@pylonsync/sync 0.3.195 → 0.3.197

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.3.195",
+  "version": "0.3.197",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/index.ts

@@ -758,7 +758,15 @@ export class SyncEngine {
           typeof msg.entity === "string" &&
           typeof msg.row_id === "string"
         ) {
-          this.handleRowRevocation(msg.entity, msg.row_id);
+          // Server includes its current high-water seq when known —
+          // use it as the tombstone seq so an in-flight stale frame
+          // with `seq <= server_seq` is filtered locally. A
+          // legitimate re-grant at a higher seq still lands.
+          const revokeSeq =
+            typeof msg.seq === "number" && msg.seq > 0
+              ? msg.seq
+              : this.cursor.last_seq;
+          this.handleRowRevocation(msg.entity, msg.row_id, revokeSeq);
           return;
         }
 
@@ -1491,25 +1499,28 @@ export class SyncEngine {
    * Drop a row from the local replica because the server signaled
    * that the current subscriber's read policy was revoked for it.
    *
-   * Calls `LocalStore.reconcileRemove(entity, id, cursor.last_seq)`
-   * to record a tombstone at the current cursor. A future server
-   * issuing seqs strictly greater than the cursor can re-create
-   * the row if policy is re-granted; replays older than the cursor
-   * are filtered by the tombstone (closing the "WS update lands
-   * between revoke and tombstone" race).
+   * `tombstoneSeq` is the server's high-water seq at the time of
+   * revocation (from the envelope). Stale in-flight WS frames with
+   * `seq <= tombstoneSeq` are filtered locally; legitimate
+   * re-grant + re-insert at higher seqs still land. Also fires a
+   * catch-up pull on revocation so any frame with `seq >
+   * tombstoneSeq` that arrives before the next legitimate event
+   * gets reconciled against server truth.
+   *
+   * Uses `LocalStore.revokeRow` (not `reconcileRemove`) so the
+   * tombstone is recorded even for CRDT-only consumers whose row
+   * was never materialized into `tables`.
    *
    * Also notifies row-eviction listeners so external row-bound
    * resources (LoroDoc registries, etc.) can unmount.
    */
-  private handleRowRevocation(entity: string, rowId: string): void {
-    const removed = this.store.reconcileRemove(
-      entity,
-      rowId,
-      this.cursor.last_seq,
-    );
+  private handleRowRevocation(
+    entity: string,
+    rowId: string,
+    tombstoneSeq: number,
+  ): void {
+    const removed = this.store.revokeRow(entity, rowId, tombstoneSeq);
     if (removed) {
-      // Persist the deletion through the same pipe as a real Delete
-      // event so on-disk replica + in-memory replica stay aligned.
       if (this.persistence) {
         void this.persistence.deleteRow(entity, rowId).catch(() => {
           /* best-effort */
@@ -1520,6 +1531,11 @@ export class SyncEngine {
     for (const listener of this.rowEvictionListeners) {
       listener(entity, rowId);
     }
+    // Fire a catch-up pull so any in-flight frame with seq above
+    // the revocation tombstone is resolved against server truth.
+    // Fire-and-forget — pull is internally serialized so concurrent
+    // triggers coalesce.
+    void this.pull();
   }
 
   /**

package/src/local-store.ts

@@ -80,6 +80,29 @@ export class LocalStore {
     return true;
   }
 
+  /**
+   * Per-subscriber row revocation: the server signaled that the
+   * current client lost read access to a specific row. ALWAYS
+   * records the tombstone (even when the row isn't in memory), so
+   * a stale insert/update event that arrives after the revocation
+   * can't resurrect the row.
+   *
+   * `reconcileRemove` returns early when the row is absent — that's
+   * the right behavior for "did anything change?" reconcile passes,
+   * but wrong here: a CRDT-only consumer using `useLoroDoc` without
+   * a JSON row never had the row in `tables` to begin with, and
+   * without the tombstone any future server-issued insert
+   * (legitimate re-grant or a slow stale frame) would land.
+   *
+   * Returns true if the row was present + removed; the tombstone
+   * is recorded regardless.
+   */
+  revokeRow(entity: string, id: string, tombstoneSeq: number): boolean {
+    const removed = this.tables.get(entity)?.delete(id) ?? false;
+    this.recordTombstone(entity, id, tombstoneSeq);
+    return removed;
+  }
+
   private isTombstoned(entity: string, id: string, at_seq?: number): boolean {
     if (this.optimisticTombstones.get(entity)?.has(id)) return true;
     const tombSeq = this.tombstones.get(entity)?.get(id);