.ManifestRealtimeHub) {
 
     /* Scope */
 
-    // Teams load in the background after auth init; until they settle, a scoped
-    // write must not fall back to read(users()) — that is the cross-tenant
-    // broadcast window. Settles on the auth event, or after a bounded wait for
-    // sessions the background load never covers (e.g. guests without guestTeams).
-    let teamsSettled = false;
-    window.addEventListener('manifest:auth:teams-loaded', () => { settleTeams(); });
-    ['manifest:auth:logout', 'manifest:auth:session-cleared', 'manifest:auth:login', 'manifest:auth:anonymous'].forEach(type =>
-        window.addEventListener(type, () => { teamsSettled = false; }));
-    function settleTeams() {
-        if (teamsSettled) return;
-        teamsSettled = true;
-        if (ctx.settleTimer) { clearTimeout(ctx.settleTimer); ctx.settleTimer = null; }
-        // Settled with a team: the team-switch effect rescopes. Settled with
-        // none: rewrite here, from self-only to the global users() grant.
-        if (ctx.started && !scopeTeamId()) { hydrate(); rescope(); }
-    }
-
     // Roster scope as a team id: explicit id > current team ('auto'/'team') > none ('global')
     function scopeTeamId() {
         const s = ctx.scope;
@@ -491,13 +479,13 @@ if (!window.ManifestRealtimeHub) {
         ctx.metadata = metadata !== undefined ? metadata : ctx.metadata;
 
         // Read-scope + owner write (owner update/delete required, else updates 401).
-        // Reads follow the roster scope: team role when scoped, all users when
-        // global. Scoped with teams NOT yet settled: self-only — never the
-        // users() broadcast (the leak window); settle/team-switch rewrites it.
+        // Scoped (teams enabled, scope not global): team grant when resolved,
+        // self-only until then — however long teams take — never the users()
+        // broadcast. users() is only for global scope or teams-disabled projects.
+        // The team-switch effect rescopes reactively when a team resolves/changes.
         const teamId = scopeTeamId();
-        const pending = !teamId && ctx.teamsEnabled && !teamsSettled
-            && ctx.scope !== 'global' && ctx.scope !== false;
-        const readRole = teamId ? A.Role.team(teamId) : (pending ? A.Role.user(user.$id) : A.Role.users());
+        const scoped = ctx.teamsEnabled && ctx.scope !== 'global' && ctx.scope !== false && ctx.scope != null;
+        const readRole = teamId ? A.Role.team(teamId) : (scoped ? A.Role.user(user.$id) : A.Role.users());
         const permissions = [
             A.Permission.read(readRole),
             A.Permission.update(A.Role.user(user.$id)),
@@ -566,18 +554,6 @@ if (!window.ManifestRealtimeHub) {
         if (!(await ensureServices())) { if (s) s.error = 'Appwrite Presences unavailable'; return false; }
         if (ctx.started) return true;
 
-        // Teams settle via the auth plugin's background load; disabled teams or
-        // an already-active team settle now, and a bounded wait covers sessions
-        // the load never fires for (e.g. guests without guestTeams)
-        try {
-            const authCfg = await window.ManifestAppwriteAuthConfig?.getAppwriteConfig?.();
-            ctx.teamsEnabled = !!authCfg?.teams;
-        } catch (e) { ctx.teamsEnabled = false; }
-        if (!ctx.teamsEnabled || currentTeamId()) settleTeams();
-        else if (!teamsSettled && !ctx.settleTimer) {
-            ctx.settleTimer = setTimeout(() => { ctx.settleTimer = null; settleTeams(); }, 8000);
-        }
-
         ctx.started = true;
 
         await hydrate();
@@ -600,7 +576,6 @@ if (!window.ManifestRealtimeHub) {
     }
 
     function stop() {
-        if (ctx.settleTimer) { clearTimeout(ctx.settleTimer); ctx.settleTimer = null; }
         if (ctx.heartbeat) { clearInterval(ctx.heartbeat); ctx.heartbeat = null; }
         if (ctx.onBlur) { window.removeEventListener('blur', ctx.onBlur); ctx.onBlur = null; }
         if (ctx.onFocus) { window.removeEventListener('focus', ctx.onFocus); ctx.onFocus = null; }

package/lib/manifest.d.ts

@@ -306,7 +306,7 @@ export interface ManifestPush {
     [extra: string]: unknown;
 }
 
-/** `$secure` from the device plugin — secure key-value storage (native keychain or fallback). */
+/** `$secure` from the device plugin — Keychain/Keystore via a native plugin; unencrypted localStorage on the web only; rejects on native without a plugin. */
 export interface ManifestSecure {
     get(key: string): Promise<string | null>;
     set(key: string, value: string): Promise<void>;

package/lib/manifest.data.js

@@ -2,7 +2,7 @@
 
 (function () {
 
-const MANIFEST_BUILD_VERSION = '0.5.256';
+const MANIFEST_BUILD_VERSION = '0.5.258';
 
 /* Manifest Data Sources - Configuration */
 

package/lib/manifest.device.js

@@ -251,11 +251,12 @@ function manifestSecureMissingBackend(msg) {
     return { get: fail('get'), set: fail('set'), remove: fail('remove'), keys: fail('keys'), clear: fail('clear') };
 }
 
-// Missing backends aren't cached, so a later-registered plugin is picked up
+// Native and use() backends cached; web reused but never chosen on native
 let _manifestSecureBackend = null;
+let _manifestSecureWeb = null;
 function manifestSecureBackend() {
     if (_manifestSecureBackend) return _manifestSecureBackend;
-    if (!manifestNativeIsNative()) return (_manifestSecureBackend = manifestSecureWebBackend());
+    if (!manifestNativeIsNative()) return _manifestSecureWeb || (_manifestSecureWeb = manifestSecureWebBackend());
     const plugin = manifestNativePlugin('SecureStorage');
     if (!plugin) return manifestSecureMissingBackend(MANIFEST_SECURE_NONE);
     if (!manifestNativeInstalled('SecureStorage')) return manifestSecureMissingBackend(MANIFEST_SECURE_UNSYNCED);
@@ -480,7 +481,7 @@ function manifestBiometricPlugin() {
     if (Array.isArray(headers)) {
         for (const name of MANIFEST_BIOMETRIC_PLUGINS) {
             const plugin = manifestNativePlugin(name);
-            if (plugin && headers.some(h => h && h.name === name)) return { name, plugin };
+            if (plugin && manifestNativeInstalled(name)) return { name, plugin };
         }
         manifestBiometricWarnNotNative();
         return null;

package/lib/manifest.integrity.json

@@ -1,7 +1,7 @@
 {
   "manifest.appwrite.auth.js": "sha384-9WNhIeSEzxxJm+yP7cV41kV2xyzyXgFCNpThqiREcNbb6tnIW6O7VRZPL2jwy9Nk",
-  "manifest.appwrite.data.js": "sha384-ot7BHrPKWwiWjT10bvg7/hVKHADiMVTG0zoC0zlG389de40O/L7YFzd3ZzDnKXN5",
-  "manifest.appwrite.presences.js": "sha384-qsRtzFCtW7pS+I95EQuZQoPAeZvBsNDSMFwDFBJriyCWcNv2Jo2KFvOweClJhowJ",
+  "manifest.appwrite.data.js": "sha384-zpWExEiCs/Ccl9jDr2MSU5BU9MD0G69HFxsAg4el4T+slUj5a/dJa4WZuUmU3XkX",
+  "manifest.appwrite.presences.js": "sha384-/CagPsgWhO1sWEevCNGJmZ/ezRK9YCjLjvF7hxNSM4gVlJmEVtfSLfF7wnsRq441",
   "manifest.bindings.js": "sha384-lPtMf8Ykaic9gNVZKq8Scia1881ZeMAyxer3WCIkUNwwrgzGBWto1OXADUwjvORF",
   "manifest.charts.js": "sha384-G+huD7UvjF9zDovdVVlh4I5X1Mq4oNnJfoFg4NnGdP3R/4Skq9hy5cGuHNYLxDYm",
   "manifest.chat.js": "sha384-88DfMfJLoi2oxclVD2iIMDkIGAExMXq5k47mekUredlicLaP3oZY5bwtwqs+TqDF",
@@ -11,24 +11,24 @@
   "manifest.combobox.js": "sha384-MILTkrgsTzsYUjGo4ZuADqV85Xs4GmfB4xexfe9vbJMIoQTZ42W4zs+DTaVSPEsx",
   "manifest.components.js": "sha384-BUFA8h+G5Plr82sV7bKzO42pPoiRZwRQcKj1lt2ROFiKjjlkayU/vmkAFqEsdBA+",
   "manifest.computed.js": "sha384-GYML/e81gQfN+iDbqhPUgny8bINCyL+SrbTofoGk4hlCnLLjv51mCv42JMqq+ku5",
-  "manifest.data.js": "sha384-1BIeRvJ8LOJLtCX4uPCepikXSOaSisgTTwfdRYAbChowEGJX1WGC7cfSSBsld0sM",
+  "manifest.data.js": "sha384-xGbKjNmwqUapD++Kjx1XA/IAl01e1WiOVnXB/8XqX5mDgsyythAq1joIGY13XpYO",
   "manifest.datepicker.js": "sha384-2XwFFnS4Bg5FDvG/v8x6KUvrjcBQEOYyTxynX2K/D/Qb3PI6+Y04lEwCnVDJLzwL",
   "manifest.defer.js": "sha384-GK9qJkYtchtyzSQ+3zmDQUJE3+au4qthT2M8JnFjXxgfwCH5IVKc2r3tackgMryU",
-  "manifest.device.js": "sha384-AWismZl/UjR/NqH7z4Sfg0DZLPpySDuS0tL34ZsbHdNYDD14JzBW9xp/ScmQKilQ",
+  "manifest.device.js": "sha384-YeQaS56L8IILqrQNBSeAOLwIh5DuAOrE60cYLK1+46qJtUrXlAvqGe2j5mbV4Vq7",
   "manifest.dropdowns.js": "sha384-acufUps7R9WjqB4XXW5JLACqniuHJGM4CNTb2rF4B2Q/jv7ZRmsAwfr2McanOz3s",
   "manifest.edit.js": "sha384-MOgQNdNLeHijhR0u2W6ntoOulKFglsATCFDqkinesOU15tHoILk/JNzHKkGi5dUG",
   "manifest.export.js": "sha384-Rx6XvqBZc4apzP/FwcDr6yIln4/zNa08Q4ZqBZcEqUz1aNZQfl4h0+Ae7mqCQyuG",
   "manifest.icons.js": "sha384-kKOINpX70YzNO3FvkV6umrmO3f0KIu0DNbwB+ej55a7y/lhU7v/myQtXL0bwCTbt",
   "manifest.localization.js": "sha384-EImsIw8Z3l13V5eH9ZJF/yfsOfIvR1oPRNSArANkPji7V8O3IRf6zMwsNiAGj3Hk",
   "manifest.markdown.js": "sha384-heyDR40LXHaAmAuA+fa381uFwShk1oAqpFFY6E2Qq4T3VN0TQfRqyc++MF40K5Hj",
-  "manifest.native.js": "sha384-AWismZl/UjR/NqH7z4Sfg0DZLPpySDuS0tL34ZsbHdNYDD14JzBW9xp/ScmQKilQ",
+  "manifest.native.js": "sha384-YeQaS56L8IILqrQNBSeAOLwIh5DuAOrE60cYLK1+46qJtUrXlAvqGe2j5mbV4Vq7",
   "manifest.payments.js": "sha384-8pofk2zhxtapPMpwnFyTelPMrYhShNhDCE722uQh/EYFvZFuPLmSdgunqsarVQjv",
   "manifest.rich.text.js": "sha384-ZBV9jXmu2nmprEHicddRE/m7nR4RPZtVc969Jte0+EJYBcVph7itkjcgN/61PyeC",
   "manifest.router.js": "sha384-9LMIkwrgnxmmFDv70TND2MRJF1z6Nl4yqG7fH5DbJ8oUIhdu/u4yUPSime1/EYhP",
   "manifest.slides.js": "sha384-3uRTkyK9XPLmnxI2+igZlpi4EyPlU/7IHj5j3BZJJ2KN455vXyk99fiXV3feO/XY",
   "manifest.status.js": "sha384-MBO345ab7H6Uq1X2dZLt4Ge1Gcra+Z2qYApvlAeIV8CJhDDJrz2FPXpp+Kcp8zcM",
   "manifest.svg.js": "sha384-qr/8H9+2cIhSXNbRWRtIdrDlTOxKlNJqwEefHvCYoiBNW/kKhPTFa109Orv/EBnb",
-  "manifest.sw.js": "sha384-BQY7u/VfJ7DZ23QutEXo4OU+EO646rWLdHPTLRB3JzwIY5InbZEtxAPYKMlQGu35",
+  "manifest.sw.js": "sha384-8xS3BLZdBXUL7CSmurvYh6v1bvI1+X56IXme2ng3lTYzwLjLHdOYQEkll4YFpKj1",
   "manifest.tabs.js": "sha384-otU09H7jnawVKQdLAYpMCd3jx00tgyPVr42D2hLIBzN5dG4se505YesavdnMqEi1",
   "manifest.tailwind.js": "sha384-r/Jvqb+Piz21jUts10BbVAJoKkShOdJRVFpywyi4HPIi/OfOJq5CtPyWAPbdkMgt",
   "manifest.toasts.js": "sha384-3zkWxzw693pxg3QDFsoYCA3CqYaLKmBaMArULXODD66Utolpewl0OAeTB92aWUVv",

package/lib/manifest.native.js

@@ -251,11 +251,12 @@ function manifestSecureMissingBackend(msg) {
     return { get: fail('get'), set: fail('set'), remove: fail('remove'), keys: fail('keys'), clear: fail('clear') };
 }
 
-// Missing backends aren't cached, so a later-registered plugin is picked up
+// Native and use() backends cached; web reused but never chosen on native
 let _manifestSecureBackend = null;
+let _manifestSecureWeb = null;
 function manifestSecureBackend() {
     if (_manifestSecureBackend) return _manifestSecureBackend;
-    if (!manifestNativeIsNative()) return (_manifestSecureBackend = manifestSecureWebBackend());
+    if (!manifestNativeIsNative()) return _manifestSecureWeb || (_manifestSecureWeb = manifestSecureWebBackend());
     const plugin = manifestNativePlugin('SecureStorage');
     if (!plugin) return manifestSecureMissingBackend(MANIFEST_SECURE_NONE);
     if (!manifestNativeInstalled('SecureStorage')) return manifestSecureMissingBackend(MANIFEST_SECURE_UNSYNCED);
@@ -480,7 +481,7 @@ function manifestBiometricPlugin() {
     if (Array.isArray(headers)) {
         for (const name of MANIFEST_BIOMETRIC_PLUGINS) {
             const plugin = manifestNativePlugin(name);
-            if (plugin && headers.some(h => h && h.name === name)) return { name, plugin };
+            if (plugin && manifestNativeInstalled(name)) return { name, plugin };
         }
         manifestBiometricWarnNotNative();
         return null;

package/lib/manifest.schema.json

@@ -413,6 +413,23 @@
                         }
                     ]
                 },
+                "presence": {
+                    "description": "Alias of presences — enable the $presence plugin: true, or an options object.",
+                    "oneOf": [
+                        {
+                            "type": "boolean"
+                        },
+                        {
+                            "type": "object",
+                            "properties": {
+                                "scope": {
+                                    "type": "string",
+                                    "description": "Roster scope: 'auto'/'team' (current team when one is active, default), 'global', or an explicit team id. May reference an env var via ${VAR_NAME}."
+                                }
+                            }
+                        }
+                    ]
+                },
                 "auth": {
                     "type": "object",
                     "properties": {

package/lib/manifest.sw.js

@@ -16,7 +16,7 @@
 
 // Build stamps the published version here; unstamped (dev) falls back to the
 // registration URL's `v`, then 'dev'.
-const BUILD_VERSION = '0.5.256';
+const BUILD_VERSION = '0.5.258';
 const CACHE_PREFIX = 'mnfst-sw:';
 const META_CACHE = CACHE_PREFIX + 'meta';
 // Sized to hold a full precache.json warm-up (PRECACHE_MAX_ENTRIES server-side)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mnfst",
-    "version": "0.5.256",
+    "version": "0.5.258",
     "private": false,
     "workspaces": [
         "templates/starter",