@pylonsync/sync 0.3.193 → 0.3.196

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.3.193",
+  "version": "0.3.196",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/index.ts

@@ -274,6 +274,15 @@ export class SyncEngine {
   private reactiveHandlers: Map<string, (msg: ReactiveMessage) => void> =
     new Map();
 
+  /**
+   * Listeners notified when the server signals a per-subscriber row
+   * revocation (`row-revoked` envelope). Used by `@pylonsync/loro`
+   * to evict the LoroDoc registry entry for a row whose policy was
+   * revoked mid-session. Plain Set so identity is the dedup key.
+   */
+  private rowEvictionListeners: Set<(entity: string, rowId: string) => void> =
+    new Set();
+
   /**
    * Register a binary-frame handler. Returns an unsubscribe fn that
    * pulls the handler back out — call on hook unmount / module
@@ -731,6 +740,28 @@ export class SyncEngine {
           return;
         }
 
+        // Server-driven revocation: a subscriber whose read policy
+        // was revoked mid-session for a specific row. Drop the row
+        // from the local replica at the current cursor seq so the
+        // tombstone supersedes any racing late-arriving WS update
+        // for the same row, and notify any LoroDoc subscriber
+        // (registered via `addRowEvictionListener`) so collaborative
+        // doc handles unmount cleanly.
+        //
+        // Distinct from a regular Delete change event because this
+        // envelope has no global seq — the row's underlying data
+        // hasn't been deleted, only the recipient's visibility of
+        // it. Other subscribers (with matching policy) keep their
+        // row intact.
+        if (
+          msg.type === "row-revoked" &&
+          typeof msg.entity === "string" &&
+          typeof msg.row_id === "string"
+        ) {
+          this.handleRowRevocation(msg.entity, msg.row_id);
+          return;
+        }
+
         // Session mutated server-side. Fires for select-org / clear-org
         // / session revoke — every tab connected as this user gets the
         // envelope (cross-machine too via the cluster bus). Trigger
@@ -1456,6 +1487,59 @@ export class SyncEngine {
     return this.refreshResolvedSession();
   }
 
+  /**
+   * Drop a row from the local replica because the server signaled
+   * that the current subscriber's read policy was revoked for it.
+   *
+   * Calls `LocalStore.revokeRow(entity, id, cursor.last_seq)` —
+   * NOT `reconcileRemove` — because the latter early-returns when
+   * the row isn't in memory (common for CRDT-only consumers using
+   * `useLoroDoc` without a JSON row). `revokeRow` always records
+   * the tombstone so a stale insert/update arriving after the
+   * revocation can't resurrect the row.
+   *
+   * Also notifies row-eviction listeners so external row-bound
+   * resources (LoroDoc registries, etc.) can unmount.
+   */
+  private handleRowRevocation(entity: string, rowId: string): void {
+    const removed = this.store.revokeRow(
+      entity,
+      rowId,
+      this.cursor.last_seq,
+    );
+    if (removed) {
+      // Persist the deletion through the same pipe as a real Delete
+      // event so on-disk replica + in-memory replica stay aligned.
+      // For CRDT-only consumers `removed` is false (the row was
+      // never materialized into `tables`), but the tombstone is
+      // still recorded above so future replays are filtered.
+      if (this.persistence) {
+        void this.persistence.deleteRow(entity, rowId).catch(() => {
+          /* best-effort */
+        });
+      }
+      this.store.notify();
+    }
+    for (const listener of this.rowEvictionListeners) {
+      listener(entity, rowId);
+    }
+  }
+
+  /**
+   * Register a listener invoked when the server signals a per-
+   * subscriber row revocation. Used by `@pylonsync/loro` to evict
+   * the LoroDoc registry entry for the row so collaborative doc
+   * handles unmount cleanly. Returns an unsubscribe function.
+   */
+  addRowEvictionListener(
+    listener: (entity: string, rowId: string) => void,
+  ): () => void {
+    this.rowEvictionListeners.add(listener);
+    return () => {
+      this.rowEvictionListeners.delete(listener);
+    };
+  }
+
   /**
    * Switch the caller's active tenant (organization) and refresh the
    * resolved session in one shot. Membership is verified server-side

package/src/local-store.ts

@@ -80,6 +80,29 @@ export class LocalStore {
     return true;
   }
 
+  /**
+   * Per-subscriber row revocation: the server signaled that the
+   * current client lost read access to a specific row. ALWAYS
+   * records the tombstone (even when the row isn't in memory), so
+   * a stale insert/update event that arrives after the revocation
+   * can't resurrect the row.
+   *
+   * `reconcileRemove` returns early when the row is absent — that's
+   * the right behavior for "did anything change?" reconcile passes,
+   * but wrong here: a CRDT-only consumer using `useLoroDoc` without
+   * a JSON row never had the row in `tables` to begin with, and
+   * without the tombstone any future server-issued insert
+   * (legitimate re-grant or a slow stale frame) would land.
+   *
+   * Returns true if the row was present + removed; the tombstone
+   * is recorded regardless.
+   */
+  revokeRow(entity: string, id: string, tombstoneSeq: number): boolean {
+    const removed = this.tables.get(entity)?.delete(id) ?? false;
+    this.recordTombstone(entity, id, tombstoneSeq);
+    return removed;
+  }
+
   private isTombstoned(entity: string, id: string, at_seq?: number): boolean {
     if (this.optimisticTombstones.get(entity)?.has(id)) return true;
     const tombSeq = this.tombstones.get(entity)?.get(id);