@spooky-sync/core 0.0.1-canary.220 → 0.0.1-canary.221

package/dist/index.d.ts

@@ -79,6 +79,20 @@ declare class RemoteDatabaseService extends AbstractDatabaseService {
   private authToken;
   constructor(config: Sp00kyConfig<any>['database'], logger: Logger$1);
   getConfig(): Sp00kyConfig<any>['database'];
+  /**
+   * Send one SurrealQL statement so that it survives the page going away.
+   *
+   * A WebSocket `send()` during `pagehide` is not guaranteed to flush — the
+   * browser may tear the socket down first, and the frame is simply lost.
+   * Measured: an unload-time release over the live socket reached the server
+   * zero times out of one. `fetch` with `keepalive` is the primitive the
+   * platform actually guarantees here, so this goes over SurrealDB's HTTP
+   * `/sql` endpoint instead of the RPC socket.
+   *
+   * Best-effort by design: no await, no retry, errors swallowed. Every caller
+   * must have a server-side fallback that makes a lost beacon a non-event.
+   */
+  beaconSql(sql: string): void;
   /**
    * Record the token every future connect should authenticate with, or `null`
    * on sign-out. See {@link authToken}.

package/dist/index.js

@@ -1044,6 +1044,42 @@ var RemoteDatabaseService = class extends AbstractDatabaseService {
 		return this.config;
 	}
 	/**
+	* Send one SurrealQL statement so that it survives the page going away.
+	*
+	* A WebSocket `send()` during `pagehide` is not guaranteed to flush — the
+	* browser may tear the socket down first, and the frame is simply lost.
+	* Measured: an unload-time release over the live socket reached the server
+	* zero times out of one. `fetch` with `keepalive` is the primitive the
+	* platform actually guarantees here, so this goes over SurrealDB's HTTP
+	* `/sql` endpoint instead of the RPC socket.
+	*
+	* Best-effort by design: no await, no retry, errors swallowed. Every caller
+	* must have a server-side fallback that makes a lost beacon a non-event.
+	*/
+	beaconSql(sql) {
+		try {
+			const { endpoint, namespace, database } = this.getConfig();
+			if (!endpoint || typeof fetch !== "function") return;
+			const url = new URL(endpoint);
+			url.protocol = url.protocol === "wss:" ? "https:" : url.protocol === "ws:" ? "http:" : url.protocol;
+			url.pathname = url.pathname.replace(/\/rpc\/?$/, "") + "/sql";
+			const headers = {
+				Accept: "application/json",
+				"Content-Type": "text/plain"
+			};
+			if (namespace) headers["surreal-ns"] = namespace;
+			if (database) headers["surreal-db"] = database;
+			if (this.authToken) headers.Authorization = `Bearer ${this.authToken}`;
+			fetch(url.toString(), {
+				method: "POST",
+				headers,
+				body: sql,
+				keepalive: true,
+				credentials: "omit"
+			}).catch(() => {});
+		} catch {}
+	}
+	/**
 	* Record the token every future connect should authenticate with, or `null`
 	* on sign-out. See {@link authToken}.
 	*
@@ -7246,9 +7282,9 @@ var Sp00kySync = class Sp00kySync {
 			return;
 		}
 		if (ids.length === 0) return;
-		try {
-			this.remote.query("FOR $id IN $ids { LET $_released = fn::query::unsubscribe($id); };", { ids }).catch(() => {});
-		} catch {}
+		const list = ids.map((id) => String(id)).filter((id) => /^_00_query:[0-9a-f]{64}$/.test(id)).join(", ");
+		if (!list) return;
+		this.remote.beaconSql(`FOR $id IN [${list}] { LET $_released = fn::query::unsubscribe($id); };`);
 	}
 	async registerQuery(queryHash) {
 		this.dataModule.beginFetching(queryHash);
@@ -7699,8 +7735,8 @@ function selfAllowlistedVariant(flag, userId) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.220";
-const WASM_VERSION = "0.0.1-canary.220";
+const CORE_VERSION = "0.0.1-canary.221";
+const WASM_VERSION = "0.0.1-canary.221";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class DevToolsService {
 	eventsHistory = [];
@@ -12715,7 +12751,7 @@ var Sp00kyClient = class {
 		return new TabsCoordinator({
 			tabId,
 			fingerprint: computeTabsFingerprint({
-				coreVersion: "0.0.1-canary.220",
+				coreVersion: "0.0.1-canary.221",
 				schemaHash: hash53(this.config.schemaSurql),
 				endpoint: this.config.database.endpoint ?? "",
 				namespace: this.config.database.namespace,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.220",
+  "version": "0.0.1-canary.221",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -60,8 +60,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.220",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.220",
+    "@spooky-sync/query-builder": "0.0.1-canary.221",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.221",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.0.3",
     "blurhash": "^2.0.5",

package/src/modules/sync/sync.ts

@@ -1878,13 +1878,24 @@ export class Sp00kySync<S extends SchemaStructure> {
     }
     if (ids.length === 0) return;
 
-    try {
-      void this.remote
-        .query('FOR $id IN $ids { LET $_released = fn::query::unsubscribe($id); };', { ids })
-        .catch(() => {});
-    } catch {
-      // Socket already gone: the TTL sweep is the fallback, as before.
-    }
+    // Over HTTP with `keepalive`, NOT the live socket. A WebSocket send during
+    // `pagehide` is not guaranteed to flush — the browser may tear the socket
+    // down first and the frame is lost. Measured on staging: releasing over the
+    // socket reached the server zero times; `fetch`/`keepalive` is the only
+    // primitive the platform promises to finish after the page is gone.
+    //
+    // Ids are inlined rather than bound because this is a bare statement, not
+    // an RPC call with a params channel. They are `_00_query:<sha256>` record
+    // ids the client itself derived, so the only interpolation is a hex digest.
+    const list = ids
+      .map((id) => String(id))
+      .filter((id) => /^_00_query:[0-9a-f]{64}$/.test(id))
+      .join(', ');
+    if (!list) return;
+
+    this.remote.beaconSql(
+      `FOR $id IN [${list}] { LET $_released = fn::query::unsubscribe($id); };`
+    );
   }
 
   private async registerQuery(queryHash: string) {

package/src/services/database/remote.ts

@@ -96,6 +96,52 @@ export class RemoteDatabaseService extends AbstractDatabaseService {
     return this.config;
   }
 
+  /**
+   * Send one SurrealQL statement so that it survives the page going away.
+   *
+   * A WebSocket `send()` during `pagehide` is not guaranteed to flush — the
+   * browser may tear the socket down first, and the frame is simply lost.
+   * Measured: an unload-time release over the live socket reached the server
+   * zero times out of one. `fetch` with `keepalive` is the primitive the
+   * platform actually guarantees here, so this goes over SurrealDB's HTTP
+   * `/sql` endpoint instead of the RPC socket.
+   *
+   * Best-effort by design: no await, no retry, errors swallowed. Every caller
+   * must have a server-side fallback that makes a lost beacon a non-event.
+   */
+  beaconSql(sql: string): void {
+    try {
+      const { endpoint, namespace, database } = this.getConfig();
+      if (!endpoint || typeof fetch !== 'function') return;
+
+      // `ws(s)://host/rpc` is the socket; `http(s)://host/sql` is the same
+      // server's statement endpoint.
+      const url = new URL(endpoint);
+      url.protocol = url.protocol === 'wss:' ? 'https:' : url.protocol === 'ws:' ? 'http:' : url.protocol;
+      url.pathname = url.pathname.replace(/\/rpc\/?$/, '') + '/sql';
+
+      const headers: Record<string, string> = {
+        Accept: 'application/json',
+        'Content-Type': 'text/plain',
+      };
+      if (namespace) headers['surreal-ns'] = namespace;
+      if (database) headers['surreal-db'] = database;
+      // Without this the statement runs unauthenticated and `$auth.id` is NONE,
+      // which for a per-user release means it matches nothing.
+      if (this.authToken) headers.Authorization = `Bearer ${this.authToken}`;
+
+      void fetch(url.toString(), {
+        method: 'POST',
+        headers,
+        body: sql,
+        keepalive: true,
+        credentials: 'omit',
+      }).catch(() => {});
+    } catch {
+      // Malformed endpoint, no fetch, blocked by CSP: the caller's fallback owns it.
+    }
+  }
+
   /**
    * Record the token every future connect should authenticate with, or `null`
    * on sign-out. See {@link authToken}.