@spooky-sync/core 0.0.1-canary.331 → 0.0.1-canary.333

package/AGENTS.md

@@ -38,7 +38,7 @@ re-materialized from state, never patched in place.
 - `BucketHandle` — file storage handle (`put`, `get`, `delete`, `exists`), plus the cache-aware `read`, `url`, `pin`/`unpin`, `evict`, `prefetch`. `get` is always remote; `read`/`url` go through the blob cache. A bucket generated with `backend: 'r2'` (`BACKEND "r2"`) sends its bytes to the SSP over HTTP (`<files.endpoint>/bucket/<name>/<path>`, bearer = the session token from `RemoteDatabaseService.getAuthToken()`) instead of `f"bucket:/path"` statements; the SSP checks `fn::_00_bucket::<name>` as the user first.
 - `services/blobs/` — durable cache for bucket bytes: OPFS holds the files, `_00_blob` holds a manifest that reconcile rebuilds from disk (so a wiped local store costs metadata, not the offline cache). Nothing expires on a timer; eviction is LRU under a byte budget only, skipping pinned and on-screen entries. Config: `blobCache` in `types.ts`.
 - `AuthService` — token management, sign-in/sign-out events. `subscribe(cb, { immediate? })` calls `cb` at once with the current user unless `immediate: false`, then on every change.
-- `CrdtManager`, `CrdtField`, `cursorColorFromName`, `CURSOR_COLORS`: collaborative `@crdt` fields on Loro. Client methods: `openCrdtField(table, recordId, field, draft?)` -> `Promise<CrdtField>` (every open of one field in a tab shares one `LoroDoc`; pair each with a close), `closeCrdtField(table, recordId, field)` -> `Promise<void>` (resolves once unsent edits are in the outbox; offline, once they are saved on the device, never waiting on the network), `createCrdtDraft(table, field)` -> a detached `CrdtField` for a record not created yet (`db.create` first, then pass it to `openCrdtField` as `draft`). `CrdtField`: `getDoc()`, `hasContent()`, `pushCursorState(bytes)`, `onCursorUpdate = cb` (a setter). Config: `crdt: true` preloads Loro, `crdtDebounceMs` (default 300, max wait 2 s). Design: `docs/crdt-v2.md` at the repo root.
+- `CrdtManager`, `CrdtField`, `cursorColorFromName`, `CURSOR_COLORS`: collaborative `@crdt` fields on Loro. Client methods: `openCrdtField(table, recordId, field, draft?)` -> `Promise<CrdtField>` (every open of one field in a tab shares one `LoroDoc`; pair each with a close), `closeCrdtField(table, recordId, field)` -> `Promise<void>` (resolves once unsent edits are in the outbox; offline, once they are saved on the device, never waiting on the network), `createCrdtDraft(table, field)` -> a detached `CrdtField` for a record not created yet (`db.create` first, then pass it to `openCrdtField` as `draft`). `CrdtField`: `getDoc()`, `hasContent()`, `pushCursorState(bytes)`, `onCursorUpdate = cb` (a setter). Config: `crdt: true` preloads Loro, `crdtDebounceMs` (the first edit after a quiet spell waits this long, default 50), `crdtSendIntervalMs` (shortest gap between two sends of one field while typing, default 200). Design: `docs/crdt-v2.md` at the repo root.
 - Types: `Sp00kyConfig` (client-solid wraps it as `SyncedDbConfig`), `QueryTimeToLive`, `PersistenceClient`, `StoreType`, `UpdateOptions`, `RunOptions`, `PreloadOptions`.
 - Subpath: `@spooky-sync/core/otel` — `createOtelTransmit(endpoint)` for piping pino logs to OpenTelemetry.
 - `client.webPush` (`WebPushModule`, `db.webPush` in the Solid bindings) - Web Push on the page: `support()`, `info()`, `subscribe(opts)` (call from a click), `unsubscribe(opts)`, `sync()`, `isSubscribed()`, `update(opts)`, `devices()`, `notify(msg)`, `cancel(id)`, `test()`, `bridge()`, `onMessage(cb)`. Server calls are `fn::push::*`; typed `WebPushError`; config `webPush` in `types.ts`. Sign-out runs through `AuthService.onBeforeSignOut`.

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as WebPushSubscribeOptions, A as RunOptions, At as Logger$1, B as SyncHealthStatus, Bt as SESSION_POLL_MS, C as QueryTimeToLive, Ct as SignOutHook, D as RecordVersionArray, Dt as createAuthEventSystem, E as ReconnectConfig, Et as AuthEventTypes, F as StorageHealth, Ft as IMPERSONATION_ACCESS, G as WebPushConfig, Gt as sameImpersonation, H as UpdateOptions, Ht as decodeTokenClaims, I as StorageHealthStatus, It as ImpersonationInfo, J as WebPushErrorCode, K as WebPushDevice, L as StoreType, Lt as ImpersonationTimerHost, M as Sp00kyConfig, Mt as SealedQuery, N as Sp00kyQueryResult, Nt as EventDefinition, O as RecordVersionDiff, Ot as RemoteDatabaseService, P as Sp00kyQueryResultPromise, Pt as EventSystem, Q as WebPushModule, R as SyncHealth, Rt as ImpersonationTimers, S as QueryStatusCallback, St as SignOutContext, T as QueryUpdateCallback, Tt as AuthEventTypeMap, U as PUSH_ENDPOINT_KEY, Ut as impersonationFromToken, V as TimingPhase, Vt as TokenClaims, W as PushDeviceKind, Wt as renewDelayMs, X as WebPushMessage, Y as WebPushInfo, Z as WebPushMessageInput, _ as QueryConfig, _t as isPushPayload, a as Level, at as WebPushUpdateOptions, b as QueryState, bt as ImpersonationCandidate, c as MutationCallback, ct as BridgeTokenMessage, d as PersistenceClient, dt as PushNotificationAction, et as WebPushSupport, f as PhaseStat, ft as PushOp, g as QueryAuthorityCallback, gt as WebPushClientMessage, h as PreloadRefresh, ht as PushUrgency, i as InlineRow, it as WebPushUnsupportedReason, j as ServerViewMeta, jt as LocalStore, k as RegistrationTimings, kt as LogTap, l as MutationEvent, lt as PUSH_PAYLOAD_VERSION, m as PreloadOptions, mt as PushPayloadKind, n as DebounceOptions, nt as WebPushSyncStatus, o as MATERIALIZATION_SAMPLE_WINDOW, ot as detectWebPushSupport, p as PinoTransmit, pt as PushPayload, q as WebPushError, r as EventSubscriptionOptions, rt as WebPushUnsubscribeOptions, s as MembershipOutcome, st as BridgeSignOutMessage, t as ConnectionState, tt as WebPushSyncOptions, u as MutationEventType, ut as PushNotification, v as QueryConfigRecord, vt as ActiveImpersonation, w as QueryTimings, wt as AuthEventSystem, x as QueryStatus, xt as SIGN_OUT_HOOK_TIMEOUT_MS, y as QueryHash, yt as AuthService, z as SyncHealthConfig, zt as ORIGIN_TOKEN_KEY } from "./types.js";
+import { $ as WebPushModule, A as RegistrationTimings, At as RemoteDatabaseService, B as SyncHealthConfig, Bt as ImpersonationTimers, C as QueryStatusCallback, Ct as SIGN_OUT_HOOK_TIMEOUT_MS, D as ReconnectConfig, Dt as AuthEventTypeMap, E as QueryUpdateCallback, Et as AuthEventSystem, F as Sp00kyQueryResultPromise, Ft as EventDefinition, G as PushDeviceKind, Gt as impersonationFromToken, H as TimingPhase, Ht as SESSION_POLL_MS, I as StorageHealth, It as EventSystem, J as WebPushError, K as WebPushConfig, Kt as renewDelayMs, L as StorageHealthStatus, Lt as IMPERSONATION_ACCESS, M as ServerViewMeta, Mt as Logger$1, N as Sp00kyConfig, Nt as LocalStore, O as RecordVersionArray, Ot as AuthEventTypes, P as Sp00kyQueryResult, Pt as SealedQuery, Q as WebPushMessageInput, R as StoreType, Rt as ImpersonationInfo, S as QueryStatus, St as REFUSAL_RECHECK_MIN_MS, T as QueryTimings, Tt as SignOutHook, U as UpdateOptions, Ut as TokenClaims, V as SyncHealthStatus, Vt as ORIGIN_TOKEN_KEY, W as PUSH_ENDPOINT_KEY, Wt as decodeTokenClaims, X as WebPushInfo, Y as WebPushErrorCode, Z as WebPushMessage, _ as QueryAuthorityCallback, _t as WebPushClientMessage, a as InlineRow, at as WebPushUnsupportedReason, b as QueryHash, bt as AuthService, c as MembershipOutcome, ct as BridgeSignOutMessage, d as MutationEventType, dt as PushNotification, et as WebPushSubscribeOptions, f as PersistenceClient, ft as PushNotificationAction, g as PreloadRefresh, gt as PushUrgency, h as PreloadOptions, ht as PushPayloadKind, i as EventSubscriptionOptions, it as WebPushUnsubscribeOptions, j as RunOptions, jt as LogTap, k as RecordVersionDiff, kt as createAuthEventSystem, l as MutationCallback, lt as BridgeTokenMessage, m as PinoTransmit, mt as PushPayload, n as DebounceOptions, nt as WebPushSyncOptions, o as Level, ot as WebPushUpdateOptions, p as PhaseStat, pt as PushOp, q as WebPushDevice, qt as sameImpersonation, r as EdgeDelta, rt as WebPushSyncStatus, s as MATERIALIZATION_SAMPLE_WINDOW, st as detectWebPushSupport, t as ConnectionState, tt as WebPushSupport, u as MutationEvent, ut as PUSH_PAYLOAD_VERSION, v as QueryConfig, vt as isPushPayload, w as QueryTimeToLive, wt as SignOutContext, x as QueryState, xt as ImpersonationCandidate, y as QueryConfigRecord, yt as ActiveImpersonation, z as SyncHealth, zt as ImpersonationTimerHost } from "./types.js";
 import { BackendNames, BackendRoutes, BucketNames, FinalQuery, GetTable, QueryBuilder, QueryOptions, QueryPlan, RecordId, RoutePayload, SchemaStructure, TableModel, TableNames } from "@spooky-sync/query-builder";
 import * as surrealdb0 from "surrealdb";
 import { Duration, RecordId as RecordId$1, Surreal } from "surrealdb";
@@ -608,7 +608,10 @@ declare class CrdtManager {
   private schema;
   private local;
   private remote;
+  /** First edit after a quiet spell: wait this long to batch the burst. */
   private debounceMs;
+  /** Shortest gap between two sends of one field, while edits keep coming. */
+  private sendIntervalMs;
   private sessions;
   private opening;
   /** Closes still saving their field's local state, by session key. */
@@ -620,7 +623,9 @@ declare class CrdtManager {
   private claim;
   private claimRetry;
   private connectionUnsubscribes;
-  constructor(schema: SchemaStructure, local: LocalStore, remote: RemoteDatabaseService, logger: Logger$1, debounceMs?: number);
+  constructor(schema: SchemaStructure, local: LocalStore, remote: RemoteDatabaseService, logger: Logger$1, /** First edit after a quiet spell: wait this long to batch the burst. */
+  debounceMs?: number, /** Shortest gap between two sends of one field, while edits keep coming. */
+  sendIntervalMs?: number);
   /** Hand over the runtime ports. Called once by the client facade. */
   attach(ports: CrdtPorts): void;
   /**
@@ -680,7 +685,16 @@ declare class CrdtManager {
    * be merged away; that is logged.
    */
   private verify;
+  /**
+   * Arm the send. Edits go out on a steady cadence while they keep coming:
+   * the first one after a quiet spell waits `debounceMs` (one row for the
+   * burst), later ones at least `sendIntervalMs` after the previous send. An
+   * armed timer is never pushed back, so continuous typing cannot hold the
+   * edits; it is only brought forward (`delay`, e.g. 0 on reconnect).
+   */
   private scheduleFlush;
+  /** Send what is unsent. A call while a send runs queues one more after it,
+   *  so edits made during that send are not left waiting for the next edit. */
   private flush;
   /** Send every own peer's ops that are not in the outbox yet, one row per
    *  peer. Only the peer's own ops travel (`updates-in-range`): a plain
@@ -961,6 +975,7 @@ type RuntimeEvent = {
   type: 'LiveChange';
   hashes: QueryHash[];
   rows?: InlineRow[];
+  deltas?: EdgeDelta[];
 } | {
   type: 'TabRole';
   role: 'solo' | 'leader' | 'follower';
@@ -1442,7 +1457,7 @@ interface Adapters {
      * changed query hashes, plus the changed rows themselves when the
      * subscription was opened with the body joined on (`liveInlineBodies`).
      */
-    live(table: string, onChange: (hashes: string[], rows?: InlineRow[]) => void): Promise<string>;
+    live(table: string, onChange: (hashes: string[], rows?: InlineRow[], deltas?: EdgeDelta[]) => void): Promise<string>;
     kill(uuid: string): Promise<void>;
   };
   ssp: {
@@ -2197,4 +2212,4 @@ declare class LocalOpTimeoutError extends Error {
  *  select on a throttled tab is seconds, not tens of seconds. */
 declare const DEFAULT_LOCAL_OP_TIMEOUT_MS = 30000;
 //#endregion
-export { ActiveImpersonation, AppReleaseHandle, AppReleaseModule, type AppReleaseOptions, type AppReleaseSnapshot, AuthEventSystem, AuthEventTypeMap, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, type BlobCacheStats, type BlobEntry, type BlobKey, type BlobReadOptions, type BlobUrlLease, type BlurhashEncodeOptions, type BlurhashSetting, type BridgeSignOutMessage, type BridgeTokenMessage, BucketHandle, BucketPutOptions, BucketPutResult, CURSOR_COLORS, ConnectionState, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, DebounceOptions, EventSubscriptionOptions, type FailedMutationRow as FailedMutation, FeatureFlagHandle, FeatureFlagModule, type FeatureFlagOptions, type FeatureFlagOverride, type FeatureFlagSnapshot, IMPERSONATION_ACCESS, ImpersonationCandidate, ImpersonationInfo, ImpersonationTimerHost, ImpersonationTimers, InlineRow, Level, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, MembershipOutcome, MutationCallback, MutationEvent, MutationEventType, ORIGIN_TOKEN_KEY, PUSH_ENDPOINT_KEY, PUSH_PAYLOAD_VERSION, PersistenceClient, PhaseStat, PinoTransmit, PreloadOptions, PreloadRefresh, type PushDeviceKind, type PushNotification, type PushNotificationAction, type PushOp, type PushPayload, type PushPayloadKind, type PushUrgency, QueryAuthorityCallback, QueryConfig, QueryConfigRecord, QueryHash, QueryState, QueryStatus, QueryStatusCallback, QueryTimeToLive, QueryTimings, QueryUpdateCallback, ReconnectConfig, RecordVersionArray, RecordVersionDiff, RegistrationTimings, RunOptions, SESSION_POLL_MS, SIGN_OUT_HOOK_TIMEOUT_MS, ServerViewMeta, SignOutContext, SignOutHook, Sp00kyClient, Sp00kyClientDeps, Sp00kyConfig, Sp00kyQueryResult, Sp00kyQueryResultPromise, StorageHealth, StorageHealthStatus, StoreType, SyncHealth, SyncHealthConfig, SyncHealthStatus, TimingPhase, TokenClaims, UpdateOptions, type WebPushClientMessage, type WebPushConfig, type WebPushDevice, WebPushError, type WebPushErrorCode, type WebPushInfo, type WebPushMessage, type WebPushMessageInput, WebPushModule, type WebPushSubscribeOptions, type WebPushSupport, type WebPushSyncOptions, type WebPushSyncStatus, type WebPushUnsubscribeOptions, type WebPushUnsupportedReason, type WebPushUpdateOptions, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, detectWebPushSupport, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, isPushPayload, renewDelayMs, sameImpersonation, semverGt, textToHtml };
+export { ActiveImpersonation, AppReleaseHandle, AppReleaseModule, type AppReleaseOptions, type AppReleaseSnapshot, AuthEventSystem, AuthEventTypeMap, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, type BlobCacheStats, type BlobEntry, type BlobKey, type BlobReadOptions, type BlobUrlLease, type BlurhashEncodeOptions, type BlurhashSetting, type BridgeSignOutMessage, type BridgeTokenMessage, BucketHandle, BucketPutOptions, BucketPutResult, CURSOR_COLORS, ConnectionState, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, DebounceOptions, EdgeDelta, EventSubscriptionOptions, type FailedMutationRow as FailedMutation, FeatureFlagHandle, FeatureFlagModule, type FeatureFlagOptions, type FeatureFlagOverride, type FeatureFlagSnapshot, IMPERSONATION_ACCESS, ImpersonationCandidate, ImpersonationInfo, ImpersonationTimerHost, ImpersonationTimers, InlineRow, Level, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, MembershipOutcome, MutationCallback, MutationEvent, MutationEventType, ORIGIN_TOKEN_KEY, PUSH_ENDPOINT_KEY, PUSH_PAYLOAD_VERSION, PersistenceClient, PhaseStat, PinoTransmit, PreloadOptions, PreloadRefresh, type PushDeviceKind, type PushNotification, type PushNotificationAction, type PushOp, type PushPayload, type PushPayloadKind, type PushUrgency, QueryAuthorityCallback, QueryConfig, QueryConfigRecord, QueryHash, QueryState, QueryStatus, QueryStatusCallback, QueryTimeToLive, QueryTimings, QueryUpdateCallback, REFUSAL_RECHECK_MIN_MS, ReconnectConfig, RecordVersionArray, RecordVersionDiff, RegistrationTimings, RunOptions, SESSION_POLL_MS, SIGN_OUT_HOOK_TIMEOUT_MS, ServerViewMeta, SignOutContext, SignOutHook, Sp00kyClient, Sp00kyClientDeps, Sp00kyConfig, Sp00kyQueryResult, Sp00kyQueryResultPromise, StorageHealth, StorageHealthStatus, StoreType, SyncHealth, SyncHealthConfig, SyncHealthStatus, TimingPhase, TokenClaims, UpdateOptions, type WebPushClientMessage, type WebPushConfig, type WebPushDevice, WebPushError, type WebPushErrorCode, type WebPushInfo, type WebPushMessage, type WebPushMessageInput, WebPushModule, type WebPushSubscribeOptions, type WebPushSupport, type WebPushSyncOptions, type WebPushSyncStatus, type WebPushUnsubscribeOptions, type WebPushUnsupportedReason, type WebPushUpdateOptions, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, detectWebPushSupport, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, isPushPayload, renewDelayMs, sameImpersonation, semverGt, textToHtml };

package/dist/index.js

@@ -551,6 +551,16 @@ function classifySyncError(error) {
 	for (const pattern of NETWORK_ERROR_PATTERNS) if (message.includes(pattern)) return "network";
 	return "application";
 }
+/**
+* Whether the server refused the SESSION rather than the statement: its own
+* wording for a token it will not accept ("There was a problem with
+* authentication"), which is also what an app's AUTHENTICATE clause and
+* sp00ky's session guard throw, and a session past its `DURATION FOR SESSION`.
+*/
+function isRefusedSessionError(error) {
+	const message = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+	return message.includes("problem with authentication") || message.includes("session has expired");
+}
 
 //#endregion
 //#region src/utils/index.ts
@@ -2188,8 +2198,8 @@ function trimHistory(history, cap) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.331";
-const WASM_VERSION = "0.0.1-canary.331";
+const CORE_VERSION = "0.0.1-canary.333";
+const WASM_VERSION = "0.0.1-canary.333";
 const SURREAL_VERSION = "3.1.0";
 var DevToolsService = class DevToolsService {
 	version = CORE_VERSION;
@@ -4168,6 +4178,35 @@ function decideMembershipOutcome(input) {
 	return meta.rowCount === 0 && meta.state !== "materializing" ? "applied" : "ignored";
 }
 /**
+* Commit LIVE edge deltas onto a held id-set: each names a row that joined
+* (or moved to a newer version). Returns `held` itself when nothing moves.
+*/
+function withDeltas(held, deltas) {
+	const next = new Map(held);
+	let moved = false;
+	for (const { id, version } of deltas) {
+		if ((next.get(id) ?? -1) >= version) continue;
+		next.set(id, version);
+		moved = true;
+	}
+	return moved ? Array.from(next.entries()) : held;
+}
+/**
+* A membership read answers for the moment the server ran it, which may be
+* before a LIVE delta that was committed while the read was in flight. Carry
+* what changed in state since the read was sent (`before` -> `now`) over onto
+* the read, so a late answer never takes back a row that just joined.
+*/
+function rebaseRead(read, before, now) {
+	if (before === now) return read;
+	const was = new Map(before);
+	const is = new Map(now);
+	const out = new Map(read);
+	for (const [id] of before) if (!is.has(id)) out.delete(id);
+	for (const [id, version] of now) if (version > (was.get(id) ?? -1) && version > (out.get(id) ?? -1)) out.set(id, version);
+	return Array.from(out.entries());
+}
+/**
 * A statement that did not answer (an ERR, or no result at all). Kept apart
 * from a `null` result, which is the server saying "no such row": reading a
 * failed statement as a missing row turned every timeout under load into a
@@ -4854,9 +4893,38 @@ const stmt$1 = (results, i) => {
 	return r && r.status === "OK" ? r.result : FAILED;
 };
 /**
+* Commit LIVE edge deltas (rows joining a view, or moving to a newer
+* version) straight to membership, without re-reading the edges: the
+* notification already says what the read would. Returns the hashes it
+* settled; any other change still goes through {@link readMembership}.
+*
+* Only for a query whose membership is known and current (`live`, not
+* materializing, no view-lost recovery pending): before that the read decides
+* what the set is. Removals are never applied here, so a view whose edges
+* are being rewritten never loses (and garbage-collects) bodies mid-rewrite.
+* Nor for a query with a `LIMIT`: a row joining it pushes another out, and
+* rendering the joiner before the read removes the leaver would show one row
+* too many (the id-set render drops the `LIMIT`).
+*/
+function* applyEdgeDeltas(deltas) {
+	const settled = /* @__PURE__ */ new Set();
+	const byHash = /* @__PURE__ */ new Map();
+	for (const d of deltas) byHash.set(d.hash, [...byHash.get(d.hash) ?? [], d]);
+	for (const [hash, list] of byHash) {
+		const entry = yield fx.state.read((s) => s.queries.get(hash));
+		if (!entry || entry.lifecycle.phase !== "live" || entry.serverState === "materializing" || entry.viewLostRetryAt !== null) continue;
+		if (entry.def.plan ? entry.def.plan.limit != null : /\bLIMIT\b/i.test(entry.def.surql)) continue;
+		const next = withDeltas(entry.remoteArray, list);
+		if (next !== entry.remoteArray) yield* applyMembership(hash, next);
+		settled.add(hash);
+	}
+	return settled;
+}
+/**
 * Read the server membership of many queries in as few round trips as the
-* row budget allows, then apply each changed set. This is the ONLY place a
-* server id-set enters state: registration, the poll, LIVE dirt and view-lost
+* row budget allows, then apply each changed set. Every server id-set enters
+* state here, except the rows LIVE reports joining (see
+* {@link applyEdgeDeltas}): registration, the poll, LIVE dirt and view-lost
 * recovery all come through here.
 */
 function* readMembership(env, hashes, opts = {}) {
@@ -4919,9 +4987,10 @@ function* readMembership(env, hashes, opts = {}) {
 	for (const [hash, snap] of snapshots) {
 		const current = yield fx.state.read((s) => s.queries.get(hash));
 		if (!current) continue;
+		const primary = rebaseRead(snap.primary, byHash.get(hash).remoteArray, current.remoteArray);
 		const metaChanged = current.serverState !== (snap.meta.present ? snap.meta.state : null);
-		if (!recordVersionArraysEqual(snap.primary, current.remoteArray) || metaChanged || current.lifecycle.phase === "cold" || current.lifecycle.phase === "cached") {
-			const outcome = yield* applyMembership(hash, snap.primary, snap.meta);
+		if (!recordVersionArraysEqual(primary, current.remoteArray) || metaChanged || current.lifecycle.phase === "cold" || current.lifecycle.phase === "cached") {
+			const outcome = yield* applyMembership(hash, primary, snap.meta);
 			if (outcome === "applied") changed = true;
 			if (outcome === "ignored" && snap.meta.present && snap.meta.state === "materializing") stillMaterializing.push(hash);
 		}
@@ -6158,10 +6227,11 @@ function createInterpreter(adapters, host) {
 				const pending = adapters.remote.queryResponses(effect.sql, effect.vars);
 				return effect.timeoutMs ? withTimeout(pending, effect.timeoutMs, () => /* @__PURE__ */ new Error(`Remote request timed out after ${effect.timeoutMs}ms`)) : pending;
 			}
-			case "remote.live": return adapters.remote.live(effect.table, (hashes, rows) => host.dispatch({
+			case "remote.live": return adapters.remote.live(effect.table, (hashes, rows, deltas) => host.dispatch({
 				type: "LiveChange",
 				hashes,
-				rows
+				rows,
+				deltas
 			}));
 			case "remote.kill": return adapters.remote.kill(effect.uuid);
 			case "ssp.register": {
@@ -6711,9 +6781,10 @@ function* pollTick(env) {
 //#endregion
 //#region src/sync/live.saga.ts
 /**
-* LIVE on the session's `_00_list_ref` table. An event marks its query's
-* membership dirty and the batched re-read decides; followers get the same
-* dirt relayed by the leader.
+* LIVE on the session's `_00_list_ref` table. A row joining a live view is
+* committed straight from its edge; any other event marks its query's
+* membership dirty and the batched re-read decides. Followers get the dirt
+* relayed by the leader.
 *
 * When the subscription was opened with the body joined on
 * (`liveInlineBodies`) the event ALSO carries the changed row. That is an
@@ -6765,8 +6836,12 @@ function* liveInvalidate() {
 		liveTable: null
 	}));
 }
-/** One or more edges of these queries changed on the server. */
-function* liveChange(env, hashes, rows) {
+/**
+* One or more edges of these queries changed on the server. A row joining a
+* live view (`deltas`) is committed at once; anything else marks the query
+* dirty for the batched re-read.
+*/
+function* liveChange(env, hashes, rows, deltas) {
 	const [known, role, streak] = yield fx.state.read((s) => [
 		hashes.filter((h) => s.queries.has(h)),
 		s.tabRole,
@@ -6778,7 +6853,9 @@ function* liveChange(env, hashes, rows) {
 		yield fx.timer.set("poll", env.pollBaseMs, { type: "PollTick" });
 	}
 	if (rows && rows.length > 0) yield* landInlineRows(env, rows);
-	yield* markMembershipDirty(known);
+	const settled = deltas && deltas.length > 0 ? yield* applyEdgeDeltas(deltas.filter((d) => known.includes(d.hash))) : /* @__PURE__ */ new Set();
+	const dirty = known.filter((h) => !settled.has(h));
+	if (dirty.length > 0) yield* markMembershipDirty(dirty);
 	if (role === "leader") yield fx.emit({
 		type: "tabs:broadcast",
 		message: {
@@ -7326,7 +7403,7 @@ function route(env, event) {
 			lane: serial("live")
 		};
 		case "LiveChange": return {
-			saga: liveChange(env, event.hashes, event.rows),
+			saga: liveChange(env, event.hashes, event.rows, event.deltas),
 			lane: serial("live-change")
 		};
 		case "TabRole": return {
@@ -11834,6 +11911,12 @@ var ImpersonationTimers = class {
 //#region src/modules/auth/index.ts
 /** Upper bound on the before-sign-out hooks, so a dead socket never holds a sign-out. */
 const SIGN_OUT_HOOK_TIMEOUT_MS = 2e3;
+/**
+* Floor between two session re-checks started by refused statements. A
+* refused session fails every statement at once, and a check that keeps the
+* session (the server was unreachable) must not be re-run by each of them.
+*/
+const REFUSAL_RECHECK_MIN_MS = 3e4;
 function decodeAccessFromToken(token) {
 	return decodeTokenClaims(token).access;
 }
@@ -11863,6 +11946,11 @@ var AuthService = class {
 	stopping = null;
 	/** A token renewal in flight, which a stop waits out (see `renewImpersonation`). */
 	renewing = null;
+	/** The session re-check in flight (see `watchSession`), shared by every trigger. */
+	reverifying = null;
+	/** When a refused statement last started a re-check. */
+	lastRefusalCheckAt = Number.NEGATIVE_INFINITY;
+	watchingSession = false;
 	impersonationTimers = new ImpersonationTimers({
 		current: () => this.impersonation,
 		renew: () => this.renewImpersonation(),
@@ -11890,6 +11978,54 @@ var AuthService = class {
 	}
 	async init() {
 		await this.check();
+		this.watchSession();
+	}
+	/**
+	* Check the session again whenever the socket comes back, and whenever the
+	* server refuses a statement because of the session.
+	*
+	* The server judges a token only when a socket authenticates: the SDK
+	* replays `authenticate` on its own reconnects, `RemoteDatabaseService` on a
+	* socket it rebuilds. When the replay is refused (the app ended the session,
+	* say with a password reset) the SDK drops to an anonymous session, and the
+	* supervisor swallows the rebuild's error, so the socket reports `connected`
+	* while this service still announces the user. Every view registered from
+	* then on carried no identity: the page looked signed in and showed nothing
+	* of the user's. `check()` applies the token again and signs out when the
+	* server refuses it.
+	*
+	* A socket that never reconnects is ended by the app's session guard
+	* (`fn::sp00ky::session_live`) instead: its heartbeats stop finding rows,
+	* and the re-registration that follows is refused with "There was a problem
+	* with authentication", which starts a check here too.
+	*/
+	watchSession() {
+		if (this.watchingSession) return;
+		this.watchingSession = true;
+		this.remote.subscribeConnection("connected", () => this.reverify());
+		this.remote.getEvents().subscribe(DatabaseEventTypes.RemoteQuery, (event) => {
+			const { success, error } = event.payload;
+			if (success || !isRefusedSessionError(error ?? "")) return;
+			const now = Date.now();
+			if (now - this.lastRefusalCheckAt < REFUSAL_RECHECK_MIN_MS) return;
+			this.lastRefusalCheckAt = now;
+			this.reverify();
+		});
+	}
+	/** One `check()` for every trigger that lands while it runs. */
+	reverify() {
+		if (!this.isAuthenticated || this.reverifying) return;
+		this.reverifying = (async () => {
+			await this.remote.whenConnected();
+			if (this.isAuthenticated) await this.check();
+		})().catch((error) => {
+			this.logger.warn({
+				error,
+				Category: "sp00ky-client::AuthService::reverify"
+			}, "Session re-check failed");
+		}).finally(() => {
+			this.reverifying = null;
+		});
 	}
 	getAccessDefinition(name) {
 		return this.schema.access?.[name];
@@ -12625,8 +12761,6 @@ function loadLoro() {
 const LOCAL_TABLE = "_00_crdt_local";
 const LOG_SUFFIX = "__crdt_log";
 const PRESENCE_SUFFIX = "__crdt_presence";
-/** Longest a burst of typing waits before its edits go out. */
-const MAX_WAIT_MS = 2e3;
 const PERSIST_DEBOUNCE_MS = 400;
 const PRESENCE_THROTTLE_MS = 250;
 const CLAIM_RETRY_MS = 5e3;
@@ -12648,11 +12782,12 @@ var CrdtManager = class {
 	claim = null;
 	claimRetry = null;
 	connectionUnsubscribes = [];
-	constructor(schema, local, remote, logger, debounceMs = 300) {
+	constructor(schema, local, remote, logger, debounceMs = 50, sendIntervalMs = 200) {
 		this.schema = schema;
 		this.local = local;
 		this.remote = remote;
 		this.debounceMs = debounceMs;
+		this.sendIntervalMs = sendIntervalMs;
 		this.logger = logger.child({ service: "CrdtManager" });
 		this.connectionUnsubscribes.push(this.remote.subscribeConnection("connected", () => {
 			for (const s of this.sessions.values()) {
@@ -12773,9 +12908,11 @@ var CrdtManager = class {
 			verifyTimer: null,
 			disposers: [],
 			flushTimer: null,
-			firstDirtyAt: 0,
+			flushDueAt: 0,
+			lastSentAt: 0,
 			persistTimer: null,
 			flushing: null,
+			flushQueued: null,
 			refetching: false,
 			presenceTimer: null,
 			presencePending: null,
@@ -12788,31 +12925,31 @@ var CrdtManager = class {
 		if (local.snapshot || fresh) session.handle.markLoaded();
 		this.sessions.set(key, session);
 		this.ensureClaimed();
-		if (!local.snapshot && !fresh) await this.serverWait(this.refetchCanonical(session));
+		const canonical = !local.snapshot && !fresh ? this.refetchCanonical(session) : null;
 		session.disposers.push(doc.subscribeLocalUpdates(() => {
 			session.local.peers[this.peer] ??= { enqueued: 0 };
 			this.scheduleFlush(session);
 			this.schedulePersist(session);
 		}));
 		const ports = this.ports;
-		const log = await ports.watch(`${table}${LOG_SUFFIX}`, {
+		const logWatch = ports.watch(`${table}${LOG_SUFFIX}`, {
 			doc: recordId,
 			field
 		}, (rows) => {
 			session.ingesting = session.ingesting.then(() => this.ingest(session, rows));
 		});
+		const presenceWatch = cursor ? ports.watch(`${table}${PRESENCE_SUFFIX}`, {
+			doc: recordId,
+			field
+		}, (rows) => this.ingestPresence(session, rows)) : null;
+		const [log, presence] = await Promise.all([logWatch, presenceWatch]);
 		session.disposers.push(log.stop);
+		if (presence) session.disposers.push(presence.stop);
 		log.settled.then(() => {
 			session.logSettled = true;
 			session.ingesting.then(() => this.checkLoaded(session));
 		});
-		if (cursor) {
-			const presence = await ports.watch(`${table}${PRESENCE_SUFFIX}`, {
-				doc: recordId,
-				field
-			}, (rows) => this.ingestPresence(session, rows));
-			session.disposers.push(presence.stop);
-		}
+		if (canonical) await this.serverWait(canonical);
 		if (!session.handle.hasContent() && !fresh) await this.serverWait(log.settled);
 		await session.ingesting;
 		this.scheduleFlush(session, 0);
@@ -12988,18 +13125,36 @@ var CrdtManager = class {
 			fork?.free();
 		}
 	}
-	scheduleFlush(s, delay = this.debounceMs) {
+	/**
+	* Arm the send. Edits go out on a steady cadence while they keep coming:
+	* the first one after a quiet spell waits `debounceMs` (one row for the
+	* burst), later ones at least `sendIntervalMs` after the previous send. An
+	* armed timer is never pushed back, so continuous typing cannot hold the
+	* edits; it is only brought forward (`delay`, e.g. 0 on reconnect).
+	*/
+	scheduleFlush(s, delay) {
 		const now = Date.now();
-		if (!s.flushTimer) s.firstDirtyAt = now;
-		else clearTimeout(s.flushTimer);
-		const wait = Math.max(0, Math.min(delay, s.firstDirtyAt + MAX_WAIT_MS - now));
+		const due = delay !== void 0 ? now + delay : Math.max(now + this.debounceMs, s.lastSentAt + this.sendIntervalMs);
+		if (s.flushTimer) {
+			if (s.flushDueAt <= due) return;
+			clearTimeout(s.flushTimer);
+		}
+		s.flushDueAt = due;
 		s.flushTimer = setTimeout(() => {
 			s.flushTimer = null;
 			this.flush(s);
-		}, wait);
-	}
-	async flush(s) {
-		if (s.flushing) return s.flushing;
+		}, due - now);
+	}
+	/** Send what is unsent. A call while a send runs queues one more after it,
+	*  so edits made during that send are not left waiting for the next edit. */
+	flush(s) {
+		if (s.flushing) {
+			s.flushQueued ??= s.flushing.then(() => {
+				s.flushQueued = null;
+				return this.flush(s);
+			});
+			return s.flushQueued;
+		}
 		s.flushing = this.sendOwnEdits(s).finally(() => {
 			s.flushing = null;
 		});
@@ -13017,6 +13172,7 @@ var CrdtManager = class {
 			from: s.local.peers[peer]?.enqueued ?? 0
 		})).filter((p) => p.end > p.from);
 		if (due.length === 0 || !this.ports) return;
+		s.lastSentAt = Date.now();
 		if (!await this.ensureClaimed()) {
 			this.retryLater(s);
 			return;
@@ -13051,7 +13207,8 @@ var CrdtManager = class {
 			}
 			s.local.peers[peer] = { enqueued: end };
 		}
-		await this.persist(s);
+		if (this.sessions.get(s.key) === s) this.schedulePersist(s);
+		else await this.persist(s);
 	}
 	retryLater(s) {
 		if (this.sessions.get(s.key) === s) this.scheduleFlush(s, CLAIM_RETRY_MS);
@@ -15084,6 +15241,27 @@ function rowOfEdge(value) {
 		record: out
 	};
 }
+/**
+* The membership change a `CREATE` or `UPDATE` notification reports: the
+* edge's target joined the view (or its version moved). Null for anything a
+* re-read must settle instead: a `DELETE` (a row leaving, or every edge of a
+* view being rewritten), a subquery child (`parent` set), or an edge missing
+* its target or version. With `FETCH out` the target is the joined row, whose
+* `id` is the record id.
+*/
+function deltaOfEdge(action, value) {
+	if (action !== "CREATE" && action !== "UPDATE") return null;
+	const hash = hashOfEdge(value);
+	const edge = value;
+	if (!hash || edge.parent != null || typeof edge.version !== "number") return null;
+	const out = edge.out instanceof RecordId$1 ? edge.out : edge.out?.id;
+	if (!(out instanceof RecordId$1)) return null;
+	return {
+		hash,
+		id: encodeRecordId(out),
+		version: edge.version
+	};
+}
 
 //#endregion
 //#region src/utils/blurhash.ts
@@ -15541,7 +15719,7 @@ function createServices(config) {
 	streamProcessor.configureCircuitPersistence(config.persistCircuit ?? config.localEngine === "sqlite", config.circuitCheckpointMs);
 	streamProcessor.configureProjection(config.circuitProjection ?? true);
 	const migrator = new LocalMigrator(local, logger);
-	const crdt = new CrdtManager(config.schema, local, remote, logger, config.crdtDebounceMs ?? 300);
+	const crdt = new CrdtManager(config.schema, local, remote, logger, config.crdtDebounceMs ?? 50, config.crdtSendIntervalMs ?? 200);
 	const auth = new AuthService(config.schema, remote, persistence, logger);
 	const tabId = typeof crypto !== "undefined" && crypto.randomUUID ? crypto.randomUUID() : `tab_${Math.random().toString(36).slice(2)}`;
 	return {
@@ -15567,7 +15745,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.331",
+			coreVersion: "0.0.1-canary.333",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,
@@ -15787,7 +15965,8 @@ function createAdapters(config, s, host, lateModules) {
 					const hash = hashOfEdge(message.value);
 					if (!hash) return;
 					const row = message.action === "DELETE" ? null : rowOfEdge(message.value);
-					onChange([hash], row ? [row] : void 0);
+					const delta = deltaOfEdge(message.action, message.value);
+					onChange([hash], row ? [row] : void 0, delta ? [delta] : void 0);
 				});
 				return String(uuid);
 			},
@@ -16686,4 +16865,4 @@ var Sp00kyClient = class {
 };
 
 //#endregion
-export { AppReleaseHandle, AppReleaseModule, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, BucketHandle, CURSOR_COLORS, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, FeatureFlagHandle, FeatureFlagModule, IMPERSONATION_ACCESS, ImpersonationTimers, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, ORIGIN_TOKEN_KEY, PUSH_ENDPOINT_KEY, PUSH_PAYLOAD_VERSION, SESSION_POLL_MS, SIGN_OUT_HOOK_TIMEOUT_MS, Sp00kyClient, WebPushError, WebPushModule, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, detectWebPushSupport, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, isPushPayload, renewDelayMs, sameImpersonation, semverGt, textToHtml };
+export { AppReleaseHandle, AppReleaseModule, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, BucketHandle, CURSOR_COLORS, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, FeatureFlagHandle, FeatureFlagModule, IMPERSONATION_ACCESS, ImpersonationTimers, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, ORIGIN_TOKEN_KEY, PUSH_ENDPOINT_KEY, PUSH_PAYLOAD_VERSION, REFUSAL_RECHECK_MIN_MS, SESSION_POLL_MS, SIGN_OUT_HOOK_TIMEOUT_MS, Sp00kyClient, WebPushError, WebPushModule, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, detectWebPushSupport, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, isPushPayload, renewDelayMs, sameImpersonation, semverGt, textToHtml };

package/dist/otel/index.d.ts

@@ -1,4 +1,4 @@
-import { p as PinoTransmit } from "../types.js";
+import { m as PinoTransmit } from "../types.js";
 import { Level } from "pino";
 
 //#region src/otel/index.d.ts

package/dist/pure.d.ts

@@ -139,6 +139,13 @@ interface InlineRow {
   version: number;
   record: Record<string, unknown>;
 }
+/**
+ * A row that joined a query's view, or moved to a newer version, as one LIVE
+ * notification on `_00_list_ref` reports it: the edge's `out` and `version`.
+ * The client commits it to the query's membership straight away instead of
+ * re-reading the edges (see `sync/live.saga.ts`).
+ */
+
 type RecordVersionArray = Array<[string, number]>;
 /**
  * Represents the difference between two record version sets.
@@ -329,6 +336,15 @@ declare function hashOfEdge(value: unknown): string | null;
  * `out: null`) and for an edge whose target has been deleted.
  */
 declare function rowOfEdge(value: unknown): InlineRow | null;
+/**
+ * The membership change a `CREATE` or `UPDATE` notification reports: the
+ * edge's target joined the view (or its version moved). Null for anything a
+ * re-read must settle instead: a `DELETE` (a row leaving, or every edge of a
+ * view being rewritten), a subquery child (`parent` set), or an edge missing
+ * its target or version. With `FETCH out` the target is the joined row, whose
+ * `id` is the record id.
+ */
+
 //#endregion
 //#region src/utils/parser.d.ts
 /**