@spooky-sync/core 0.0.1-canary.280 → 0.0.1-canary.282

package/dist/worker-types.js

@@ -0,0 +1,73 @@
+//#region src/push/types.ts
+/**
+* Web Push wire types shared by the page (`db.webPush`), the service worker
+* bridge (`@spooky-sync/core/sw`) and the live feed. Pure: types plus a few
+* dependency-free helpers, safe in any context.
+*
+* `PushPayload` mirrors `packages/push-core/src/config.rs` (`PushPayload`,
+* `PayloadKind`, `Op`, `NotificationTemplate`). Keep the two in step.
+*/
+/** Payload format version this build understands. */
+const PUSH_PAYLOAD_VERSION = 1;
+/** `urlBase64ToUint8Array`: the VAPID key as `applicationServerKey` wants it. */
+function base64UrlToBytes(value) {
+	const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4);
+	const raw = typeof atob === "function" ? atob(padded) : decodeBase64Fallback(padded);
+	const out = new Uint8Array(raw.length);
+	for (let i = 0; i < raw.length; i++) out[i] = raw.charCodeAt(i);
+	return out;
+}
+function bytesToBase64Url(bytes) {
+	const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+	let raw = "";
+	for (let i = 0; i < view.length; i++) raw += String.fromCharCode(view[i]);
+	return (typeof btoa === "function" ? btoa(raw) : encodeBase64Fallback(raw)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function sameBytes(a, b) {
+	if (!a || !b) return false;
+	const x = a instanceof Uint8Array ? a : new Uint8Array(a);
+	const y = b instanceof Uint8Array ? b : new Uint8Array(b);
+	if (x.length !== y.length) return false;
+	for (let i = 0; i < x.length; i++) if (x[i] !== y[i]) return false;
+	return true;
+}
+/** A payload this build can act on (`v` known, `kind` set). */
+function isPushPayload(value) {
+	if (!value || typeof value !== "object") return false;
+	const v = value;
+	return v.v === PUSH_PAYLOAD_VERSION && (v.kind === "rule" || v.kind === "message");
+}
+const B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function decodeBase64Fallback(input) {
+	const clean = input.replace(/=+$/, "");
+	let out = "";
+	let buffer = 0;
+	let bits = 0;
+	for (const ch of clean) {
+		const idx = B64.indexOf(ch);
+		if (idx < 0) continue;
+		buffer = buffer << 6 | idx;
+		bits += 6;
+		if (bits >= 8) {
+			bits -= 8;
+			out += String.fromCharCode(buffer >> bits & 255);
+		}
+	}
+	return out;
+}
+function encodeBase64Fallback(raw) {
+	let out = "";
+	for (let i = 0; i < raw.length; i += 3) {
+		const a = raw.charCodeAt(i);
+		const b = i + 1 < raw.length ? raw.charCodeAt(i + 1) : 0;
+		const c = i + 2 < raw.length ? raw.charCodeAt(i + 2) : 0;
+		const n = a << 16 | b << 8 | c;
+		out += B64[n >> 18 & 63] + B64[n >> 12 & 63];
+		out += i + 1 < raw.length ? B64[n >> 6 & 63] : "=";
+		out += i + 2 < raw.length ? B64[n & 63] : "=";
+	}
+	return out;
+}
+
+//#endregion
+export { sameBytes as a, isPushPayload as i, base64UrlToBytes as n, bytesToBase64Url as r, PUSH_PAYLOAD_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.280",
+  "version": "0.0.1-canary.282",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -13,12 +13,24 @@
     "./otel": {
       "types": "./dist/otel/index.d.ts",
       "import": "./dist/otel/index.js"
+    },
+    "./pure": {
+      "types": "./dist/pure.d.ts",
+      "import": "./dist/pure.js"
+    },
+    "./live": {
+      "types": "./dist/live.d.ts",
+      "import": "./dist/live.js"
+    },
+    "./sw": {
+      "types": "./dist/sw.d.ts",
+      "import": "./dist/sw.js"
     }
   },
   "scripts": {
     "dev": "tsdown --watch",
     "dev:example": "pnpm dev",
-    "build": "tsdown && node scripts/check-broker-bundle.mjs",
+    "build": "tsdown && node scripts/check-broker-bundle.mjs && node scripts/check-worker-entries.mjs",
     "test": "vitest",
     "test:run": "vitest run",
     "test:coverage": "vitest run --coverage",
@@ -63,8 +75,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.280",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.280",
+    "@spooky-sync/query-builder": "0.0.1-canary.282",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.282",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.0.3",
     "blurhash": "^2.0.5",

package/scripts/check-worker-entries.mjs

@@ -0,0 +1,172 @@
+// Build gate for the wasm-free subpath entries: dist/pure.js, dist/live.js and
+// dist/sw.js (`@spooky-sync/core/pure`, `/live`, `/sw`). They are imported by
+// service workers, dedicated workers and Node, so across each entry and every
+// chunk it reaches:
+//   - no import of a wasm engine, the circuit, CRDTs or the logger;
+//   - no reference to `window`, `document` or `localStorage` (a service worker
+//     has none of them; an access at module top level would throw on import);
+//   - `/sw` does not even pull in the `surrealdb` SDK.
+// Each entry is then really imported in this Node process (no DOM globals)
+// to catch top-level side effects the static scan cannot see. Prints the
+// gzipped size of each entry (own code, and fully bundled with its npm
+// dependencies when rolldown is reachable). Run after `tsdown` in the build.
+import { readFileSync, existsSync } from 'node:fs';
+import { resolve, dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { gzipSync } from 'node:zlib';
+import { createRequire } from 'node:module';
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const dist = join(root, 'dist');
+
+const ENTRIES = ['pure.js', 'live.js', 'sw.js'];
+const FORBIDDEN_IMPORTS = [
+  '@spooky-sync/ssp-wasm',
+  '@surrealdb/wasm',
+  '@sqlite.org/sqlite-wasm',
+  'loro-crdt',
+  'pino',
+  'blurhash',
+];
+const FORBIDDEN_PER_ENTRY = { 'sw.js': ['surrealdb'] };
+const FORBIDDEN_GLOBALS = ['window', 'document', 'localStorage'];
+
+const importRe =
+  /(?:import|export)\s*(?:[^'"`;]*?\sfrom\s*)?["']([^"']+)["']|import\(\s*["']([^"']+)["']\s*\)/g;
+
+/** Blank out comments and string/template literals so identifier scans see code only. */
+function codeOnly(src) {
+  let out = '';
+  let i = 0;
+  while (i < src.length) {
+    const c = src[i];
+    const n = src[i + 1];
+    if (c === '/' && n === '/') {
+      while (i < src.length && src[i] !== '\n') i++;
+      continue;
+    }
+    if (c === '/' && n === '*') {
+      i += 2;
+      while (i < src.length && !(src[i] === '*' && src[i + 1] === '/')) i++;
+      i += 2;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === '`') {
+      const q = c;
+      i++;
+      while (i < src.length && src[i] !== q) i += src[i] === '\\' ? 2 : 1;
+      i++;
+      out += '""';
+      continue;
+    }
+    out += c;
+    i++;
+  }
+  return out;
+}
+
+function walk(entry) {
+  const seen = new Set();
+  const bare = new Set();
+  const stack = [join(dist, entry)];
+  while (stack.length > 0) {
+    const file = stack.pop();
+    if (seen.has(file)) continue;
+    seen.add(file);
+    if (!existsSync(file)) throw new Error(`${entry}: missing ${file}`);
+    const src = readFileSync(file, 'utf8');
+    for (const m of src.matchAll(importRe)) {
+      const spec = m[1] ?? m[2];
+      if (spec.startsWith('.')) stack.push(resolve(dirname(file), spec));
+      else bare.add(spec);
+    }
+  }
+  return { files: [...seen], bare: [...bare] };
+}
+
+const problems = [];
+const sizes = [];
+
+for (const entry of ENTRIES) {
+  let graph;
+  try {
+    graph = walk(entry);
+  } catch (error) {
+    problems.push(String(error.message ?? error));
+    continue;
+  }
+  const forbidden = [...FORBIDDEN_IMPORTS, ...(FORBIDDEN_PER_ENTRY[entry] ?? [])];
+  for (const spec of graph.bare) {
+    if (forbidden.some((f) => spec === f || spec.startsWith(`${f}/`)))
+      problems.push(`${entry} imports ${spec}`);
+  }
+  let own = '';
+  for (const file of graph.files) {
+    const src = readFileSync(file, 'utf8');
+    own += src;
+    if (/\.wasm\b/.test(src))
+      problems.push(`${entry}: ${file.slice(dist.length + 1)} references a .wasm file`);
+    const code = codeOnly(src);
+    for (const name of FORBIDDEN_GLOBALS) {
+      // `x.window` (a property) is fine; a bare identifier is not.
+      const re = new RegExp(`(?<![.\\w$])${name}(?![\\w$])`);
+      if (re.test(code))
+        problems.push(`${entry}: ${file.slice(dist.length + 1)} references \`${name}\``);
+    }
+  }
+  sizes.push({
+    entry,
+    files: graph.files.length,
+    raw: Buffer.byteLength(own),
+    gzip: gzipSync(own).length,
+    deps: graph.bare,
+  });
+}
+
+// Import each entry for real: top-level code must run without DOM globals.
+for (const entry of ENTRIES) {
+  try {
+    await import(pathToFileURL(join(dist, entry)).href);
+  } catch (error) {
+    problems.push(`${entry} fails to import in Node: ${error?.message ?? error}`);
+  }
+}
+
+// Fully bundled size (entry + npm deps, minified), when rolldown is reachable
+// through tsdown. Informational only.
+async function bundledGzip(entry) {
+  try {
+    const req = createRequire(createRequire(join(root, 'package.json')).resolve('tsdown'));
+    const { rolldown } = await import(pathToFileURL(req.resolve('rolldown')).href);
+    const bundle = await rolldown({
+      input: join(dist, entry),
+      platform: 'browser',
+      logLevel: 'silent',
+    });
+    const { output } = await bundle.generate({ format: 'esm', minify: true });
+    await bundle.close();
+    const code = output.map((o) => o.code ?? '').join('');
+    return gzipSync(code).length;
+  } catch {
+    return null;
+  }
+}
+
+for (const s of sizes) s.bundled = await bundledGzip(s.entry);
+
+const kb = (n) => `${(n / 1024).toFixed(2)} kB`;
+for (const s of sizes) {
+  const bundled = s.bundled === null ? '' : `, bundled with deps + minified ${kb(s.bundled)} gzip`;
+  console.log(
+    `check-worker-entries: ${s.entry.padEnd(8)} ${kb(s.raw)} (${kb(s.gzip)} gzip, ${s.files} file${s.files === 1 ? '' : 's'}; deps: ${s.deps.join(', ') || 'none'})${bundled}`
+  );
+}
+
+if (problems.length > 0) {
+  for (const p of problems) console.error(`check-worker-entries: ${p}`);
+  console.error(
+    'The /pure, /live and /sw entries must stay free of wasm, the logger and DOM globals.'
+  );
+  process.exit(1);
+}
+console.log('check-worker-entries: ok');

package/src/client/services.ts

@@ -1,6 +1,6 @@
-import { RecordId, type Uuid } from 'surrealdb';
+import type { Uuid } from 'surrealdb';
 import type { SchemaStructure } from '@spooky-sync/query-builder';
-import type { InlineRow, Sp00kyConfig, PersistenceClient } from '../types';
+import type { Sp00kyConfig, PersistenceClient } from '../types';
 import type { Logger } from '../services/logger/index';
 import { createLogger } from '../services/logger/index';
 import { ConnectionSupervisor, LocalMigrator, RemoteDatabaseService, createLocalEngine } from '../services/database/index';
@@ -27,6 +27,8 @@ import type { Adapters } from '../kernel/interpreter';
 import type { RuntimeEvent } from '../kernel/events';
 import type { ServiceCalls } from '../kernel/effects';
 import { encodeRecordId } from '../utils/index';
+import { sha256Hex } from '../utils/sha256';
+import { hashOfEdge, rowOfEdge } from '../utils/edges';
 import { mintMutationId } from '../mutation/mutation-id';
 import { BucketHandle, bucketContentToBlob } from './bucket-handle';
 
@@ -48,13 +50,9 @@ export function writeBootBucketHint(bucketId: string): void {
   }
 }
 
-export async function sha256Hex(input: string): Promise<string> {
-  const bytes = new TextEncoder().encode(input);
-  const digest = await crypto.subtle.digest('SHA-256', bytes);
-  return Array.from(new Uint8Array(digest))
-    .map((b) => b.toString(16).padStart(2, '0'))
-    .join('');
-}
+// Moved to a pure module so `@spooky-sync/core/pure` and the live feed share
+// it; re-exported here for existing imports.
+export { sha256Hex };
 
 export function mintSalt(): string {
   const c = (globalThis as { crypto?: Crypto }).crypto;
@@ -208,35 +206,9 @@ export function leaderToRuntime(msg: { type: string; [k: string]: unknown }): un
   }
 }
 
-/** The hash a `_00_list_ref` edge belongs to: the id part of its `in` (`_00_query:<hash>`). */
-export function hashOfEdge(value: unknown): string | null {
-  const inId = (value as { in?: unknown } | null)?.in;
-  if (!inId) return null;
-  const str = inId instanceof RecordId ? String(inId.id) : String(inId).replace(/^_00_query:/, '');
-  return str.length > 0 ? str : null;
-}
-
-/**
- * The row an edge notification carries, when the subscription joined it on.
- *
- * Without `FETCH out` the edge's `out` is a record id and there is nothing to
- * land, so this returns null and the caller falls back to fetching the body.
- * It also returns null for a row the session may not read (the join yields
- * `out: null`) and for an edge whose target has been deleted.
- */
-export function rowOfEdge(value: unknown): InlineRow | null {
-  const edge = value as { out?: unknown; version?: unknown } | null;
-  const out = edge?.out;
-  if (!out || typeof out !== 'object' || Array.isArray(out) || out instanceof RecordId) return null;
-  // Must be a real RecordId: the landing path keys off `row.id` being one, and
-  // would otherwise record the version for a body it never wrote.
-  const rid = (out as { id?: unknown }).id;
-  if (!(rid instanceof RecordId)) return null;
-  const id = encodeRecordId(rid);
-  const version = typeof edge?.version === 'number' ? edge.version : null;
-  if (version === null) return null;
-  return { id, version, record: out as Record<string, unknown> };
-}
+// Edge decoding lives in a pure module (the wasm-free live feed uses it too);
+// re-exported here for existing imports.
+export { hashOfEdge, rowOfEdge };
 
 /** Build the adapters the interpreter drives from the services. */
 export function createAdapters<S extends SchemaStructure>(config: Sp00kyConfig<S>, s: Services<S>, host: ServiceHost, lateModules: () => { init(): void }[]): Adapters {

package/src/client/sp00ky-client.ts

@@ -34,6 +34,7 @@ import { FeatureFlagModule, FeatureFlagHandle } from '../modules/feature-flag/in
 import type { FeatureFlagOptions, FeatureFlagOverride } from '../modules/feature-flag/index';
 import { AppReleaseModule, AppReleaseHandle } from '../modules/app-release/index';
 import type { AppReleaseOptions } from '../modules/app-release/index';
+import { WebPushModule } from '../modules/web-push/index';
 import { DevToolsService } from '../modules/devtools/index';
 import type { DevToolsQuerySource } from '../modules/devtools/index';
 import { parseQueryParams, generateId } from '../utils/index';
@@ -73,6 +74,8 @@ export interface Sp00kyClientDeps<S extends SchemaStructure> {
 export class Sp00kyClient<S extends SchemaStructure> {
   public readonly auth: AuthService<S>;
   public readonly streamProcessor: StreamProcessorService;
+  /** Web Push for this browser: subscribe, devices, self-pushes, service worker bridge. */
+  public readonly webPush: WebPushModule;
 
   private readonly services: Services<S>;
   private readonly env: SagaEnv;
@@ -139,6 +142,16 @@ export class Sp00kyClient<S extends SchemaStructure> {
     const remoteRegisterPort = { enqueueDownEvent: () => void this.runtime.dispatch({ type: 'EnsureRegistered' }) };
     this.featureFlags = new FeatureFlagModule<S>({ dataModule: liveQueryPort, sync: remoteRegisterPort, auth: s.auth, logger: s.logger });
     this.appReleases = new AppReleaseModule<S>({ dataModule: liveQueryPort, sync: remoteRegisterPort, auth: s.auth, logger: s.logger });
+    this.webPush = new WebPushModule({
+      remote: s.remote,
+      auth: s.auth,
+      persistence: s.persistence,
+      logger: s.logger,
+      database: config.database,
+      connection: s.connectionSupervisor,
+      config: config.webPush,
+    });
+    this.disposers.push(this.webPush.attach());
 
     const querySource: DevToolsQuerySource = {
       getActiveQueries: () => [...this.runtime.state.queries.values()].map(toQueryState),

package/src/index.ts

@@ -15,6 +15,39 @@ export {
   type AppReleaseOptions,
   type AppReleaseSnapshot,
 } from './modules/app-release/index';
+export {
+  WebPushModule,
+  WebPushError,
+  detectWebPushSupport,
+  PUSH_ENDPOINT_KEY,
+  type WebPushConfig,
+  type WebPushSupport,
+  type WebPushUnsupportedReason,
+  type WebPushInfo,
+  type WebPushDevice,
+  type PushDeviceKind,
+  type WebPushSubscribeOptions,
+  type WebPushUnsubscribeOptions,
+  type WebPushSyncOptions,
+  type WebPushSyncStatus,
+  type WebPushUpdateOptions,
+  type WebPushMessageInput,
+  type WebPushMessage,
+  type WebPushErrorCode,
+} from './modules/web-push/index';
+export {
+  PUSH_PAYLOAD_VERSION,
+  isPushPayload,
+  type PushPayload,
+  type PushPayloadKind,
+  type PushOp,
+  type PushUrgency,
+  type PushNotification,
+  type PushNotificationAction,
+  type BridgeTokenMessage,
+  type BridgeSignOutMessage,
+  type WebPushClientMessage,
+} from './push/types';
 export type {
   BlobCacheStats,
   BlobEntry,