@pylonsync/sync 0.3.200 → 0.3.202

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.3.200",
+  "version": "0.3.202",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/index.ts

@@ -165,6 +165,23 @@ export class SyncEngine {
   private reconnectAttempts = 0;
   private persistence: import("./persistence").IndexedDBPersistence | null = null;
 
+  /**
+   * Flips true once `start()` has either:
+   *   - drained IndexedDB into the in-memory store (data path), OR
+   *   - decided the engine has no persistence layer (test / SSR / explicit opt-out).
+   *
+   * `useQuery`'s `loading` flag consumes this so apps don't render a
+   * "Loading…" flash on every page refresh when the disk replica
+   * already has the data. Without it, even returning visits show the
+   * spinner for the 50–200ms gap between component mount and IndexedDB
+   * `loadAllEntities()` resolving — visually identical to a true
+   * cold-start fetch.
+   */
+  private _hydrated = false;
+  isHydrated(): boolean {
+    return this._hydrated;
+  }
+
   readonly store: LocalStore;
   readonly mutations: MutationQueue;
 
@@ -395,7 +412,10 @@ export class SyncEngine {
         // subscribers re-read. Without this, if the subsequent pull returns
         // no changes (replica already at cursor), subscribers stay stuck on
         // their initial empty snapshot until the first WS event arrives.
+        this._hydrated = true;
         if (hydrated) this.store.notify();
+        else this.store.notify(); // notify even on empty cache so useQuery
+        // sees `isHydrated()` flip and can drop its initial loading state.
 
         // Load cursor.
         const savedCursor = await this.persistence.loadCursor();
@@ -439,6 +459,11 @@ export class SyncEngine {
         // IndexedDB not available — continue without persistence.
       }
     }
+    // Always flip `_hydrated` true by this point — even when persist
+    // was off or IndexedDB threw. useQuery's loading semantics depend
+    // on it; leaving false would pin every app with persist:false
+    // into a permanent "Loading…" state.
+    this._hydrated = true;
 
     // Seed the server-resolved session before the first pull so
     // `useSession` subscribers see the right tenant from frame one, and
@@ -458,10 +483,21 @@ export class SyncEngine {
     // the local IndexedDB has rows the server doesn't (deletes made by
     // another surface while this tab was closed, or events that fell
     // off the in-memory ChangeLog before this tab's cursor caught up).
-    // Fires after pull so we don't reconcile against rows that pull
-    // would have applied anyway. Errors are swallowed inside
-    // reconcileInner so a failed reconcile doesn't take down startup.
-    void this.reconcile();
+    //
+    // Deliberately NOT fired here anymore. Apps that select-org from
+    // a bootstrap effect race against this reconcile pass: the engine
+    // resolves /api/auth/me before selectOrg lands, tenant=null, the
+    // entity fetch returns 0 rows, every cached row gets tombstoned,
+    // and the user sees a "rows render then flash away" gap until
+    // selectOrg fires the session-changed envelope and the engine
+    // re-pulls. The visibility-change + WS-reconnect reconcile triggers
+    // below STILL run, so deletes made while the tab was closed
+    // converge on the next focus / reconnect — just not in the narrow
+    // window where the session might still be unresolved. Net effect:
+    // identical safety, no flash.
+    //
+    // The session-flip guard in reconcileInner is the second line of
+    // defense; this is the first. Belt + braces.
 
     // Wire the visibility-change reconcile so a tab that returns from
     // the background (laptop wakes, tab unhidden) catches up against
@@ -1459,7 +1495,27 @@ export class SyncEngine {
         this.lastSeenTenant !== undefined &&
         this.lastSeenTenant !== tenantNow
       ) {
-        await this.resetReplica();
+        // Two flavors of "tenant changed":
+        //
+        //   - null → X  : session first-resolution. The engine started
+        //                 before the app called /api/auth/select-org;
+        //                 /api/auth/me returned tenant_id=null at start
+        //                 and is only now reporting the real value.
+        //                 The cached IndexedDB rows ARE for tenant X
+        //                 (that's where the user's data lives), so
+        //                 wiping them would tombstone valid state and
+        //                 produce the "rows render then flash away"
+        //                 symptom multi-tenant apps were hitting. Skip
+        //                 the reset; pull under the new tenant fills
+        //                 any gaps via the existing cursor catch-up.
+        //
+        //   - X → Y     : actual org switch. Cached rows belong to
+        //                 the OLD tenant and must not bleed into the
+        //                 new context, so resetReplica is correct.
+        const firstResolution = this.lastSeenTenant === null && tenantNow !== null;
+        if (!firstResolution) {
+          await this.resetReplica();
+        }
         await this.pull();
       }
       this.lastSeenTenant = tenantNow;