@spooky-sync/core 0.0.1-canary.215 → 0.0.1-canary.217

package/dist/index.d.ts

@@ -1314,6 +1314,10 @@ declare class Sp00kySync<S extends SchemaStructure> {
    * that a genuine drop minutes later still refetches.
    */
   private static readonly RECONNECT_REFETCH_COOLDOWN_MS;
+  /** Poll interval while waiting for a reconnected session to re-authenticate. */
+  private static readonly AUTH_READY_RETRY_MS;
+  /** Attempts before giving up on re-auth and skipping the refetch entirely. */
+  private static readonly AUTH_READY_MAX_ATTEMPTS;
   events: SyncEventSystem;
   private currentUserId;
   private tabRole;
@@ -1555,6 +1559,34 @@ declare class Sp00kySync<S extends SchemaStructure> {
    */
   private invalidateRefLiveQuery;
   private subscribeToReconnect;
+  /**
+   * Whether the REMOTE SESSION currently carries `$auth.id`.
+   *
+   * Not the same question as `currentUserId`, and that gap is the whole point:
+   * `currentUserId` is this client's own record of who signed in and survives a
+   * socket drop untouched, while `$auth` lives on the WebSocket session and has
+   * to be re-applied after every reconnect. Registering in the window between
+   * the two is silently destructive, because `fn::query::register` sends
+   * `<string>($auth.id OR '')` and the SSP stores that value write-once: the
+   * view's edges then route to the global `_00_list_ref` stamped `auth_id = ''`,
+   * which that table's own permission rule (`auth_id = $auth.id`) makes
+   * unreadable to the very user who registered it.
+   *
+   * Signed-out clients answer `true`: `''` is the honest identity there, not a
+   * race.
+   */
+  private remoteAuthEstablished;
+  /**
+   * Wait for the reconnected session to carry an identity again, then
+   * re-register every active query and re-bind LIVE.
+   *
+   * Giving up without registering is deliberately better than registering
+   * anyway: a registration made with no `$auth.id` produces a view its own
+   * owner cannot read, and it is write-once, so it stays that way. Skipping
+   * leaves the query unregistered and visibly loading, which the next
+   * reconnect or heartbeat retries.
+   */
+  private refetchAfterReconnect;
   private startRefLiveQueries;
   private handleRemoteListRefChange;
   /**

package/dist/index.js

@@ -5338,9 +5338,23 @@ var DownQueue = class {
 		return this.queue.length;
 	}
 	push(event) {
+		if (event.type === "register" && this.lastQueuedTypeFor(event.payload.hash) === "register") {
+			this.logger.debug({
+				hash: event.payload.hash,
+				Category: "sp00ky-client::DownQueue::push"
+			}, "Register already queued for this hash; coalescing");
+			return;
+		}
 		this.queue.push(event);
 		this.emitPushEvent();
 	}
+	/** Type of the last queued event for `hash`, or `undefined` if none. */
+	lastQueuedTypeFor(hash) {
+		for (let i = this.queue.length - 1; i >= 0; i--) {
+			const queued = this.queue[i];
+			if (queued.payload.hash === hash) return queued.type;
+		}
+	}
 	emitPushEvent() {
 		this._events.addEvent({
 			type: SyncQueueEventTypes.QueryItemEnqueued,
@@ -6012,6 +6026,10 @@ var Sp00kySync = class Sp00kySync {
 	* that a genuine drop minutes later still refetches.
 	*/
 	static RECONNECT_REFETCH_COOLDOWN_MS = 1e4;
+	/** Poll interval while waiting for a reconnected session to re-authenticate. */
+	static AUTH_READY_RETRY_MS = 500;
+	/** Attempts before giving up on re-auth and skipping the refetch entirely. */
+	static AUTH_READY_MAX_ATTEMPTS = 10;
 	events = createSyncEventSystem();
 	currentUserId = null;
 	tabRole = "solo";
@@ -6176,7 +6194,7 @@ var Sp00kySync = class Sp00kySync {
 				else if (this.downQueue.size > 0) await this.scheduler.syncDown();
 				else {
 					const hashes = this.dataModule.getActiveQueryHashes();
-					if (hashes.length > 0) {
+					if (hashes.length > 0 && await this.remoteAuthEstablished()) {
 						for (const hash of hashes) this.scheduler.enqueueDownEvent({
 							type: "register",
 							payload: { hash }
@@ -6725,21 +6743,75 @@ var Sp00kySync = class Sp00kySync {
 				return;
 			}
 			this.lastReconnectRefetchAt = Date.now();
-			const hashes = this.dataModule.getActiveQueryHashes();
-			this.logger.info({
-				queries: hashes.length,
-				Category: "sp00ky-client::Sp00kySync::onReconnect"
-			}, "Remote reconnected, refetching active queries");
-			for (const hash of hashes) this.scheduler.enqueueDownEvent({
-				type: "register",
-				payload: { hash }
-			});
-			if (this.currentUserId || this.anonLiveEnabled) this.restartRefLiveQuery().catch((err) => {
-				this.logger.debug({
-					err,
+			this.refetchAfterReconnect();
+		});
+	}
+	/**
+	* Whether the REMOTE SESSION currently carries `$auth.id`.
+	*
+	* Not the same question as `currentUserId`, and that gap is the whole point:
+	* `currentUserId` is this client's own record of who signed in and survives a
+	* socket drop untouched, while `$auth` lives on the WebSocket session and has
+	* to be re-applied after every reconnect. Registering in the window between
+	* the two is silently destructive, because `fn::query::register` sends
+	* `<string>($auth.id OR '')` and the SSP stores that value write-once: the
+	* view's edges then route to the global `_00_list_ref` stamped `auth_id = ''`,
+	* which that table's own permission rule (`auth_id = $auth.id`) makes
+	* unreadable to the very user who registered it.
+	*
+	* Signed-out clients answer `true`: `''` is the honest identity there, not a
+	* race.
+	*/
+	async remoteAuthEstablished() {
+		if (!this.currentUserId) return true;
+		try {
+			const result = await this.remote.query("RETURN <string>($auth.id OR '')");
+			const authId = Array.isArray(result) ? result[0] : void 0;
+			return typeof authId === "string" && authId.length > 0;
+		} catch (err) {
+			this.logger.debug({
+				err,
+				Category: "sp00ky-client::Sp00kySync::remoteAuthEstablished"
+			}, "Auth probe failed; treating the session as not yet authenticated");
+			return false;
+		}
+	}
+	/**
+	* Wait for the reconnected session to carry an identity again, then
+	* re-register every active query and re-bind LIVE.
+	*
+	* Giving up without registering is deliberately better than registering
+	* anyway: a registration made with no `$auth.id` produces a view its own
+	* owner cannot read, and it is write-once, so it stays that way. Skipping
+	* leaves the query unregistered and visibly loading, which the next
+	* reconnect or heartbeat retries.
+	*/
+	async refetchAfterReconnect() {
+		for (let attempt = 1; attempt <= Sp00kySync.AUTH_READY_MAX_ATTEMPTS; attempt++) {
+			if (await this.remoteAuthEstablished()) break;
+			if (attempt === Sp00kySync.AUTH_READY_MAX_ATTEMPTS) {
+				this.logger.warn({
+					attempts: attempt,
 					Category: "sp00ky-client::Sp00kySync::onReconnect"
-				}, "LIVE restart after reconnect failed; relying on poll fallback");
-			});
+				}, "Reconnected but the session still carries no $auth.id; not re-registering (a registration now would stamp every view with an empty identity)");
+				return;
+			}
+			await new Promise((resolve) => setTimeout(resolve, Sp00kySync.AUTH_READY_RETRY_MS));
+		}
+		const hashes = this.dataModule.getActiveQueryHashes();
+		this.logger.info({
+			queries: hashes.length,
+			Category: "sp00ky-client::Sp00kySync::onReconnect"
+		}, "Remote reconnected, refetching active queries");
+		for (const hash of hashes) this.scheduler.enqueueDownEvent({
+			type: "register",
+			payload: { hash }
+		});
+		if (this.currentUserId || this.anonLiveEnabled) this.restartRefLiveQuery().catch((err) => {
+			this.logger.debug({
+				err,
+				Category: "sp00ky-client::Sp00kySync::onReconnect"
+			}, "LIVE restart after reconnect failed; relying on poll fallback");
 		});
 	}
 	async startRefLiveQueries() {
@@ -7560,8 +7632,8 @@ function selfAllowlistedVariant(flag, userId) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.215";
-const WASM_VERSION = "0.0.1-canary.215";
+const CORE_VERSION = "0.0.1-canary.217";
+const WASM_VERSION = "0.0.1-canary.217";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class DevToolsService {
 	eventsHistory = [];
@@ -12572,7 +12644,7 @@ var Sp00kyClient = class {
 		return new TabsCoordinator({
 			tabId,
 			fingerprint: computeTabsFingerprint({
-				coreVersion: "0.0.1-canary.215",
+				coreVersion: "0.0.1-canary.217",
 				schemaHash: hash53(this.config.schemaSurql),
 				endpoint: this.config.database.endpoint ?? "",
 				namespace: this.config.database.namespace,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.215",
+  "version": "0.0.1-canary.217",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -60,8 +60,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.215",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.215",
+    "@spooky-sync/query-builder": "0.0.1-canary.217",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.217",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.0.3",
     "blurhash": "^2.0.5",

package/src/modules/sync/queue/queue-down.test.ts

@@ -12,6 +12,7 @@ const silentLogger = {
 } as any;
 
 const register = (hash: string) => ({ type: 'register', payload: { hash } }) as DownEvent;
+const cleanup = (hash: string) => ({ type: 'cleanup', payload: { hash } }) as DownEvent;
 
 const hashOf = (e: DownEvent) => e.payload.hash;
 
@@ -129,7 +130,7 @@ describe('DownQueue.takeNext (per-hash ordering under concurrency)', () => {
     // queue and is simply passed over.
     const q = makeQueue();
     q.push(register('a'));
-    q.push(register('a'));
+    q.push(cleanup('a'));
     q.push(register('b'));
 
     const busy = new Set(['a']);
@@ -138,7 +139,7 @@ describe('DownQueue.takeNext (per-hash ordering under concurrency)', () => {
 
     // Once 'a' frees up, its two events come back out in their original order.
     const rest = [q.takeNext(new Set())!, q.takeNext(new Set())!];
-    expect(rest.map(hashOf)).toEqual(['a', 'a']);
+    expect(rest.map((e) => e.type)).toEqual(['register', 'cleanup']);
     expect(q.size).toBe(0);
   });
 
@@ -178,3 +179,50 @@ describe('DownQueue.run', () => {
     expect(q.size).toBe(0);
   });
 });
+
+describe('DownQueue.push register coalescing', () => {
+  it('drops a register for a hash that already has one queued', () => {
+    // Four paths re-enqueue `register` for every active hash (reconnect,
+    // self-heal, re-mount, and a re-headed failure) and they stack: one tab was
+    // measured issuing 84 registrations in 93 seconds for 38 hashes. A register
+    // carries nothing but the hash, so the second is identical work.
+    const q = makeQueue();
+    q.push(register('a'));
+    q.push(register('a'));
+    q.push(register('a'));
+
+    expect(q.size).toBe(1);
+  });
+
+  it('keeps registers for DIFFERENT hashes', () => {
+    const q = makeQueue();
+    q.push(register('a'));
+    q.push(register('b'));
+
+    expect(q.size).toBe(2);
+  });
+
+  it('does NOT coalesce a register queued behind a cleanup for the same hash', () => {
+    // Ordering is per hash: dropping this register would let the cleanup tear
+    // the query down with nothing left to re-establish it.
+    const q = makeQueue();
+    q.push(register('a'));
+    q.push(cleanup('a'));
+    q.push(register('a'));
+
+    expect(q.size).toBe(3);
+    expect([q.takeNext(new Set())!, q.takeNext(new Set())!, q.takeNext(new Set())!].map((e) => e.type)).toEqual([
+      'register',
+      'cleanup',
+      'register',
+    ]);
+  });
+
+  it('leaves non-register events alone', () => {
+    const q = makeQueue();
+    q.push(cleanup('a'));
+    q.push(cleanup('a'));
+
+    expect(q.size).toBe(2);
+  });
+});

package/src/modules/sync/queue/queue-down.ts

@@ -70,10 +70,38 @@ export class DownQueue {
   }
 
   push(event: DownEvent) {
+    // Coalesce repeat registrations. Four separate paths re-enqueue `register`
+    // for every active hash — reconnect, self-heal while degraded, a
+    // re-mounted subscription, and a failed event re-headed by `run` — and
+    // they stack, so one tab was observed issuing 84 `fn::query::register`
+    // round trips in 93 seconds for 38 hashes. A register is idempotent and
+    // carries no payload beyond the hash, so a second one queued behind the
+    // first would re-do identical work.
+    //
+    // Only when the LAST queued event for the hash is itself a `register`.
+    // Ordering never mattered globally but it does per hash (see `takeNext`):
+    // dropping a register queued behind a `cleanup` would let the cleanup tear
+    // the query down with nothing to re-establish it.
+    if (event.type === 'register' && this.lastQueuedTypeFor(event.payload.hash) === 'register') {
+      this.logger.debug(
+        { hash: event.payload.hash, Category: 'sp00ky-client::DownQueue::push' },
+        'Register already queued for this hash; coalescing'
+      );
+      return;
+    }
     this.queue.push(event);
     this.emitPushEvent();
   }
 
+  /** Type of the last queued event for `hash`, or `undefined` if none. */
+  private lastQueuedTypeFor(hash: string): DownEvent['type'] | undefined {
+    for (let i = this.queue.length - 1; i >= 0; i--) {
+      const queued = this.queue[i]!;
+      if (queued.payload.hash === hash) return queued.type;
+    }
+    return undefined;
+  }
+
   private emitPushEvent() {
     this._events.addEvent({
       type: SyncQueueEventTypes.QueryItemEnqueued,

package/src/modules/sync/sync.ts

@@ -126,6 +126,10 @@ export class Sp00kySync<S extends SchemaStructure> {
    * that a genuine drop minutes later still refetches.
    */
   private static readonly RECONNECT_REFETCH_COOLDOWN_MS = 10_000;
+  /** Poll interval while waiting for a reconnected session to re-authenticate. */
+  private static readonly AUTH_READY_RETRY_MS = 500;
+  /** Attempts before giving up on re-auth and skipping the refetch entirely. */
+  private static readonly AUTH_READY_MAX_ATTEMPTS = 10;
   public events = createSyncEventSystem();
 
   // Auth identity that drives per-user `_00_list_ref_user_<id>` routing
@@ -405,8 +409,14 @@ export class Sp00kySync<S extends SchemaStructure> {
           // re-register active queries — mirroring the reconnect handler — so
           // there's a concrete op whose success flips health. If there are no
           // active queries either, probe connectivity directly.
+          // Same identity gate as the reconnect path: self-heal fires while
+          // sync is degraded, which is exactly when a session is most likely
+          // to have lost its `$auth`, and a register issued there stamps the
+          // view with an empty identity permanently. See
+          // `remoteAuthEstablished`.
           const hashes = this.dataModule.getActiveQueryHashes();
-          if (hashes.length > 0) {
+          const canRegister = hashes.length > 0 && (await this.remoteAuthEstablished());
+          if (canRegister) {
             for (const hash of hashes) {
               this.scheduler.enqueueDownEvent({ type: 'register', payload: { hash } });
             }
@@ -1177,29 +1187,89 @@ export class Sp00kySync<S extends SchemaStructure> {
         return;
       }
       this.lastReconnectRefetchAt = Date.now();
-      const hashes = this.dataModule.getActiveQueryHashes();
-      this.logger.info(
-        { queries: hashes.length, Category: 'sp00ky-client::Sp00kySync::onReconnect' },
-        'Remote reconnected, refetching active queries'
+      void this.refetchAfterReconnect();
+    });
+  }
+
+  /**
+   * Whether the REMOTE SESSION currently carries `$auth.id`.
+   *
+   * Not the same question as `currentUserId`, and that gap is the whole point:
+   * `currentUserId` is this client's own record of who signed in and survives a
+   * socket drop untouched, while `$auth` lives on the WebSocket session and has
+   * to be re-applied after every reconnect. Registering in the window between
+   * the two is silently destructive, because `fn::query::register` sends
+   * `<string>($auth.id OR '')` and the SSP stores that value write-once: the
+   * view's edges then route to the global `_00_list_ref` stamped `auth_id = ''`,
+   * which that table's own permission rule (`auth_id = $auth.id`) makes
+   * unreadable to the very user who registered it.
+   *
+   * Signed-out clients answer `true`: `''` is the honest identity there, not a
+   * race.
+   */
+  private async remoteAuthEstablished(): Promise<boolean> {
+    if (!this.currentUserId) return true;
+    try {
+      const result = await this.remote.query<[string]>("RETURN <string>($auth.id OR '')");
+      const authId = Array.isArray(result) ? result[0] : undefined;
+      return typeof authId === 'string' && authId.length > 0;
+    } catch (err) {
+      this.logger.debug(
+        { err, Category: 'sp00ky-client::Sp00kySync::remoteAuthEstablished' },
+        'Auth probe failed; treating the session as not yet authenticated'
       );
-      for (const hash of hashes) {
-        this.scheduler.enqueueDownEvent({ type: 'register', payload: { hash } });
-      }
-      // The WS reconnect leaves the server-side LIVE subscription dead — the
-      // re-enqueued `register` events only re-fetch initial state, they don't
-      // re-subscribe. Without this, LIVE never recovers after a reconnect and
-      // the poll silently becomes the sole sync path (and never backs off).
-      // Authenticated → per-user table; signed-out with anon live enabled →
-      // the shared `_00_list_ref_anon`. Otherwise there's no table to re-bind.
-      if (this.currentUserId || this.anonLiveEnabled) {
-        this.restartRefLiveQuery().catch((err) => {
-          this.logger.debug(
-            { err, Category: 'sp00ky-client::Sp00kySync::onReconnect' },
-            'LIVE restart after reconnect failed; relying on poll fallback'
-          );
-        });
+      return false;
+    }
+  }
+
+  /**
+   * Wait for the reconnected session to carry an identity again, then
+   * re-register every active query and re-bind LIVE.
+   *
+   * Giving up without registering is deliberately better than registering
+   * anyway: a registration made with no `$auth.id` produces a view its own
+   * owner cannot read, and it is write-once, so it stays that way. Skipping
+   * leaves the query unregistered and visibly loading, which the next
+   * reconnect or heartbeat retries.
+   */
+  private async refetchAfterReconnect(): Promise<void> {
+    for (let attempt = 1; attempt <= Sp00kySync.AUTH_READY_MAX_ATTEMPTS; attempt++) {
+      if (await this.remoteAuthEstablished()) break;
+      if (attempt === Sp00kySync.AUTH_READY_MAX_ATTEMPTS) {
+        this.logger.warn(
+          {
+            attempts: attempt,
+            Category: 'sp00ky-client::Sp00kySync::onReconnect',
+          },
+          'Reconnected but the session still carries no $auth.id; not re-registering (a registration now would stamp every view with an empty identity)'
+        );
+        return;
       }
-    });
+      await new Promise((resolve) => setTimeout(resolve, Sp00kySync.AUTH_READY_RETRY_MS));
+    }
+
+    const hashes = this.dataModule.getActiveQueryHashes();
+    this.logger.info(
+      { queries: hashes.length, Category: 'sp00ky-client::Sp00kySync::onReconnect' },
+      'Remote reconnected, refetching active queries'
+    );
+    for (const hash of hashes) {
+      this.scheduler.enqueueDownEvent({ type: 'register', payload: { hash } });
+    }
+    // The WS reconnect leaves the server-side LIVE subscription dead — the
+    // re-enqueued `register` events only re-fetch initial state, they don't
+    // re-subscribe. Without this, LIVE never recovers after a reconnect and
+    // the poll silently becomes the sole sync path (and never backs off).
+    // Authenticated → per-user table; signed-out with anon live enabled →
+    // the shared `_00_list_ref_anon`. Otherwise there's no table to re-bind.
+    if (this.currentUserId || this.anonLiveEnabled) {
+      this.restartRefLiveQuery().catch((err) => {
+        this.logger.debug(
+          { err, Category: 'sp00ky-client::Sp00kySync::onReconnect' },
+          'LIVE restart after reconnect failed; relying on poll fallback'
+        );
+      });
+    }
   }
 
   private async startRefLiveQueries() {