@spooky-sync/core 0.0.1-canary.314 → 0.0.1-canary.316

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as renderOrderSql, c as serializeMergeRow, d as stableKey, i as projectedDataSql, l as serializeRow, o as renderWhereSql, r as project, s as reviveRow, t as PROMOTION_OPEN_OPTIONS, u as resolveRelations } from "./sqlite-open.js";
+import { a as renderOrderSql, c as serializeMergeRow, d as resolveRelations, f as stableKey, i as projectedDataSql, l as serializeRow, o as renderWhereSql, r as project, s as reviveRow, t as PROMOTION_OPEN_OPTIONS, u as recordIdKey } from "./sqlite-open.js";
 import { QueryBuilder, RecordId, baseFieldOfParam, cyrb53 } from "@spooky-sync/query-builder";
 import { DateTime, Duration, RecordId as RecordId$1, Surreal, Uuid, applyDiagnostics, createRemoteEngines } from "surrealdb";
 import pino from "pino";
@@ -2178,8 +2178,8 @@ function trimHistory(history, cap) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.314";
-const WASM_VERSION = "0.0.1-canary.314";
+const CORE_VERSION = "0.0.1-canary.316";
+const WASM_VERSION = "0.0.1-canary.316";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class DevToolsService {
 	version = CORE_VERSION;
@@ -11212,7 +11212,7 @@ var StreamProcessorService = class {
 			const hasToString = typeof value.toString === "function";
 			const isNotPlainObject = value.constructor !== Object;
 			if (hasTable && hasId && hasToString && isNotPlainObject) {
-				const result = value.toString();
+				const result = recordIdKey(value) ?? value.toString();
 				this.logger.trace({
 					result,
 					Category: "sp00ky-client::StreamProcessorService::normalizeValue"
@@ -11445,6 +11445,13 @@ var AuthService = class {
 	/** Target of an impersonation that just ended, until the client purges its
 	*  local bucket (see `consumeEndedImpersonation`). */
 	endedImpersonationTarget = null;
+	/** The way back to the admin in flight. The Stop button, the session poll,
+	*  a refused renewal and a rejected check can all end an impersonation, and
+	*  they share this one: a second stop running beside the first found the
+	*  admin token already taken and signed the admin out. */
+	stopping = null;
+	/** A token renewal in flight, which a stop waits out (see `renewImpersonation`). */
+	renewing = null;
 	impersonationTimers = new ImpersonationTimers({
 		current: () => this.impersonation,
 		renew: () => this.renewImpersonation(),
@@ -11595,9 +11602,18 @@ var AuthService = class {
 	* a full sign-out rather than staying on the target.
 	*/
 	async stopImpersonating(opts = {}) {
+		if (this.stopping) return this.stopping;
+		if (!this.impersonation) return;
+		this.stopping = this.leaveImpersonation(opts).finally(() => {
+			this.stopping = null;
+		});
+		return this.stopping;
+	}
+	async leaveImpersonation(opts) {
+		this.impersonationTimers.clear();
+		await this.renewing?.catch(() => void 0);
 		const info = this.impersonation;
 		if (!info) return;
-		this.impersonationTimers.clear();
 		if (!opts.serverEnded) try {
 			await this.remote.query("RETURN fn::_00_impersonate::stop($session)", { session: info.session });
 		} catch (error) {
@@ -11632,9 +11648,19 @@ var AuthService = class {
 	}
 	/** Re-sign the impersonation token before it expires. */
 	async renewImpersonation() {
-		if (!this.impersonation) return;
+		if (!this.impersonation || this.stopping) return;
+		const renewal = this.applyRenewal();
+		this.renewing = renewal;
+		try {
+			await renewal;
+		} finally {
+			if (this.renewing === renewal) this.renewing = null;
+		}
+	}
+	async applyRenewal() {
 		const [renewed] = await this.remote.query("RETURN fn::_00_impersonate::renew()");
 		if (!renewed?.token) throw new Error("Impersonation renewal returned no token.");
+		if (this.stopping || !this.impersonation) return;
 		this.remote.setAuthToken(renewed.token);
 		await this.remote.getClient().authenticate(renewed.token);
 		this.token = renewed.token;
@@ -11700,6 +11726,7 @@ var AuthService = class {
 	async check(accessToken) {
 		this.isLoading = true;
 		let token;
+		let accepted = false;
 		try {
 			token = accessToken || await this.persistenceClient.get("sp00ky_auth_token") || void 0;
 			if (!token) {
@@ -11711,6 +11738,7 @@ var AuthService = class {
 			}
 			this.remote.setAuthToken(token);
 			await this.remote.getClient().authenticate(token);
+			accepted = true;
 			const result = await this.remote.query("SELECT * FROM ONLY $auth.id");
 			const items = Array.isArray(result) && Array.isArray(result[0]) ? result[0] : result;
 			const user = Array.isArray(items) ? items[0] : items;
@@ -11741,7 +11769,13 @@ var AuthService = class {
 				error,
 				Category: "sp00ky-client::AuthService::check"
 			}, "Auth check unreachable; keeping the cached session and retrying later");
-			else {
+			else if (accepted && token) {
+				this.logger.warn({
+					error,
+					Category: "sp00ky-client::AuthService::check"
+				}, "Auth check accepted the token but could not read the user; keeping the session");
+				await this.keepAcceptedSession(token);
+			} else {
 				this.logger.error({
 					error,
 					stack: error.stack,
@@ -11753,6 +11787,17 @@ var AuthService = class {
 			this.isLoading = false;
 		}
 	}
+	/** Hold a session the server accepted without its user row: the id comes
+	*  from the token, as on a warm boot. A token naming no user is refused. */
+	async keepAcceptedSession(token) {
+		if (this.isAuthenticated && this.token === token && this.currentUser) return;
+		const { userId } = decodeTokenClaims(token);
+		if (!userId) {
+			await this.rejectToken(token);
+			return;
+		}
+		await this.setSession(token, { id: userId });
+	}
 	/**
 	* The server refused `token`. A refused impersonation token (stopped,
 	* expired, or revoked) returns to the admin session instead of signing the
@@ -14603,7 +14648,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.314",
+			coreVersion: "0.0.1-canary.316",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,

package/dist/sqlite-open.js

@@ -88,13 +88,32 @@ async function resolveOne(parents, relation, fetcher, depth, path) {
 function looksLikeRecordId(value) {
 	if (value == null) return false;
 	if (typeof value === "string") return /^[A-Za-z_][A-Za-z0-9_]*:.+/.test(value);
-	if (typeof value === "object") {
-		const rid = value;
-		return rid.tb !== void 0 && rid.id !== void 0;
-	}
+	if (typeof value === "object") return recordIdKey(value) !== null;
 	return false;
 }
 /**
+* The raw `table:id` key of a RecordId, duck-typed: the SDK 1.x shape
+* `{ tb, id }` or the SDK 2.x one, whose `table` is a `Table` (both behind
+* getters). `null` for anything else.
+*
+* Never the SDK's `toString()`: that is SurrealQL, escaped. SDK 2.1.0 escapes
+* every key that starts with a digit (`game:⟨476g…⟩`), while the store and
+* server membership spell the same id `game:476g…`, so a key built from
+* `toString()` silently missed about a quarter of random ids. A complex
+* (array/object) key has no raw spelling and returns `null`.
+*/
+function recordIdKey(value) {
+	const rid = value;
+	if (rid.id === void 0) return null;
+	if (rid.tb !== void 0) return `${String(rid.tb)}:${stableKey(rid.id)}`;
+	const proto = Object.getPrototypeOf(value);
+	if (proto === Object.prototype || proto === null) return null;
+	const name = rid.table?.name;
+	if (typeof rid.table !== "object" || typeof name !== "string") return null;
+	if (typeof rid.id === "string" || typeof rid.id === "number" || typeof rid.id === "bigint") return `${name}:${String(rid.id)}`;
+	return null;
+}
+/**
 * Stable grouping key for a correlation value. A `RecordId` (duck-typed to
 * avoid a hard surrealdb dependency here) and its `table:id` string form must
 * collapse to the same key so a parent FK stored either way matches the child.
@@ -104,8 +123,9 @@ function stableKey(value) {
 	if (typeof value === "string") return value;
 	if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return String(value);
 	if (typeof value === "object") {
+		const key = recordIdKey(value);
+		if (key !== null) return key;
 		const rid = value;
-		if (rid.tb !== void 0 && rid.id !== void 0) return `${String(rid.tb)}:${stableKey(rid.id)}`;
 		if (typeof rid.toString === "function") {
 			const s = rid.toString();
 			if (s !== "[object Object]") return s;
@@ -173,11 +193,12 @@ function scalar(value) {
 	return value;
 }
 function serializeRow(row) {
-	return JSON.stringify(row, (_k, v) => {
+	return JSON.stringify(row, function(k, v) {
 		if (v instanceof Uint8Array) return { __u8: toBase64(v) };
-		if (v && typeof v === "object") {
-			const rid = v;
-			if (rid.tb !== void 0 && rid.id !== void 0) return stableKey(v);
+		const raw = this[k];
+		if (raw && typeof raw === "object") {
+			const key = recordIdKey(raw);
+			if (key !== null) return key;
 		}
 		return v;
 	});
@@ -355,4 +376,4 @@ async function openDb(sqlite3, dbName, useOpfs, opts = {}) {
 }
 
 //#endregion
-export { renderOrderSql as a, serializeMergeRow as c, stableKey as d, projectedDataSql as i, serializeRow as l, openDb as n, renderWhereSql as o, project as r, reviveRow as s, PROMOTION_OPEN_OPTIONS as t, resolveRelations as u };
+export { renderOrderSql as a, serializeMergeRow as c, resolveRelations as d, stableKey as f, projectedDataSql as i, serializeRow as l, openDb as n, renderWhereSql as o, project as r, reviveRow as s, PROMOTION_OPEN_OPTIONS as t, recordIdKey as u };

package/dist/sqlite-worker.js

@@ -1,4 +1,4 @@
-import { a as renderOrderSql, d as stableKey, i as projectedDataSql, n as openDb, o as renderWhereSql, r as project, s as reviveRow, u as resolveRelations } from "./sqlite-open.js";
+import { a as renderOrderSql, d as resolveRelations, f as stableKey, i as projectedDataSql, n as openDb, o as renderWhereSql, r as project, s as reviveRow } from "./sqlite-open.js";
 import sqlite3InitModule from "@sqlite.org/sqlite-wasm";
 
 //#region src/services/database/sqlite-lock-verify.ts

package/dist/types.d.ts

@@ -793,6 +793,13 @@ declare class AuthService<S extends SchemaStructure> {
   /** Target of an impersonation that just ended, until the client purges its
    *  local bucket (see `consumeEndedImpersonation`). */
   private endedImpersonationTarget;
+  /** The way back to the admin in flight. The Stop button, the session poll,
+   *  a refused renewal and a rejected check can all end an impersonation, and
+   *  they share this one: a second stop running beside the first found the
+   *  admin token already taken and signed the admin out. */
+  private stopping;
+  /** A token renewal in flight, which a stop waits out (see `renewImpersonation`). */
+  private renewing;
   private impersonationTimers;
   get eventSystem(): AuthEventSystem;
   constructor(schema: S, remote: RemoteDatabaseService, persistenceClient: PersistenceClient, logger: Logger$1);
@@ -839,8 +846,10 @@ declare class AuthService<S extends SchemaStructure> {
   stopImpersonating(opts?: {
     serverEnded?: boolean;
   }): Promise<void>;
+  private leaveImpersonation;
   /** Re-sign the impersonation token before it expires. */
   renewImpersonation(): Promise<void>;
+  private applyRenewal;
   /** Users an admin may pick from. Admin-only on the server. */
   searchImpersonationTargets(search: string): Promise<ImpersonationCandidate[]>;
   /** Open impersonation sessions. Admin-only on the server. */
@@ -872,6 +881,9 @@ declare class AuthService<S extends SchemaStructure> {
    * Check for existing session and validate
    */
   check(accessToken?: string): Promise<void>;
+  /** Hold a session the server accepted without its user row: the id comes
+   *  from the token, as on a warm boot. A token naming no user is refused. */
+  private keepAcceptedSession;
   /**
    * The server refused `token`. A refused impersonation token (stopped,
    * expired, or revoked) returns to the admin session instead of signing the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.314",
+  "version": "0.0.1-canary.316",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -75,8 +75,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.314",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.314",
+    "@spooky-sync/query-builder": "0.0.1-canary.316",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.316",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.0.3",
     "blurhash": "^2.0.5",

package/src/modules/auth/impersonation.integration.test.ts

@@ -0,0 +1,205 @@
+import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { createHmac } from 'node:crypto';
+import { Surreal } from 'surrealdb';
+import { AuthService } from './index';
+import { ORIGIN_TOKEN_KEY } from './impersonation';
+
+/**
+ * Impersonation start and stop against a real SurrealDB (the WASM engine) and
+ * the real SDK: record access for the admin, the `_00_impersonate` access with
+ * the same AUTHENTICATE revocation block the CLI generates, and the session
+ * functions minus the HTTP mint (the token is signed here, the way
+ * `ssp_protocol::impersonation::mint` signs it).
+ */
+
+const KEY = 'test-impersonation-key';
+const b64 = (v: string | Buffer) => Buffer.from(v).toString('base64url');
+
+function mintImpersonation(session: string, target: string, admin: string, ttlSecs = 900): string {
+  const now = Math.floor(Date.now() / 1000);
+  const header = b64(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+  const claims = b64(
+    JSON.stringify({
+      iss: 'SurrealDB',
+      iat: now,
+      nbf: now,
+      exp: now + ttlSecs,
+      NS: 'n',
+      DB: 'd',
+      AC: '_00_impersonate',
+      ID: target,
+      spky_imp: session,
+      spky_admin: admin,
+      spky_as_access: 'account',
+    })
+  );
+  const sig = createHmac('sha256', KEY).update(`${header}.${claims}`).digest('base64url');
+  return `${header}.${claims}.${sig}`;
+}
+
+const SCHEMA = `
+DEFINE TABLE user SCHEMALESS PERMISSIONS FOR select WHERE true FOR create, update, delete NONE;
+DEFINE ACCESS account ON DATABASE TYPE RECORD
+  SIGNIN (SELECT * FROM user WHERE email = $email AND pass = $pass)
+  DURATION FOR TOKEN 365d, FOR SESSION 365d;
+DEFINE TABLE _00_admin SCHEMALESS PERMISSIONS NONE;
+DEFINE TABLE _00_impersonation SCHEMALESS PERMISSIONS FOR select, create, update WHERE true;
+DEFINE ACCESS _00_impersonate ON DATABASE TYPE RECORD
+  WITH JWT ALGORITHM HS256 KEY '${KEY}'
+  AUTHENTICATE {
+    LET $s = (SELECT * FROM ONLY type::record($token.spky_imp));
+    IF $s = NONE OR $s.ended_at != NONE OR <string>$s.target != <string>$auth.id {
+      THROW 'Impersonation session is no longer valid.';
+    };
+    IF array::len((SELECT VALUE id FROM _00_admin WHERE user = $s.admin LIMIT 1)) = 0 {
+      THROW 'Impersonation session is no longer valid.';
+    };
+    RETURN $auth;
+  }
+  DURATION FOR TOKEN 15m, FOR SESSION 15m;
+DEFINE FUNCTION fn::_00_impersonate::start($target: string, $reason: string) {
+  IF $access = '_00_impersonate' { THROW 'Cannot start impersonation from an impersonated session.'; };
+  UPSERT _00_impersonation:s1 SET target = type::record($target), admin = $auth.id, reason = $reason, ended_at = NONE;
+  RETURN { token: $test_imp_token, session: '_00_impersonation:s1' };
+} PERMISSIONS FULL;
+DEFINE FUNCTION fn::_00_impersonate::stop($session: string) {
+  UPDATE type::record($session) SET ended_at = time::now();
+  RETURN NONE;
+} PERMISSIONS FULL;
+DEFINE FUNCTION fn::_00_impersonate::renew() {
+  IF $access != '_00_impersonate' { THROW 'Not an impersonated session.'; };
+  RETURN { token: $test_imp_token_renewed };
+} PERMISSIONS FULL;
+DEFINE FUNCTION fn::_00_impersonate::current() {
+  IF $access != '_00_impersonate' { RETURN NONE; };
+  LET $s = (SELECT * FROM ONLY type::record($token.spky_imp));
+  RETURN IF $s = NONE OR $s.ended_at != NONE { NONE } ELSE { { session: <string>$s.id } };
+} PERMISSIONS FULL;
+CREATE user:alice SET email = 'alice@x', pass = 'pw';
+CREATE user:bob SET email = 'bob@x', pass = 'pw';
+CREATE _00_admin:alice SET user = user:alice;
+`;
+
+const silentLogger = (): any => {
+  const l: any = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn(), trace: vi.fn() };
+  l.child = () => l;
+  return l;
+};
+
+describe('impersonation on the SurrealDB-WASM engine', () => {
+  let db: Surreal;
+  let adminToken: string;
+
+  beforeAll(async () => {
+    const realFetch = globalThis.fetch;
+    vi.stubGlobal('fetch', async (input: unknown, init?: RequestInit) => {
+      const url = input instanceof URL ? input : new URL(String(input));
+      if (url.protocol === 'file:') return new Response(await readFile(fileURLToPath(url)));
+      return realFetch(input as RequestInfo, init);
+    });
+    const { createWasmEngines } = await import('@surrealdb/wasm');
+    db = new Surreal({ engines: createWasmEngines() });
+    await db.connect('mem://');
+    await db.use({ namespace: 'n', database: 'd' });
+    await db.query(SCHEMA);
+    await db.query(`DEFINE PARAM $test_imp_token VALUE '${mintImpersonation('_00_impersonation:s1', 'user:bob', 'user:alice')}' PERMISSIONS FULL;`);
+    await db.query(`DEFINE PARAM $test_imp_token_renewed VALUE '${mintImpersonation('_00_impersonation:s1', 'user:bob', 'user:alice', 901)}' PERMISSIONS FULL;`);
+    const tokens = await db.signin({ access: 'account', variables: { email: 'alice@x', pass: 'pw' } });
+    adminToken = typeof tokens === 'string' ? tokens : (tokens as { access: string }).access;
+  }, 60_000);
+
+  afterAll(async () => {
+    await db?.close();
+    vi.unstubAllGlobals();
+  });
+
+  function makeAuth(opts: { failUserRead?: () => boolean; holdStop?: Promise<void> } = {}) {
+    const store = new Map<string, unknown>();
+    const persistence = {
+      get: async (k: string) => store.get(k) ?? null,
+      set: async (k: string, v: unknown) => void store.set(k, v),
+      remove: async (k: string) => void store.delete(k),
+    } as any;
+    const remote = {
+      query: async (sql: string, vars?: Record<string, unknown>) => {
+        if (sql.includes('$auth.id') && opts.failUserRead?.()) {
+          throw new Error('There was a problem with the database: the query was cancelled');
+        }
+        if (sql.includes('fn::_00_impersonate::stop') && opts.holdStop) await opts.holdStop;
+        return db.query(sql, vars);
+      },
+      setAuthToken: () => undefined,
+      getClient: () => db,
+    } as any;
+    return { auth: new AuthService({} as any, remote, persistence, silentLogger()), store };
+  }
+
+  it('stop returns to the admin', async () => {
+    const { auth, store } = makeAuth();
+    await auth.check(adminToken);
+    expect(String(auth.currentUser.id)).toBe('user:alice');
+
+    await auth.impersonate('user:bob', 'support');
+    expect(String(auth.currentUser.id)).toBe('user:bob');
+
+    await auth.stopImpersonating();
+    expect(auth.isAuthenticated).toBe(true);
+    expect(String(auth.currentUser.id)).toBe('user:alice');
+    expect(store.get('sp00ky_auth_token')).toBe(adminToken);
+    expect(store.has(ORIGIN_TOKEN_KEY)).toBe(false);
+  });
+
+  it('an explicit stop racing a server-ended stop still returns to the admin', async () => {
+    let release!: () => void;
+    const holdStop = new Promise<void>((r) => (release = r));
+    const { auth } = makeAuth({ holdStop });
+    await auth.check(adminToken);
+    await auth.impersonate('user:bob', 'support');
+
+    // The Stop button's stop is waiting on the server when the poll notices
+    // the end (or a renewal is refused). Run apart, the poll's stop returned
+    // to the admin and the button's, finding the admin token taken, signed
+    // the admin out. Now the second joins the first.
+    const explicit = auth.stopImpersonating();
+    const fromPoll = auth.stopImpersonating({ serverEnded: true });
+    release();
+    await Promise.all([explicit, fromPoll]);
+
+    expect(auth.isAuthenticated).toBe(true);
+    expect(String(auth.currentUser.id)).toBe('user:alice');
+  });
+
+  it('a failed read of the admin row on the way back keeps the admin signed in', async () => {
+    let failNext = false;
+    const { auth, store } = makeAuth({ failUserRead: () => (failNext ? ((failNext = false), true) : false) });
+    await auth.check(adminToken);
+    await auth.impersonate('user:bob', 'support');
+
+    failNext = true;
+    await auth.stopImpersonating();
+
+    expect(auth.isAuthenticated).toBe(true);
+    expect(String(auth.currentUser.id)).toBe('user:alice');
+    expect(store.get('sp00ky_auth_token')).toBe(adminToken);
+  });
+
+  it('stop after half an hour of renewals and polls returns to the admin', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout', 'setInterval', 'clearInterval'] });
+    try {
+      const { auth } = makeAuth();
+      await auth.check(adminToken);
+      await auth.impersonate('user:bob', 'support');
+      await vi.advanceTimersByTimeAsync(30 * 60 * 1000);
+      expect(String(auth.currentUser.id)).toBe('user:bob');
+
+      await auth.stopImpersonating();
+
+      expect(auth.isAuthenticated).toBe(true);
+      expect(String(auth.currentUser.id)).toBe('user:alice');
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});

package/src/modules/auth/impersonation.test.ts

@@ -260,6 +260,28 @@ describe('timers', () => {
     expect(auth.impersonation).toBeNull();
   });
 
+  it('a renewal in flight when stop begins does not put the target back on the socket', async () => {
+    const { auth, server, store } = await signedInAdmin();
+    await auth.impersonate('user:bob', 'support ticket');
+    let releaseRenew!: () => void;
+    const held = new Promise<void>((r) => (releaseRenew = r));
+    const answer = server.query.getMockImplementation()!;
+    server.query.mockImplementation(async (sql: string, vars?: Record<string, unknown>) => {
+      if (sql.includes('fn::_00_impersonate::renew')) await held;
+      return answer(sql, vars);
+    });
+
+    const renewal = auth.renewImpersonation();
+    const stop = auth.stopImpersonating();
+    releaseRenew();
+    await Promise.all([renewal, stop]);
+
+    expect(auth.currentUser.id).toBe('user:alice');
+    expect(auth.token).toBe(ADMIN);
+    expect(server.state.socketToken).toBe(ADMIN);
+    expect(store.get('sp00ky_auth_token')).toBe(ADMIN);
+  });
+
   it('keeps going through network failures on the poll', async () => {
     let calls = 0;
     const host = {

package/src/modules/auth/index.ts

@@ -103,6 +103,13 @@ export class AuthService<S extends SchemaStructure> {
   /** Target of an impersonation that just ended, until the client purges its
    *  local bucket (see `consumeEndedImpersonation`). */
   private endedImpersonationTarget: string | null = null;
+  /** The way back to the admin in flight. The Stop button, the session poll,
+   *  a refused renewal and a rejected check can all end an impersonation, and
+   *  they share this one: a second stop running beside the first found the
+   *  admin token already taken and signed the admin out. */
+  private stopping: Promise<void> | null = null;
+  /** A token renewal in flight, which a stop waits out (see `renewImpersonation`). */
+  private renewing: Promise<void> | null = null;
   private impersonationTimers = new ImpersonationTimers({
     current: () => this.impersonation,
     renew: () => this.renewImpersonation(),
@@ -272,9 +279,22 @@ export class AuthService<S extends SchemaStructure> {
    * a full sign-out rather than staying on the target.
    */
   async stopImpersonating(opts: { serverEnded?: boolean } = {}): Promise<void> {
+    if (this.stopping) return this.stopping;
+    if (!this.impersonation) return;
+    this.stopping = this.leaveImpersonation(opts).finally(() => {
+      this.stopping = null;
+    });
+    return this.stopping;
+  }
+
+  private async leaveImpersonation(opts: { serverEnded?: boolean }): Promise<void> {
+    this.impersonationTimers.clear();
+    // A renewal already sent finishes first, so it cannot put the target's
+    // token back on the socket after the admin's (it sees `stopping` and
+    // stands down).
+    await this.renewing?.catch(() => undefined);
     const info = this.impersonation;
     if (!info) return;
-    this.impersonationTimers.clear();
     if (!opts.serverEnded) {
       try {
         await this.remote.query('RETURN fn::_00_impersonate::stop($session)', { session: info.session });
@@ -314,9 +334,22 @@ export class AuthService<S extends SchemaStructure> {
 
   /** Re-sign the impersonation token before it expires. */
   async renewImpersonation(): Promise<void> {
-    if (!this.impersonation) return;
+    if (!this.impersonation || this.stopping) return;
+    const renewal = this.applyRenewal();
+    this.renewing = renewal;
+    try {
+      await renewal;
+    } finally {
+      if (this.renewing === renewal) this.renewing = null;
+    }
+  }
+
+  private async applyRenewal(): Promise<void> {
     const [renewed] = await this.remote.query<[{ token: string }]>('RETURN fn::_00_impersonate::renew()');
     if (!renewed?.token) throw new Error('Impersonation renewal returned no token.');
+    // A stop began while the server was signing: the session is being left,
+    // so a fresh token for it must not go on the socket or into storage.
+    if (this.stopping || !this.impersonation) return;
     this.remote.setAuthToken(renewed.token);
     await this.remote.getClient().authenticate(renewed.token);
     this.token = renewed.token;
@@ -399,6 +432,9 @@ export class AuthService<S extends SchemaStructure> {
     this.isLoading = true;
 
     let token: string | undefined;
+    // Set once the server has accepted the token: from then on a failure is a
+    // failure to read the user row, not a verdict on the session.
+    let accepted = false;
     try {
       token = accessToken || (await this.persistenceClient.get<string>('sp00ky_auth_token')) || undefined;
 
@@ -418,6 +454,7 @@ export class AuthService<S extends SchemaStructure> {
       // `RemoteDatabaseService.setAuthToken`).
       this.remote.setAuthToken(token);
       await this.remote.getClient().authenticate(token);
+      accepted = true;
 
       // Verify the session by fetching the full user record using $auth.id
       const result = await this.remote.query('SELECT * FROM ONLY $auth.id');
@@ -471,6 +508,17 @@ export class AuthService<S extends SchemaStructure> {
           { error, Category: 'sp00ky-client::AuthService::check' },
           'Auth check unreachable; keeping the cached session and retrying later'
         );
+      } else if (accepted && token) {
+        // The server took the token and only the read of the user row failed
+        // (a busy database, a statement error). Signing out here logged an
+        // admin out on the way back from an impersonation while the database
+        // was saturated. Keep the session on the id the token names; the row
+        // arrives with the next check or the app's own user query.
+        this.logger.warn(
+          { error, Category: 'sp00ky-client::AuthService::check' },
+          'Auth check accepted the token but could not read the user; keeping the session'
+        );
+        await this.keepAcceptedSession(token);
       } else {
         this.logger.error(
           { error, stack: (error as Error).stack, Category: 'sp00ky-client::AuthService::check' },
@@ -483,6 +531,18 @@ export class AuthService<S extends SchemaStructure> {
     }
   }
 
+  /** Hold a session the server accepted without its user row: the id comes
+   *  from the token, as on a warm boot. A token naming no user is refused. */
+  private async keepAcceptedSession(token: string): Promise<void> {
+    if (this.isAuthenticated && this.token === token && this.currentUser) return;
+    const { userId } = decodeTokenClaims(token);
+    if (!userId) {
+      await this.rejectToken(token);
+      return;
+    }
+    await this.setSession(token, { id: userId });
+  }
+
   /**
    * The server refused `token`. A refused impersonation token (stopped,
    * expired, or revoked) returns to the admin session instead of signing the

package/src/services/database/relation-resolver.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect } from 'vitest';
+import { RecordId } from 'surrealdb';
 import type { RelationPlan, WhereNode } from '@spooky-sync/query-builder';
 import { looksLikeRecordId, resolveRelations, sortRows, stableKey } from './relation-resolver';
 import {
@@ -306,6 +307,22 @@ describe('stableKey', () => {
     expect(stableKey({ tb: 'user', id: '1' })).toBe('user:1');
     expect(stableKey('user:1')).toBe('user:1');
   });
+
+  it('spells an SDK RecordId raw, never as escaped SurrealQL', () => {
+    // SDK 2.1.0 `toString()`s these as `game:⟨476g…⟩`, `t:⟨123⟩`, `t:⟨a-b⟩`.
+    expect(stableKey(new RecordId('game', '476gsdlvro7cme8nwied'))).toBe('game:476gsdlvro7cme8nwied');
+    expect(stableKey(new RecordId('t', '123'))).toBe('t:123');
+    expect(stableKey(new RecordId('t', 'a-b'))).toBe('t:a-b');
+    expect(stableKey(new RecordId('t', 7))).toBe('t:7');
+    expect(looksLikeRecordId(new RecordId('game', '476gsdlvro7cme8nwied'))).toBe(true);
+  });
+
+  it('leaves a complex key to toString and a plain row with table/id columns alone', () => {
+    const complex = new RecordId('t', [1, 'x']);
+    expect(stableKey(complex)).toBe(complex.toString());
+    const row = { table: { name: 'x' }, id: 'y' };
+    expect(stableKey(row)).toBe(JSON.stringify(row));
+  });
 });
 
 /**

package/src/services/database/sqlite-plan-sql.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect } from 'vitest';
+import { RecordId } from 'surrealdb';
 import type { WhereNode } from '@spooky-sync/query-builder';
 import {
   comparisonSql,
@@ -96,6 +97,11 @@ describe('serializeRow / reviveRow round-trip', () => {
     const json = serializeRow({ id: 't:1', author: { tb: 'user', id: 'u1' }, n: 2 });
     expect(reviveRow(json)).toEqual({ id: 't:1', author: 'user:u1', n: 2 });
   });
+
+  it('stores an SDK RecordId link raw, not as its escaped toJSON', () => {
+    const json = serializeRow({ id: 'game:1', white: new RecordId('player_name', '3abc'), tags: [new RecordId('t', '9z')] });
+    expect(reviveRow(json)).toEqual({ id: 'game:1', white: 'player_name:3abc', tags: ['t:9z'] });
+  });
 });
 
 describe('project', () => {

package/src/services/database/sqlite-plan-sql.ts

@@ -1,5 +1,5 @@
 import type { WhereComparison, WhereNode } from '@spooky-sync/query-builder';
-import { stableKey } from './relation-resolver';
+import { recordIdKey, stableKey } from './relation-resolver';
 import type { OrderBy, Row } from './cache-engine';
 
 /**
@@ -60,11 +60,14 @@ export function scalar(value: unknown): unknown {
 }
 
 export function serializeRow(row: Row): string {
-  return JSON.stringify(row, (_k, v) => {
+  return JSON.stringify(row, function (this: Record<string, unknown>, k, v) {
     if (v instanceof Uint8Array) return { __u8: toBase64(v) };
-    if (v && typeof v === 'object') {
-      const rid = v as { tb?: unknown; id?: unknown };
-      if (rid.tb !== undefined && rid.id !== undefined) return stableKey(v);
+    // `v` has already been through `toJSON()`, and a RecordId's is escaped
+    // SurrealQL (`game:⟨476g…⟩`), so key the original value instead.
+    const raw = this[k];
+    if (raw && typeof raw === 'object') {
+      const key = recordIdKey(raw);
+      if (key !== null) return key;
     }
     return v;
   });

package/src/services/database/sqlite-select.test.ts

@@ -45,6 +45,10 @@ const FIXTURE: Record<string, Row[]> = {
     { id: 'comment:2', thread: 'thread:B', body: 'second' },
     { id: 'comment:3', thread: 'thread:A', body: 'other thread' },
   ],
+  game: [
+    { id: 'game:476gsdlvro7cme8nwied', white: 'player_name:a' },
+    { id: 'game:stgyqp7fm3sc4tmyc8fm', white: 'player_name:b' },
+  ],
 };
 
 /** The `.one()` detail-view plan shape: id baked as a literal AND slaved to
@@ -187,12 +191,23 @@ describe('SqliteCacheEngine.select via worker (one hop)', () => {
     const rid = new RecordId('comment', '2');
     const { engine, calls } = makeEngine({ workerSelect: true, answerSelect: true });
     await engine.connect('anon');
-    await engine.select({ table: 'comment', ids: [rid, 'comment:1'] }, {});
+    const rows = await engine.select({ table: 'comment', ids: [rid, 'comment:1'] }, {});
     const sel = calls.find((c) => c.type === 'select')!;
-    // stableKey output (surrealdb may escape the id part, e.g. comment:⟨2⟩) —
-    // identical to what the legacy `selectByIds` binds, so stored rows match.
-    expect(sel.payload.plan.ids).toEqual([stableKey(rid), 'comment:1']);
-    expect(sel.payload.plan.ids.every((i: unknown) => typeof i === 'string')).toBe(true);
+    // The raw spelling the rows are stored under, never the SDK's escaped
+    // `comment:⟨2⟩`: that one matched no stored row.
+    expect(sel.payload.plan.ids).toEqual(['comment:2', 'comment:1']);
+    expect(rows.map((r) => r.id)).toEqual(['comment:2', 'comment:1']);
+  });
+
+  it('finds a window row whose id starts with a digit (SDK 2.1.0 escapes it)', async () => {
+    // `materializeEffect` parses every window id into a RecordId, and SDK
+    // 2.1.0's `toString()` spells this one `game:⟨476g…⟩`. Keyed that way the
+    // row went missing, the window came back short and read as the list end.
+    const { engine } = makeEngine({ workerSelect: true, answerSelect: true });
+    await engine.connect('anon');
+    const ids = [new RecordId('game', '476gsdlvro7cme8nwied'), new RecordId('game', 'stgyqp7fm3sc4tmyc8fm')];
+    const rows = await engine.select({ table: 'game', ids }, {});
+    expect(rows.map((r) => r.id)).toEqual(['game:476gsdlvro7cme8nwied', 'game:stgyqp7fm3sc4tmyc8fm']);
   });
 
   it('normalizes RecordId values baked inside the plan\'s where tree', async () => {

package/src/services/stream-processor/index.ts

@@ -7,6 +7,7 @@ import type { WasmProcessor, WasmStreamUpdate } from './wasm-types';
 import type { Duration } from 'surrealdb';
 import type { QueryTimeToLive, RecordVersionArray } from '../../types';
 import { encodeRecordId } from '../../utils/index';
+import { recordIdKey } from '../database/relation-resolver';
 
 // Simple interface for query plan registration (replaces Incantation class)
 interface QueryPlanConfig {
@@ -1044,7 +1045,9 @@ export class StreamProcessorService {
       const isNotPlainObject = value.constructor !== Object;
 
       if (hasTable && hasId && hasToString && isNotPlainObject) {
-        const result = value.toString();
+        // The raw `table:id`, as the store spells it. `toString()` is escaped
+        // SurrealQL (SDK 2.1.0: `game:⟨476g…⟩`); only a complex key uses it.
+        const result = recordIdKey(value) ?? value.toString();
         this.logger.trace(
           { result, Category: 'sp00ky-client::StreamProcessorService::normalizeValue' },
           'RecordId detected'