@spooky-sync/core 0.0.1-canary.320 → 0.0.1-canary.321

package/dist/index.js

@@ -2178,8 +2178,8 @@ function trimHistory(history, cap) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.320";
-const WASM_VERSION = "0.0.1-canary.320";
+const CORE_VERSION = "0.0.1-canary.321";
+const WASM_VERSION = "0.0.1-canary.321";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class DevToolsService {
 	version = CORE_VERSION;
@@ -3726,6 +3726,8 @@ function phaseTimings(e) {
 * both sides resolve it to the shared `_00_list_ref_anon` table.
 */
 const ANON_USER_ID = "anon";
+/** The one `_00_list_ref` table every signed-out session shares. */
+const ANON_LIST_REF_TABLE = "_00_list_ref_anon";
 /**
 * Default ref-storage mode for this client build. Mirrors the SSP's
 * default (`RefMode::Dedicated`) so cross-session sync works out of the
@@ -3774,7 +3776,7 @@ function bucketIdForUser(userId) {
 * single mode.
 */
 function listRefTableFor(mode, userId) {
-	if (userId === ANON_USER_ID) return "_00_list_ref_anon";
+	if (userId === ANON_USER_ID) return ANON_LIST_REF_TABLE;
 	if (mode === "single") return "_00_list_ref";
 	const uid = sanitizeUserId(userId);
 	return uid ? `_00_list_ref_user_${uid}` : "_00_list_ref";
@@ -4350,15 +4352,44 @@ const readViewRows = () => `SELECT * FROM ${VIEW_TABLE}`;
 /** Copy every legacy `_00_window` row into `_00_view` once. */
 const readLegacyViewRows = () => `SELECT * FROM ${LEGACY_VIEW_TABLE}`;
 const countViewRows = () => `SELECT count() FROM ${VIEW_TABLE} GROUP ALL`;
-const listRefSelect = (table) => `SELECT out, version FROM ${table} WHERE in = $in AND parent IS NONE`;
-const subqueryListRefSelect = (table) => `SELECT out, version FROM ${table} WHERE in = $in AND parent IS NOT NONE`;
+const listRefSelect = (table) => `SELECT out, version FROM $in->${table} WHERE parent IS NONE`;
+const subqueryListRefSelect = (table) => `SELECT out, version FROM $in->${table} WHERE parent IS NOT NONE`;
 const queryRowCountSelect = () => "SELECT VALUE { rowCount: rowCount, state: state } FROM ONLY $in";
-const listRefBatchSelect = (table) => `SELECT in, out, version, parent FROM ${table} WHERE in IN $ins`;
+const listRefBatchSelect = (table) => `SELECT in, out, version, parent FROM $ins->${table}`;
 const queryRowCountBatchSelect = () => "SELECT VALUE { id: id, rowCount: rowCount, state: state } FROM $ins";
 /** The single-query read: edges, meta, subquery children in one request. */
 const singleSnapshotSelect = (table) => `${listRefSelect(table)};\n${queryRowCountSelect()};\n${subqueryListRefSelect(table)}`;
 /** The many-query read: all edges + all metas in one request. */
 const batchSnapshotSelect = (table) => `${listRefBatchSelect(table)};\n${queryRowCountBatchSelect()}`;
+/**
+* The session's one LIVE subscription on its `_00_list_ref` table.
+*
+* `inlineBodies` adds `FETCH out`, which resolves the edge's target into the
+* notification so the body arrives with the doorbell.
+*
+* On the anon table it is filtered to this client's own edges. Every
+* signed-out session shares that table, so unfiltered each one received (and
+* the server fetched a body for) every anonymous edge change of every other
+* session, and the client then dropped all but its own. An edge carries the
+* `session::id()` of whichever socket last registered its view, which is a
+* socket of this client but not necessarily the current one: a view stays
+* registered across a reconnect, and a reload keeps its salt and its views,
+* so their older edges still name an earlier socket. `sessionIds` are those
+* earlier sockets. The current one is matched by `session::id()` itself,
+* which SurrealDB evaluates in the subscriber's own session, so the filter
+* holds before the client has learned its new id.
+*
+* The cast is load-bearing: `session::id()` is a uuid, `clientId` a string,
+* and without it nothing matches. Per-user tables need no filter.
+*/
+function listRefLive(table, opts) {
+	const join = opts.inlineBodies ? " FETCH out" : "";
+	if (table !== ANON_LIST_REF_TABLE) return { sql: `LIVE SELECT * FROM ${table}${join}` };
+	return {
+		sql: `LIVE SELECT * FROM ${table} WHERE clientId = <string>session::id() OR clientId IN $sids${join}`,
+		vars: { sids: [...opts.sessionIds] }
+	};
+}
 /** Register + read back edges/meta/children in ONE request. */
 const registerSelect = (table) => `fn::query::register($config);\n${singleSnapshotSelect(table)}`;
 const registerVars = (payload) => ({
@@ -6657,9 +6688,9 @@ function* landInlineRows(env, rows) {
 //#region src/sync/connection.saga.ts
 /**
 * Transport state changes. A drop invalidates the live query and arms a
-* resubscribe; the next `connected` (outside the burst cooldown) drops every
-* remote registration so `ensureRegistered` rebuilds them behind the
-* `$auth.id` gate, and restarts LIVE.
+* resubscribe. The next `connected` restarts LIVE and drains the outbox;
+* outside the burst cooldown it also drops every remote registration so
+* `ensureRegistered` rebuilds them behind the `$auth.id` gate.
 */
 function* connectionChanged(env, connection) {
 	const state = yield fx.state.read((s) => s);
@@ -6672,18 +6703,17 @@ function* connectionChanged(env, connection) {
 	if (connection !== "connected" || !state.sync.needsResubscribe) return;
 	const now = yield fx.now();
 	const last = state.sync.lastReconnectRefetchAt;
-	if (last !== null && now - last < RECONNECT_REFETCH_COOLDOWN_MS) {
-		yield fx.state.update(patchSync({ needsResubscribe: false }));
-		return;
+	if (last !== null && now - last < RECONNECT_REFETCH_COOLDOWN_MS) yield fx.state.update(patchSync({ needsResubscribe: false }));
+	else {
+		yield fx.state.update(compose(patchSync({
+			needsResubscribe: false,
+			lastReconnectRefetchAt: now
+		}), ...[...state.queries.values()].filter((e) => e.lifecycle.remote !== "unregistered").map((e) => applyLifecycle(e.def.hash, { type: "remote-dropped" }))));
+		yield fx.dispatch({
+			type: "EnsureRegistered",
+			requireAuth: true
+		});
 	}
-	yield fx.state.update(compose(patchSync({
-		needsResubscribe: false,
-		lastReconnectRefetchAt: now
-	}), ...[...state.queries.values()].filter((e) => e.lifecycle.remote !== "unregistered").map((e) => applyLifecycle(e.def.hash, { type: "remote-dropped" }))));
-	yield fx.dispatch({
-		type: "EnsureRegistered",
-		requireAuth: true
-	});
 	yield fx.dispatch({ type: "LiveStart" });
 	yield fx.dispatch({ type: "Drain" });
 }
@@ -8213,8 +8243,12 @@ function resolveReconnectConfig(input) {
 */
 const REMOTE_MAX_CONCURRENT_QUERIES = 6;
 /**
-* Session ids a page remembers for its pagehide release. Only the sessions of
-* the last ttl matter; this many reconnects inside one ttl is a broken network.
+* Session ids a page remembers for its pagehide release and its anonymous LIVE
+* filter. The release only needs the sessions of the last ttl; this many
+* reconnects inside one ttl is a broken network. The LIVE filter would like
+* every session that stamped an edge still held, but the SSP restamps an edge
+* whenever its row changes, so an id that falls off costs at most the LIVE
+* removal of a row untouched since, which the membership poll still catches.
 */
 const MAX_SESSION_IDS = 16;
 var RemoteDatabaseService = class extends AbstractDatabaseService {
@@ -8256,6 +8290,10 @@ var RemoteDatabaseService = class extends AbstractDatabaseService {
 	* whose own session id matches none of them, so it names these instead. Kept
 	* for the page, not the socket: a view registered before a reconnect still
 	* carries the old id until its next heartbeat.
+	*
+	* The anonymous LIVE filters on the same ids (see `listRefLive`): its edges
+	* name the socket that registered their view, which may be an earlier one.
+	* A reload hands its ids to the next page with the salt.
 	*/
 	sessionIdsSeen = [];
 	constructor(config, logger) {
@@ -8281,6 +8319,14 @@ var RemoteDatabaseService = class extends AbstractDatabaseService {
 		return this.sessionIdsSeen;
 	}
 	/**
+	* Take on the session ids of the page this one reloaded from. It kept that
+	* page's salt, so the views it re-registers still carry edges stamped by
+	* those sockets. Older than anything this page has seen, so they go first.
+	*/
+	adoptSessionIds(ids) {
+		this.sessionIdsSeen = [...ids.filter((sid) => typeof sid === "string" && sid !== "" && !this.sessionIdsSeen.includes(sid)), ...this.sessionIdsSeen].slice(-MAX_SESSION_IDS);
+	}
+	/**
 	* Ask the socket that just connected for its session id. Straight to the
 	* SDK: it needs no namespace or identity, so it need not wait behind an
 	* in-flight connect or take a slot from the query queue.
@@ -14707,17 +14753,29 @@ function takeReloadSalt(authId) {
 		if (raw === null) return null;
 		sessionStorage.removeItem(RELOAD_SALT_KEY);
 		const left = JSON.parse(raw);
-		return typeof left.salt === "string" && left.salt !== "" && (left.authId ?? null) === authId ? left.salt : null;
+		if (typeof left.salt !== "string" || left.salt === "" || (left.authId ?? null) !== authId) return null;
+		const sessionIds = Array.isArray(left.sessionIds) ? left.sessionIds.filter((sid) => typeof sid === "string") : [];
+		return {
+			salt: left.salt,
+			sessionIds
+		};
 	} catch {
 		return null;
 	}
 }
-/** Leave this page's salt for the next page in this tab; see {@link takeReloadSalt}. */
-function leaveReloadSalt(salt, authId) {
+/**
+* Leave this page's salt for the next page in this tab; see {@link takeReloadSalt}.
+*
+* The session ids of this page's sockets go with it. The views the next page
+* re-registers keep the edges this page's sockets stamped, and the anonymous
+* LIVE only hears edges stamped by a session it knows (see `listRefLive`).
+*/
+function leaveReloadSalt(salt, authId, sessionIds = []) {
 	try {
 		if (typeof sessionStorage !== "undefined") sessionStorage.setItem(RELOAD_SALT_KEY, JSON.stringify({
 			salt,
-			authId
+			authId,
+			sessionIds
 		}));
 	} catch {}
 }
@@ -14782,7 +14840,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.320",
+			coreVersion: "0.0.1-canary.321",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,
@@ -14886,8 +14944,13 @@ function createAdapters(config, s, host, lateModules) {
 	const services = {
 		"hint.read": readBootBucketHint,
 		"hint.write": writeBootBucketHint,
-		"salt.take": takeReloadSalt,
-		"salt.leave": leaveReloadSalt,
+		"salt.take": (authId) => {
+			const left = takeReloadSalt(authId);
+			if (!left) return null;
+			s.remote.adoptSessionIds(left.sessionIds);
+			return left.salt;
+		},
+		"salt.leave": (salt, authId) => leaveReloadSalt(salt, authId, s.remote.sessionIds()),
 		"local.connect": (bucketId) => s.local.connect(bucketId),
 		"local.switchStore": (bucketId) => s.local.switchStore(bucketId),
 		"local.beginSwitch": () => s.local.beginSwitch(),
@@ -14983,8 +15046,11 @@ function createAdapters(config, s, host, lateModules) {
 		remote: {
 			queryResponses: (sql, vars) => s.remote.queryResponses(sql, vars),
 			live: async (table, onChange) => {
-				const join = config.liveInlineBodies ? " FETCH out" : "";
-				const [uuid] = await s.remote.query(`LIVE SELECT * FROM ${table}${join}`);
+				const stmt = listRefLive(table, {
+					inlineBodies: config.liveInlineBodies === true,
+					sessionIds: s.remote.sessionIds()
+				});
+				const [uuid] = await s.remote.query(stmt.sql, stmt.vars);
 				(await s.remote.getClient().liveOf(uuid)).subscribe((message) => {
 					if (message.action === "KILLED") return;
 					const hash = hashOfEdge(message.value);

package/dist/live.d.ts

@@ -1,4 +1,4 @@
-import { r as RefMode } from "./worker-ref-tables.js";
+import { i as RefMode } from "./worker-ref-tables.js";
 import { SchemaStructure } from "@spooky-sync/query-builder";
 
 //#region src/live/index.d.ts

package/dist/live.js

@@ -1,4 +1,4 @@
-import { B as queryHashInput, C as heartbeatRowGone, M as registerVars, N as singleSnapshotSelect, S as heartbeatBatch, a as metaFromRow, b as bodySelect, c as parseDuration, d as parseQueryParams, f as ANON_USER_ID, h as listRefTableFor, j as registerSelect, l as parseRecordIdString, n as rowOfEdge, p as DEFAULT_REF_MODE, s as encodeRecordId, t as hashOfEdge, u as withTimeout, z as sha256Hex } from "./worker-edges.js";
+import { D as registerSelect, F as ANON_USER_ID, H as queryHashInput, I as DEFAULT_REF_MODE, O as registerVars, R as listRefTableFor, V as sha256Hex, _ as heartbeatBatch, a as metaFromRow, c as parseDuration, d as parseQueryParams, h as bodySelect, k as singleSnapshotSelect, l as parseRecordIdString, n as rowOfEdge, s as encodeRecordId, t as hashOfEdge, u as withTimeout, v as heartbeatRowGone, x as listRefLive } from "./worker-edges.js";
 import { n as decodeTokenClaims } from "./worker-impersonation.js";
 import { RecordId, Surreal } from "surrealdb";
 
@@ -18,7 +18,8 @@ import { RecordId, Surreal } from "surrealdb";
 *   params, ttl }`, key = sha256(JSON.stringify({ surql, params, sessionId })));
 * - bodies with `SELECT * FROM $ids`;
 * - one `LIVE SELECT * FROM <the user's _00_list_ref table> FETCH out` per
-*   feed, so a changed row usually arrives inline with its edge; an edge whose
+*   feed (on the shared anon table, filtered to the feed's own edges; see
+*   `listRefLive`), so a changed row usually arrives inline with its edge; an edge whose
 *   `out` is a bare id (a server that ignores FETCH) costs a body read, one
 *   whose `out` is null (unreadable or deleted row) a membership re-read;
 * - `fn::query::heartbeat` at half the ttl, re-registering a reclaimed view;
@@ -45,6 +46,7 @@ const FLUSH_MS = 10;
 const FETCH_BATCH_MS = 15;
 const REREAD_MS = 50;
 const RELEASE_TIMEOUT_MS = 2e3;
+const MAX_SOCKETS = 16;
 function deferred() {
 	let resolve;
 	let reject;
@@ -184,6 +186,8 @@ var Feed = class {
 	liveStarting = null;
 	subs = /* @__PURE__ */ new Map();
 	sessionId;
+	/** `session::id()` of every socket this feed has had, oldest first. */
+	sockets = [];
 	ttl;
 	timeoutMs;
 	isClosed = false;
@@ -273,9 +277,23 @@ var Feed = class {
 			}));
 		}
 		this.db = db;
+		this.noteSession();
+	}
+	/**
+	* Remember the `session::id()` of the socket now open. Views are registered
+	* once and not again after a reconnect, so their edges keep naming the socket
+	* that registered them; the anonymous LIVE has to keep hearing those.
+	*/
+	async noteSession() {
+		try {
+			const [sid] = await this.q("RETURN <string>session::id()");
+			if (typeof sid !== "string" || this.sockets.includes(sid)) return;
+			this.sockets = [...this.sockets, sid].slice(-MAX_SOCKETS);
+		} catch {}
 	}
 	/** After a reconnect: LIVE again, then re-read every view (events in the gap are lost). */
 	async recover() {
+		this.noteSession();
 		try {
 			await this.ensureLive();
 			for (const sub of this.subs.values()) if (sub.loaded) this.scheduleReread(sub);
@@ -310,12 +328,18 @@ var Feed = class {
 		if (this.live || this.isClosed) return false;
 		if (!this.liveStarting) this.liveStarting = (async () => {
 			try {
+				const live = (inlineBodies) => listRefLive(this.table, {
+					inlineBodies,
+					sessionIds: this.sockets
+				});
 				let id;
 				try {
-					[id] = await this.q(`LIVE SELECT * FROM ${this.table} FETCH out`);
+					const { sql, vars } = live(true);
+					[id] = await this.q(sql, vars);
 				} catch (error) {
 					this.report(error);
-					[id] = await this.q(`LIVE SELECT * FROM ${this.table}`);
+					const { sql, vars } = live(false);
+					[id] = await this.q(sql, vars);
 				}
 				const stream = await this.db.liveOf(id);
 				const off = stream.subscribe((message) => this.onLive(message));

package/dist/pure.d.ts

@@ -1,4 +1,4 @@
-import { a as listRefTableFor, i as bucketIdForUser, n as DEFAULT_REF_MODE, o as sanitizeUserId, r as RefMode, t as ANON_USER_ID } from "./worker-ref-tables.js";
+import { a as bucketIdForUser, i as RefMode, n as ANON_USER_ID, o as listRefTableFor, r as DEFAULT_REF_MODE, s as sanitizeUserId, t as ANON_LIST_REF_TABLE } from "./worker-ref-tables.js";
 import { a as PushNotificationAction, c as PushPayloadKind, d as base64UrlToBytes, f as bytesToBase64Url, i as PushNotification, l as PushUrgency, m as sameBytes, n as BridgeTokenMessage, o as PushOp, p as isPushPayload, r as PUSH_PAYLOAD_VERSION, s as PushPayload, t as BridgeSignOutMessage, u as WebPushClientMessage } from "./worker-types.js";
 import { Duration, RecordId } from "surrealdb";
 import { ColumnSchema, RecordId as RecordId$1, SchemaStructure } from "@spooky-sync/query-builder";
@@ -201,6 +201,34 @@ declare const queryRowCountBatchSelect: () => string;
 declare const singleSnapshotSelect: (table: string) => string;
 /** The many-query read: all edges + all metas in one request. */
 declare const batchSnapshotSelect: (table: string) => string;
+/**
+ * The session's one LIVE subscription on its `_00_list_ref` table.
+ *
+ * `inlineBodies` adds `FETCH out`, which resolves the edge's target into the
+ * notification so the body arrives with the doorbell.
+ *
+ * On the anon table it is filtered to this client's own edges. Every
+ * signed-out session shares that table, so unfiltered each one received (and
+ * the server fetched a body for) every anonymous edge change of every other
+ * session, and the client then dropped all but its own. An edge carries the
+ * `session::id()` of whichever socket last registered its view, which is a
+ * socket of this client but not necessarily the current one: a view stays
+ * registered across a reconnect, and a reload keeps its salt and its views,
+ * so their older edges still name an earlier socket. `sessionIds` are those
+ * earlier sockets. The current one is matched by `session::id()` itself,
+ * which SurrealDB evaluates in the subscriber's own session, so the filter
+ * holds before the client has learned its new id.
+ *
+ * The cast is load-bearing: `session::id()` is a uuid, `clientId` a string,
+ * and without it nothing matches. Per-user tables need no filter.
+ */
+declare function listRefLive(table: string, opts: {
+  inlineBodies: boolean;
+  sessionIds: ReadonlyArray<string>;
+}): {
+  sql: string;
+  vars?: Vars;
+};
 interface RegisterPayload {
   id: RecordId<string>;
   surql: string;
@@ -334,4 +362,4 @@ declare function sha256Hex(input: string): Promise<string>;
  */
 declare function queryKey(input: QueryKeyInput, sessionId: string | null): Promise<string>;
 //#endregion
-export { ANON_USER_ID, type Answer, BridgeSignOutMessage, BridgeTokenMessage, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, type ListRefSnapshot, PUSH_PAYLOAD_VERSION, PushNotification, PushNotificationAction, PushOp, PushPayload, PushPayloadKind, PushUrgency, type QueryKeyInput, type QueryMetaRow, type RefMode, RegisterPayload, type SealOptions, type SealedQuery, type SurqlHelper, type TokenClaims, type TxQuery, VIEW_TABLE, WebPushClientMessage, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, leaveViewsBeacon, listRefBatchSelect, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, readViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };
+export { ANON_LIST_REF_TABLE, ANON_USER_ID, type Answer, BridgeSignOutMessage, BridgeTokenMessage, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, type ListRefSnapshot, PUSH_PAYLOAD_VERSION, PushNotification, PushNotificationAction, PushOp, PushPayload, PushPayloadKind, PushUrgency, type QueryKeyInput, type QueryMetaRow, type RefMode, RegisterPayload, type SealOptions, type SealedQuery, type SurqlHelper, type TokenClaims, type TxQuery, VIEW_TABLE, WebPushClientMessage, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, leaveViewsBeacon, listRefBatchSelect, listRefLive, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, readViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };

package/dist/pure.js

@@ -1,4 +1,4 @@
-import { A as readViewRows, B as queryHashInput, C as heartbeatRowGone, D as queryRowCountBatchSelect, E as listRefSelect, F as upsertBodiesTx, I as viewRecordId, L as viewRow, M as registerVars, N as singleSnapshotSelect, O as queryRowCountSelect, P as subqueryListRefSelect, R as surql, S as heartbeatBatch, T as listRefBatchSelect, V as viewKeyInput, _ as LEGACY_VIEW_TABLE, a as metaFromRow, b as bodySelect, c as parseDuration, d as parseQueryParams, f as ANON_USER_ID, g as sanitizeUserId, h as listRefTableFor, i as dedupeRecordVersions, j as registerSelect, k as readLegacyViewRows, l as parseRecordIdString, m as bucketIdForUser, n as rowOfEdge, o as snapshotFromSingle, p as DEFAULT_REF_MODE, r as FAILED, s as encodeRecordId, t as hashOfEdge, v as VIEW_TABLE, w as leaveViewsBeacon, x as countViewRows, y as batchSnapshotSelect, z as sha256Hex } from "./worker-edges.js";
+import { A as subqueryListRefSelect, B as surql, C as queryRowCountBatchSelect, D as registerSelect, E as readViewRows, F as ANON_USER_ID, H as queryHashInput, I as DEFAULT_REF_MODE, L as bucketIdForUser, M as viewRecordId, N as viewRow, O as registerVars, P as ANON_LIST_REF_TABLE, R as listRefTableFor, S as listRefSelect, T as readLegacyViewRows, U as viewKeyInput, V as sha256Hex, _ as heartbeatBatch, a as metaFromRow, b as listRefBatchSelect, c as parseDuration, d as parseQueryParams, f as LEGACY_VIEW_TABLE, g as countViewRows, h as bodySelect, i as dedupeRecordVersions, j as upsertBodiesTx, k as singleSnapshotSelect, l as parseRecordIdString, m as batchSnapshotSelect, n as rowOfEdge, o as snapshotFromSingle, p as VIEW_TABLE, r as FAILED, s as encodeRecordId, t as hashOfEdge, v as heartbeatRowGone, w as queryRowCountSelect, x as listRefLive, y as leaveViewsBeacon, z as sanitizeUserId } from "./worker-edges.js";
 import { n as decodeTokenClaims, t as IMPERSONATION_ACCESS } from "./worker-impersonation.js";
 import { a as sameBytes, i as isPushPayload, n as base64UrlToBytes, r as bytesToBase64Url, t as PUSH_PAYLOAD_VERSION } from "./worker-types.js";
 
@@ -21,4 +21,4 @@ function queryKey(input, sessionId) {
 }
 
 //#endregion
-export { ANON_USER_ID, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, PUSH_PAYLOAD_VERSION, VIEW_TABLE, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, leaveViewsBeacon, listRefBatchSelect, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, readViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };
+export { ANON_LIST_REF_TABLE, ANON_USER_ID, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, PUSH_PAYLOAD_VERSION, VIEW_TABLE, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, leaveViewsBeacon, listRefBatchSelect, listRefLive, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, readViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };

package/dist/types.d.ts

@@ -668,11 +668,21 @@ declare class RemoteDatabaseService extends AbstractDatabaseService {
    * whose own session id matches none of them, so it names these instead. Kept
    * for the page, not the socket: a view registered before a reconnect still
    * carries the old id until its next heartbeat.
+   *
+   * The anonymous LIVE filters on the same ids (see `listRefLive`): its edges
+   * name the socket that registered their view, which may be an earlier one.
+   * A reload hands its ids to the next page with the salt.
    */
   private sessionIdsSeen;
   constructor(config: Sp00kyConfig<any>['database'], logger: Logger$1);
   /** See {@link sessionIdsSeen}. */
   sessionIds(): readonly string[];
+  /**
+   * Take on the session ids of the page this one reloaded from. It kept that
+   * page's salt, so the views it re-registers still carry edges stamped by
+   * those sockets. Older than anything this page has seen, so they go first.
+   */
+  adoptSessionIds(ids: ReadonlyArray<string>): void;
   /**
    * Ask the socket that just connected for its session id. Straight to the
    * SDK: it needs no namespace or identity, so it need not wait behind an

package/dist/worker-edges.js

@@ -97,6 +97,71 @@ const surql = {
 	}
 };
 
+//#endregion
+//#region src/modules/ref-tables.ts
+/**
+* Sentinel user id for unauthenticated clients when anonymous live queries are
+* enabled. Mirrors `ssp_protocol::ANON_AUTH_ID`. It carries no `user:` prefix
+* so it can never collide with a real user id (those arrive as `user:<id>`);
+* both sides resolve it to the shared `_00_list_ref_anon` table.
+*/
+const ANON_USER_ID = "anon";
+/** The one `_00_list_ref` table every signed-out session shares. */
+const ANON_LIST_REF_TABLE = "_00_list_ref_anon";
+/**
+* Default ref-storage mode for this client build. Mirrors the SSP's
+* default (`RefMode::Dedicated`) so cross-session sync works out of the
+* box.
+*/
+const DEFAULT_REF_MODE = "dedicated";
+/**
+* Sanitize a user record id (e.g. `"user:abc"`) into the segment that
+* goes into a dedicated table name (e.g. `"abc"`). Returns `null` if
+* the id is missing the `user:` prefix or contains characters that
+* aren't valid in a SurrealDB table identifier — the server-side
+* `ssp_protocol::sanitize_user_id` uses the same predicate.
+*
+* Accepts both string ids (`"user:abc"`) and SurrealDB `RecordId`
+* objects (which only stringify cleanly via `.toString()`), since
+* `AuthService` passes the record-id object as-is to its subscribers.
+*/
+function sanitizeUserId(userId) {
+	if (userId === null || userId === void 0) return null;
+	const asString = typeof userId === "string" ? userId : typeof userId.toString === "function" ? userId.toString() : null;
+	if (!asString) return null;
+	const raw = asString.startsWith("user:") ? asString.slice(5) : asString;
+	if (raw.length === 0) return null;
+	if (!/^[A-Za-z0-9_]+$/.test(raw)) return null;
+	return raw;
+}
+/**
+* Resolve the LOCAL storage bucket id for a user. Every user gets their own
+* IndexedDB-backed local store (`indxdb://sp00ky-<bucketId>`) so cached rows,
+* query state, and the mutation outbox never leak across accounts on a shared
+* device. Signed-out sessions share the `anon` bucket.
+*
+* An id that fails sanitization still gets a DETERMINISTIC per-user bucket
+* (cyrb53 hex of the raw id) — falling back to `anon` here would put an
+* authenticated user in the shared bucket and recreate the cross-user leak.
+*/
+function bucketIdForUser(userId) {
+	if (userId === null || userId === void 0 || userId === ANON_USER_ID) return ANON_USER_ID;
+	const uid = sanitizeUserId(userId);
+	if (uid) return uid;
+	return `u${cyrb53(String(userId)).toString(16)}`;
+}
+/**
+* Returns the `_00_list_ref` table name for `(mode, userId)`. Falls
+* back to the global `_00_list_ref` when sanitization fails or in
+* single mode.
+*/
+function listRefTableFor(mode, userId) {
+	if (userId === ANON_USER_ID) return ANON_LIST_REF_TABLE;
+	if (mode === "single") return "_00_list_ref";
+	const uid = sanitizeUserId(userId);
+	return uid ? `_00_list_ref_user_${uid}` : "_00_list_ref";
+}
+
 //#endregion
 //#region src/query/sql.ts
 /** Every SurrealQL statement the query side sends, as pure builders. */
@@ -119,15 +184,44 @@ const readViewRows = () => `SELECT * FROM ${VIEW_TABLE}`;
 /** Copy every legacy `_00_window` row into `_00_view` once. */
 const readLegacyViewRows = () => `SELECT * FROM ${LEGACY_VIEW_TABLE}`;
 const countViewRows = () => `SELECT count() FROM ${VIEW_TABLE} GROUP ALL`;
-const listRefSelect = (table) => `SELECT out, version FROM ${table} WHERE in = $in AND parent IS NONE`;
-const subqueryListRefSelect = (table) => `SELECT out, version FROM ${table} WHERE in = $in AND parent IS NOT NONE`;
+const listRefSelect = (table) => `SELECT out, version FROM $in->${table} WHERE parent IS NONE`;
+const subqueryListRefSelect = (table) => `SELECT out, version FROM $in->${table} WHERE parent IS NOT NONE`;
 const queryRowCountSelect = () => "SELECT VALUE { rowCount: rowCount, state: state } FROM ONLY $in";
-const listRefBatchSelect = (table) => `SELECT in, out, version, parent FROM ${table} WHERE in IN $ins`;
+const listRefBatchSelect = (table) => `SELECT in, out, version, parent FROM $ins->${table}`;
 const queryRowCountBatchSelect = () => "SELECT VALUE { id: id, rowCount: rowCount, state: state } FROM $ins";
 /** The single-query read: edges, meta, subquery children in one request. */
 const singleSnapshotSelect = (table) => `${listRefSelect(table)};\n${queryRowCountSelect()};\n${subqueryListRefSelect(table)}`;
 /** The many-query read: all edges + all metas in one request. */
 const batchSnapshotSelect = (table) => `${listRefBatchSelect(table)};\n${queryRowCountBatchSelect()}`;
+/**
+* The session's one LIVE subscription on its `_00_list_ref` table.
+*
+* `inlineBodies` adds `FETCH out`, which resolves the edge's target into the
+* notification so the body arrives with the doorbell.
+*
+* On the anon table it is filtered to this client's own edges. Every
+* signed-out session shares that table, so unfiltered each one received (and
+* the server fetched a body for) every anonymous edge change of every other
+* session, and the client then dropped all but its own. An edge carries the
+* `session::id()` of whichever socket last registered its view, which is a
+* socket of this client but not necessarily the current one: a view stays
+* registered across a reconnect, and a reload keeps its salt and its views,
+* so their older edges still name an earlier socket. `sessionIds` are those
+* earlier sockets. The current one is matched by `session::id()` itself,
+* which SurrealDB evaluates in the subscriber's own session, so the filter
+* holds before the client has learned its new id.
+*
+* The cast is load-bearing: `session::id()` is a uuid, `clientId` a string,
+* and without it nothing matches. Per-user tables need no filter.
+*/
+function listRefLive(table, opts) {
+	const join = opts.inlineBodies ? " FETCH out" : "";
+	if (table !== ANON_LIST_REF_TABLE) return { sql: `LIVE SELECT * FROM ${table}${join}` };
+	return {
+		sql: `LIVE SELECT * FROM ${table} WHERE clientId = <string>session::id() OR clientId IN $sids${join}`,
+		vars: { sids: [...opts.sessionIds] }
+	};
+}
 /** Register + read back edges/meta/children in ONE request. */
 const registerSelect = (table) => `fn::query::register($config);\n${singleSnapshotSelect(table)}`;
 const registerVars = (payload) => ({
@@ -178,69 +272,6 @@ function upsertBodiesTx(records) {
 	};
 }
 
-//#endregion
-//#region src/modules/ref-tables.ts
-/**
-* Sentinel user id for unauthenticated clients when anonymous live queries are
-* enabled. Mirrors `ssp_protocol::ANON_AUTH_ID`. It carries no `user:` prefix
-* so it can never collide with a real user id (those arrive as `user:<id>`);
-* both sides resolve it to the shared `_00_list_ref_anon` table.
-*/
-const ANON_USER_ID = "anon";
-/**
-* Default ref-storage mode for this client build. Mirrors the SSP's
-* default (`RefMode::Dedicated`) so cross-session sync works out of the
-* box.
-*/
-const DEFAULT_REF_MODE = "dedicated";
-/**
-* Sanitize a user record id (e.g. `"user:abc"`) into the segment that
-* goes into a dedicated table name (e.g. `"abc"`). Returns `null` if
-* the id is missing the `user:` prefix or contains characters that
-* aren't valid in a SurrealDB table identifier — the server-side
-* `ssp_protocol::sanitize_user_id` uses the same predicate.
-*
-* Accepts both string ids (`"user:abc"`) and SurrealDB `RecordId`
-* objects (which only stringify cleanly via `.toString()`), since
-* `AuthService` passes the record-id object as-is to its subscribers.
-*/
-function sanitizeUserId(userId) {
-	if (userId === null || userId === void 0) return null;
-	const asString = typeof userId === "string" ? userId : typeof userId.toString === "function" ? userId.toString() : null;
-	if (!asString) return null;
-	const raw = asString.startsWith("user:") ? asString.slice(5) : asString;
-	if (raw.length === 0) return null;
-	if (!/^[A-Za-z0-9_]+$/.test(raw)) return null;
-	return raw;
-}
-/**
-* Resolve the LOCAL storage bucket id for a user. Every user gets their own
-* IndexedDB-backed local store (`indxdb://sp00ky-<bucketId>`) so cached rows,
-* query state, and the mutation outbox never leak across accounts on a shared
-* device. Signed-out sessions share the `anon` bucket.
-*
-* An id that fails sanitization still gets a DETERMINISTIC per-user bucket
-* (cyrb53 hex of the raw id) — falling back to `anon` here would put an
-* authenticated user in the shared bucket and recreate the cross-user leak.
-*/
-function bucketIdForUser(userId) {
-	if (userId === null || userId === void 0 || userId === ANON_USER_ID) return ANON_USER_ID;
-	const uid = sanitizeUserId(userId);
-	if (uid) return uid;
-	return `u${cyrb53(String(userId)).toString(16)}`;
-}
-/**
-* Returns the `_00_list_ref` table name for `(mode, userId)`. Falls
-* back to the global `_00_list_ref` when sanitization fails or in
-* single mode.
-*/
-function listRefTableFor(mode, userId) {
-	if (userId === ANON_USER_ID) return "_00_list_ref_anon";
-	if (mode === "single") return "_00_list_ref";
-	const uid = sanitizeUserId(userId);
-	return uid ? `_00_list_ref_user_${uid}` : "_00_list_ref";
-}
-
 //#endregion
 //#region src/utils/parser.ts
 /**
@@ -436,4 +467,4 @@ function rowOfEdge(value) {
 }
 
 //#endregion
-export { readViewRows as A, queryHashInput as B, heartbeatRowGone as C, queryRowCountBatchSelect as D, listRefSelect as E, upsertBodiesTx as F, viewRecordId as I, viewRow as L, registerVars as M, singleSnapshotSelect as N, queryRowCountSelect as O, subqueryListRefSelect as P, surql as R, heartbeatBatch as S, listRefBatchSelect as T, viewKeyInput as V, LEGACY_VIEW_TABLE as _, metaFromRow as a, bodySelect as b, parseDuration as c, parseQueryParams as d, ANON_USER_ID as f, sanitizeUserId as g, listRefTableFor as h, dedupeRecordVersions as i, registerSelect as j, readLegacyViewRows as k, parseRecordIdString as l, bucketIdForUser as m, rowOfEdge as n, snapshotFromSingle as o, DEFAULT_REF_MODE as p, FAILED as r, encodeRecordId as s, hashOfEdge as t, withTimeout as u, VIEW_TABLE as v, leaveViewsBeacon as w, countViewRows as x, batchSnapshotSelect as y, sha256Hex as z };
+export { subqueryListRefSelect as A, surql as B, queryRowCountBatchSelect as C, registerSelect as D, readViewRows as E, ANON_USER_ID as F, queryHashInput as H, DEFAULT_REF_MODE as I, bucketIdForUser as L, viewRecordId as M, viewRow as N, registerVars as O, ANON_LIST_REF_TABLE as P, listRefTableFor as R, listRefSelect as S, readLegacyViewRows as T, viewKeyInput as U, sha256Hex as V, heartbeatBatch as _, metaFromRow as a, listRefBatchSelect as b, parseDuration as c, parseQueryParams as d, LEGACY_VIEW_TABLE as f, countViewRows as g, bodySelect as h, dedupeRecordVersions as i, upsertBodiesTx as j, singleSnapshotSelect as k, parseRecordIdString as l, batchSnapshotSelect as m, rowOfEdge as n, snapshotFromSingle as o, VIEW_TABLE as p, FAILED as r, encodeRecordId as s, hashOfEdge as t, withTimeout as u, heartbeatRowGone as v, queryRowCountSelect as w, listRefLive as x, leaveViewsBeacon as y, sanitizeUserId as z };

package/dist/worker-ref-tables.d.ts

@@ -7,6 +7,8 @@ type RefMode = 'single' | 'dedicated';
  * both sides resolve it to the shared `_00_list_ref_anon` table.
  */
 declare const ANON_USER_ID = "anon";
+/** The one `_00_list_ref` table every signed-out session shares. */
+declare const ANON_LIST_REF_TABLE = "_00_list_ref_anon";
 /**
  * Default ref-storage mode for this client build. Mirrors the SSP's
  * default (`RefMode::Dedicated`) so cross-session sync works out of the
@@ -43,4 +45,4 @@ declare function bucketIdForUser(userId: unknown): string;
  */
 declare function listRefTableFor(mode: RefMode, userId: unknown): string;
 //#endregion
-export { listRefTableFor as a, bucketIdForUser as i, DEFAULT_REF_MODE as n, sanitizeUserId as o, RefMode as r, ANON_USER_ID as t };
+export { bucketIdForUser as a, RefMode as i, ANON_USER_ID as n, listRefTableFor as o, DEFAULT_REF_MODE as r, sanitizeUserId as s, ANON_LIST_REF_TABLE as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.320",
+  "version": "0.0.1-canary.321",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -75,8 +75,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.320",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.320",
+    "@spooky-sync/query-builder": "0.0.1-canary.321",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.321",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.0.3",
     "blurhash": "^2.0.5",