@spooky-sync/core 0.0.1-canary.331 → 0.0.1-canary.333

package/dist/types.d.ts

@@ -822,6 +822,12 @@ interface SignOutContext {
 type SignOutHook = (ctx: SignOutContext) => Promise<void> | void;
 /** Upper bound on the before-sign-out hooks, so a dead socket never holds a sign-out. */
 declare const SIGN_OUT_HOOK_TIMEOUT_MS = 2000;
+/**
+ * Floor between two session re-checks started by refused statements. A
+ * refused session fails every statement at once, and a check that keeps the
+ * session (the server was unreachable) must not be re-run by each of them.
+ */
+declare const REFUSAL_RECHECK_MIN_MS = 30000;
 type Prettify<T> = { [K in keyof T]: T[K] } & {};
 type MapColumnType<T extends ColumnSchema> = T['optional'] extends true ? TypeNameToTypeMap[T['type']] | undefined : TypeNameToTypeMap[T['type']];
 type ExtractAccessParams<S extends SchemaStructure, Name extends keyof S['access'], Method extends 'signIn' | 'signup'> = S['access'] extends undefined ? never : S['access'][Name] extends AccessDefinition ? Prettify<{ [K in keyof S['access'][Name][Method]['params']]: MapColumnType<S['access'][Name][Method]['params'][K]> }> : never;
@@ -855,10 +861,37 @@ declare class AuthService<S extends SchemaStructure> {
   private stopping;
   /** A token renewal in flight, which a stop waits out (see `renewImpersonation`). */
   private renewing;
+  /** The session re-check in flight (see `watchSession`), shared by every trigger. */
+  private reverifying;
+  /** When a refused statement last started a re-check. */
+  private lastRefusalCheckAt;
+  private watchingSession;
   private impersonationTimers;
   get eventSystem(): AuthEventSystem;
   constructor(schema: S, remote: RemoteDatabaseService, persistenceClient: PersistenceClient, logger: Logger$1);
   init(): Promise<void>;
+  /**
+   * Check the session again whenever the socket comes back, and whenever the
+   * server refuses a statement because of the session.
+   *
+   * The server judges a token only when a socket authenticates: the SDK
+   * replays `authenticate` on its own reconnects, `RemoteDatabaseService` on a
+   * socket it rebuilds. When the replay is refused (the app ended the session,
+   * say with a password reset) the SDK drops to an anonymous session, and the
+   * supervisor swallows the rebuild's error, so the socket reports `connected`
+   * while this service still announces the user. Every view registered from
+   * then on carried no identity: the page looked signed in and showed nothing
+   * of the user's. `check()` applies the token again and signs out when the
+   * server refuses it.
+   *
+   * A socket that never reconnects is ended by the app's session guard
+   * (`fn::sp00ky::session_live`) instead: its heartbeats stop finding rows,
+   * and the re-registration that follows is refused with "There was a problem
+   * with authentication", which starts a check here too.
+   */
+  private watchSession;
+  /** One `check()` for every trigger that lands while it runs. */
+  private reverify;
   getAccessDefinition<Name extends keyof S['access']>(name: Name): AccessDefinition | undefined;
   /**
    * Subscribe to auth state changes.
@@ -1594,14 +1627,20 @@ interface Sp00kyConfig<S extends SchemaStructure> {
    */
   streamDebounceTime?: number;
   /**
-   * Debounce time in milliseconds for syncing collaborative (CRDT) field
-   * edits to the server. Local state is kept on every change (so reload and
-   * offline work), but a field's own new ops go out as one edit-log row per
-   * pause of this length (at most 2 s apart while typing continues).
-   * Lower = snappier propagation and more rows; higher = fewer rows and more
-   * lag for other collaborators. Defaults to 300ms.
+   * How long in milliseconds the first edit to a collaborative (CRDT) field
+   * after a quiet spell waits before it goes out, so a burst of keystrokes
+   * travels as one edit-log row. Local state is kept on every change (so
+   * reload and offline work). Defaults to 50ms.
    */
   crdtDebounceMs?: number;
+  /**
+   * The shortest gap in milliseconds between two edit-log rows of one CRDT
+   * field: while someone keeps typing, their edits go out on this cadence
+   * instead of waiting for a pause. Lower = other collaborators see the text
+   * sooner and more rows are written; higher = fewer rows and more lag.
+   * Defaults to 200ms.
+   */
+  crdtSendIntervalMs?: number;
   /**
    * Enable collaborative CRDT fields. When `true`, the `loro-crdt` engine is
    * preloaded at client startup (fetched as a separate chunk on page load) so
@@ -1635,15 +1674,16 @@ interface Sp00kyConfig<S extends SchemaStructure> {
    * back for it.
    *
    * The client holds exactly one live subscription, on its `_00_list_ref`
-   * table, and today it is a doorbell: the notification is reduced to the
-   * query hash and the row is then pulled with `SELECT * FROM $ids`. The edge
+   * table. Without this, the notification names the row and the client then
+   * pulls it with `SELECT * FROM $ids`. The edge
    * is a real graph edge, so `FETCH out` makes SurrealDB resolve the row into
    * the notification and the body fetch disappears.
    *
    * The push stays advisory: the body is landed exactly the way a fetched body
    * is (store write, circuit ingest, version recorded), so a notification the
-   * server drops costs nothing but the old round trip. Membership is still
-   * read back; only the body fetch is saved.
+   * server drops costs nothing but the old round trip. A row joining a live
+   * view is committed to membership from the notification either way (no
+   * re-read); with this on, the body fetch is saved as well.
    *
    * Default `false`. The cost is wire bytes: one edit bumps the edge in every
    * view holding the row, and under `FETCH` each of those notifications
@@ -1873,6 +1913,17 @@ interface InlineRow {
   version: number;
   record: Record<string, unknown>;
 }
+/**
+ * A row that joined a query's view, or moved to a newer version, as one LIVE
+ * notification on `_00_list_ref` reports it: the edge's `out` and `version`.
+ * The client commits it to the query's membership straight away instead of
+ * re-reading the edges (see `sync/live.saga.ts`).
+ */
+interface EdgeDelta {
+  hash: QueryHash;
+  id: string;
+  version: number;
+}
 type RecordVersionArray = Array<[string, number]>;
 /**
  * Represents the difference between two record version sets.
@@ -2175,4 +2226,4 @@ interface DebounceOptions {
   flushOnHide?: boolean;
 }
 //#endregion
-export { WebPushSubscribeOptions as $, RunOptions as A, Logger$1 as At, SyncHealthStatus as B, SESSION_POLL_MS as Bt, QueryTimeToLive as C, SignOutHook as Ct, RecordVersionArray as D, createAuthEventSystem as Dt, ReconnectConfig as E, AuthEventTypes as Et, StorageHealth as F, IMPERSONATION_ACCESS as Ft, WebPushConfig as G, sameImpersonation as Gt, UpdateOptions as H, decodeTokenClaims as Ht, StorageHealthStatus as I, ImpersonationInfo as It, WebPushErrorCode as J, WebPushDevice as K, StoreType as L, ImpersonationTimerHost as Lt, Sp00kyConfig as M, SealedQuery as Mt, Sp00kyQueryResult as N, EventDefinition as Nt, RecordVersionDiff as O, RemoteDatabaseService as Ot, Sp00kyQueryResultPromise as P, EventSystem as Pt, WebPushModule as Q, SyncHealth as R, ImpersonationTimers as Rt, QueryStatusCallback as S, SignOutContext as St, QueryUpdateCallback as T, AuthEventTypeMap as Tt, PUSH_ENDPOINT_KEY as U, impersonationFromToken as Ut, TimingPhase as V, TokenClaims as Vt, PushDeviceKind as W, renewDelayMs as Wt, WebPushMessage as X, WebPushInfo as Y, WebPushMessageInput as Z, QueryConfig as _, isPushPayload as _t, Level$1 as a, WebPushUpdateOptions as at, QueryState as b, ImpersonationCandidate as bt, MutationCallback as c, BridgeTokenMessage as ct, PersistenceClient as d, PushNotificationAction as dt, WebPushSupport as et, PhaseStat as f, PushOp as ft, QueryAuthorityCallback as g, WebPushClientMessage as gt, PreloadRefresh as h, PushUrgency as ht, InlineRow as i, WebPushUnsupportedReason as it, ServerViewMeta as j, LocalStore as jt, RegistrationTimings as k, LogTap as kt, MutationEvent as l, PUSH_PAYLOAD_VERSION as lt, PreloadOptions as m, PushPayloadKind as mt, DebounceOptions as n, WebPushSyncStatus as nt, MATERIALIZATION_SAMPLE_WINDOW as o, detectWebPushSupport as ot, PinoTransmit as p, PushPayload as pt, WebPushError as q, EventSubscriptionOptions as r, WebPushUnsubscribeOptions as rt, MembershipOutcome as s, BridgeSignOutMessage as st, ConnectionState as t, WebPushSyncOptions as tt, MutationEventType as u, PushNotification as ut, QueryConfigRecord as v, ActiveImpersonation as vt, QueryTimings as w, AuthEventSystem as wt, QueryStatus as x, SIGN_OUT_HOOK_TIMEOUT_MS as xt, QueryHash as y, AuthService as yt, SyncHealthConfig as z, ORIGIN_TOKEN_KEY as zt };
+export { WebPushModule as $, RegistrationTimings as A, RemoteDatabaseService as At, SyncHealthConfig as B, ImpersonationTimers as Bt, QueryStatusCallback as C, SIGN_OUT_HOOK_TIMEOUT_MS as Ct, ReconnectConfig as D, AuthEventTypeMap as Dt, QueryUpdateCallback as E, AuthEventSystem as Et, Sp00kyQueryResultPromise as F, EventDefinition as Ft, PushDeviceKind as G, impersonationFromToken as Gt, TimingPhase as H, SESSION_POLL_MS as Ht, StorageHealth as I, EventSystem as It, WebPushError as J, WebPushConfig as K, renewDelayMs as Kt, StorageHealthStatus as L, IMPERSONATION_ACCESS as Lt, ServerViewMeta as M, Logger$1 as Mt, Sp00kyConfig as N, LocalStore as Nt, RecordVersionArray as O, AuthEventTypes as Ot, Sp00kyQueryResult as P, SealedQuery as Pt, WebPushMessageInput as Q, StoreType as R, ImpersonationInfo as Rt, QueryStatus as S, REFUSAL_RECHECK_MIN_MS as St, QueryTimings as T, SignOutHook as Tt, UpdateOptions as U, TokenClaims as Ut, SyncHealthStatus as V, ORIGIN_TOKEN_KEY as Vt, PUSH_ENDPOINT_KEY as W, decodeTokenClaims as Wt, WebPushInfo as X, WebPushErrorCode as Y, WebPushMessage as Z, QueryAuthorityCallback as _, WebPushClientMessage as _t, InlineRow as a, WebPushUnsupportedReason as at, QueryHash as b, AuthService as bt, MembershipOutcome as c, BridgeSignOutMessage as ct, MutationEventType as d, PushNotification as dt, WebPushSubscribeOptions as et, PersistenceClient as f, PushNotificationAction as ft, PreloadRefresh as g, PushUrgency as gt, PreloadOptions as h, PushPayloadKind as ht, EventSubscriptionOptions as i, WebPushUnsubscribeOptions as it, RunOptions as j, LogTap as jt, RecordVersionDiff as k, createAuthEventSystem as kt, MutationCallback as l, BridgeTokenMessage as lt, PinoTransmit as m, PushPayload as mt, DebounceOptions as n, WebPushSyncOptions as nt, Level$1 as o, WebPushUpdateOptions as ot, PhaseStat as p, PushOp as pt, WebPushDevice as q, sameImpersonation as qt, EdgeDelta as r, WebPushSyncStatus as rt, MATERIALIZATION_SAMPLE_WINDOW as s, detectWebPushSupport as st, ConnectionState as t, WebPushSupport as tt, MutationEvent as u, PUSH_PAYLOAD_VERSION as ut, QueryConfig as v, isPushPayload as vt, QueryTimeToLive as w, SignOutContext as wt, QueryState as x, ImpersonationCandidate as xt, QueryConfigRecord as y, ActiveImpersonation as yt, SyncHealth as z, ImpersonationTimerHost as zt };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.331",
+  "version": "0.0.1-canary.333",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -75,8 +75,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.331",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.331",
+    "@spooky-sync/query-builder": "0.0.1-canary.333",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.333",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.1.0",
     "@surrealdb/wasm-native": "^3.3.4",

package/src/client/router.ts

@@ -77,7 +77,7 @@ export function route(env: SagaEnv, event: RuntimeEvent): RouteTarget {
     case 'LiveStart':
       return { saga: liveStart(env), lane: serial('live') };
     case 'LiveChange':
-      return { saga: liveChange(env, event.hashes, event.rows), lane: serial('live-change') };
+      return { saga: liveChange(env, event.hashes, event.rows, event.deltas), lane: serial('live-change') };
     case 'TabRole':
       return { saga: setRole(env, event.role), lane: serial('tabs') };
     case 'TabMessage':

package/src/client/services.ts

@@ -30,7 +30,7 @@ import type { ServiceCalls } from '../kernel/effects';
 import { encodeRecordId, mintOwnerSecret } from '../utils/index';
 import { sha256Hex } from '../utils/sha256';
 import { leaveViewsBeacon, listRefLive } from '../query/sql';
-import { hashOfEdge, rowOfEdge } from '../utils/edges';
+import { deltaOfEdge, hashOfEdge, rowOfEdge } from '../utils/edges';
 import { mintMutationId } from '../mutation/mutation-id';
 import { BucketHandle, bucketContentToBlob, bucketSettings } from './bucket-handle';
 
@@ -176,7 +176,7 @@ export function createServices<S extends SchemaStructure>(config: Sp00kyConfig<S
   streamProcessor.configureCircuitPersistence(config.persistCircuit ?? config.localEngine === 'sqlite', config.circuitCheckpointMs);
   streamProcessor.configureProjection(config.circuitProjection ?? true);
   const migrator = new LocalMigrator(local, logger);
-  const crdt = new CrdtManager(config.schema, local, remote, logger, config.crdtDebounceMs ?? 300);
+  const crdt = new CrdtManager(config.schema, local, remote, logger, config.crdtDebounceMs ?? 50, config.crdtSendIntervalMs ?? 200);
   const auth = new AuthService(config.schema, remote, persistence, logger);
   const tabId = typeof crypto !== 'undefined' && crypto.randomUUID ? crypto.randomUUID() : `tab_${Math.random().toString(36).slice(2)}`;
   return {
@@ -395,7 +395,8 @@ export function createAdapters<S extends SchemaStructure>(config: Sp00kyConfig<S
           // that was actually deleted the join yields nothing anyway. Landing
           // a body there would only ever write back what is going away.
           const row = message.action === 'DELETE' ? null : rowOfEdge(message.value);
-          onChange([hash], row ? [row] : undefined);
+          const delta = deltaOfEdge(message.action, message.value);
+          onChange([hash], row ? [row] : undefined, delta ? [delta] : undefined);
         });
         return String(uuid);
       },

package/src/kernel/events.ts

@@ -1,4 +1,4 @@
-import type { ConnectionState, InlineRow, QueryHash, QueryStatus, SyncHealth } from '../types';
+import type { ConnectionState, EdgeDelta, InlineRow, QueryHash, QueryStatus, SyncHealth } from '../types';
 import type { StreamUpdate } from '../services/stream-processor/index';
 
 /**
@@ -36,7 +36,7 @@ export type RuntimeEvent =
   | { type: 'ConnectionChanged'; state: ConnectionState }
   | { type: 'StreamUpdate'; update: StreamUpdate }
   | { type: 'LiveStart' }
-  | { type: 'LiveChange'; hashes: QueryHash[]; rows?: InlineRow[] }
+  | { type: 'LiveChange'; hashes: QueryHash[]; rows?: InlineRow[]; deltas?: EdgeDelta[] }
   | { type: 'TabRole'; role: 'solo' | 'leader' | 'follower' }
   | { type: 'TabMessage'; message: unknown };
 

package/src/kernel/interpreter.ts

@@ -2,7 +2,7 @@ import { Duration } from 'surrealdb';
 import type { LocalStore } from '../services/database/cache-engine';
 import type { IngestRecord, StreamUpdate } from '../services/stream-processor/index';
 import type { ClientState } from '../state/client-state';
-import type { InlineRow } from '../types';
+import type { EdgeDelta, InlineRow } from '../types';
 import { withTimeout } from '../utils/index';
 import type { Effect, IdScope, RegisterResult, ServiceCalls, Settled, StatementResult } from './effects';
 import type { OutEvent, RuntimeEvent } from './events';
@@ -17,7 +17,7 @@ export interface Adapters {
      * changed query hashes, plus the changed rows themselves when the
      * subscription was opened with the body joined on (`liveInlineBodies`).
      */
-    live(table: string, onChange: (hashes: string[], rows?: InlineRow[]) => void): Promise<string>;
+    live(table: string, onChange: (hashes: string[], rows?: InlineRow[], deltas?: EdgeDelta[]) => void): Promise<string>;
     kill(uuid: string): Promise<void>;
   };
   ssp: {
@@ -81,7 +81,7 @@ export function createInterpreter(adapters: Adapters, host: InterpreterHost): In
           : pending;
       }
       case 'remote.live':
-        return adapters.remote.live(effect.table, (hashes, rows) => host.dispatch({ type: 'LiveChange', hashes, rows }));
+        return adapters.remote.live(effect.table, (hashes, rows, deltas) => host.dispatch({ type: 'LiveChange', hashes, rows, deltas }));
       case 'remote.kill':
         return adapters.remote.kill(effect.uuid);
       case 'ssp.register': {

package/src/modules/auth/auth.session-recheck.test.ts

@@ -0,0 +1,140 @@
+import { describe, it, expect, vi } from 'vitest';
+import { AuthService, REFUSAL_RECHECK_MIN_MS } from './index';
+import {
+  createDatabaseEventSystem,
+  DatabaseEventTypes,
+} from '../../services/database/events/index';
+
+// The session is re-checked after every reconnect and after a statement the
+// server refused because of the session: a token refused on a socket's own
+// handshake used to leave the page on an anonymous `connected` socket while
+// it kept announcing the user.
+
+function jwt(claims: Record<string, unknown>): string {
+  return `header.${Buffer.from(JSON.stringify(claims)).toString('base64url')}.signature`;
+}
+
+const silentLogger = () =>
+  ({ debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn(), child: () => silentLogger() }) as any;
+
+const REFUSED = 'There was a problem with authentication: this session has ended, sign in again';
+
+function makeAuth() {
+  const token = jwt({ AC: 'account', ID: 'user:abc' });
+  const store = new Map<string, unknown>([['sp00ky_auth_token', token]]);
+  const persistence = {
+    get: vi.fn(async (k: string) => store.get(k) ?? null),
+    set: vi.fn(async (k: string, v: unknown) => void store.set(k, v)),
+    remove: vi.fn(async (k: string) => void store.delete(k)),
+  } as any;
+  const connected = new Set<() => void>();
+  const events = createDatabaseEventSystem();
+  let refuse = false;
+  const authenticate = vi.fn(async () => {
+    if (refuse) throw new Error(REFUSED);
+  });
+  const remote = {
+    query: vi.fn(async () => [{ id: 'user:abc' }]),
+    setAuthToken: vi.fn(),
+    whenConnected: vi.fn(async () => undefined),
+    subscribeConnection: (_event: 'connected', cb: () => void) => {
+      connected.add(cb);
+      return () => connected.delete(cb);
+    },
+    getEvents: () => events,
+    getClient: () => ({ authenticate, invalidate: vi.fn(async () => undefined) }),
+  } as any;
+  const auth = new AuthService({} as any, remote, persistence, silentLogger());
+  const settle = () => new Promise((r) => setTimeout(r, 0));
+  return {
+    auth,
+    authenticate,
+    store,
+    refuseFromNowOn: () => void (refuse = true),
+    reconnect: async () => {
+      for (const cb of connected) cb();
+      await settle();
+    },
+    statementFails: async (error: string) => {
+      events.emit(DatabaseEventTypes.RemoteQuery, {
+        query: 'RETURN fn::query::register($config)',
+        duration: 1,
+        success: false,
+        error,
+        timestamp: Date.now(),
+      });
+      await settle();
+    },
+  };
+}
+
+describe('AuthService session re-check', () => {
+  it('signs out when a reconnected socket can no longer use the token', async () => {
+    const t = makeAuth();
+    await t.auth.init();
+    expect(t.auth.isAuthenticated).toBe(true);
+
+    t.refuseFromNowOn();
+    await t.reconnect();
+
+    expect(t.authenticate).toHaveBeenCalledTimes(2);
+    expect(t.auth.isAuthenticated).toBe(false);
+    expect(t.store.get('sp00ky_auth_token')).toBeUndefined();
+  });
+
+  it('keeps a session the server still accepts after a reconnect', async () => {
+    const t = makeAuth();
+    await t.auth.init();
+    await t.reconnect();
+
+    expect(t.authenticate).toHaveBeenCalledTimes(2);
+    expect(t.auth.isAuthenticated).toBe(true);
+  });
+
+  it('signs out when a statement on an open socket is refused for the session', async () => {
+    const t = makeAuth();
+    await t.auth.init();
+
+    t.refuseFromNowOn();
+    await t.statementFails(`An error occurred: ${REFUSED}`);
+
+    expect(t.auth.isAuthenticated).toBe(false);
+  });
+
+  it('ignores statement errors that are not about the session', async () => {
+    const t = makeAuth();
+    await t.auth.init();
+    await t.statementFails('Found 3 for field `n`, but expected a string');
+    await t.statementFails('There was a problem with the underlying connection');
+
+    expect(t.authenticate).toHaveBeenCalledTimes(1);
+  });
+
+  it('re-checks once per window however many statements are refused', async () => {
+    vi.useFakeTimers({ toFake: ['Date'] });
+    try {
+      const t = makeAuth();
+      await t.auth.init();
+      await t.statementFails(REFUSED);
+      await t.statementFails(REFUSED);
+      expect(t.authenticate).toHaveBeenCalledTimes(2);
+
+      vi.setSystemTime(Date.now() + REFUSAL_RECHECK_MIN_MS);
+      await t.statementFails(REFUSED);
+      expect(t.authenticate).toHaveBeenCalledTimes(3);
+      expect(t.auth.isAuthenticated).toBe(true);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('does nothing for a signed-out page', async () => {
+    const t = makeAuth();
+    t.store.clear();
+    await t.auth.init();
+    await t.reconnect();
+    await t.statementFails(REFUSED);
+
+    expect(t.authenticate).not.toHaveBeenCalled();
+  });
+});

package/src/modules/auth/index.ts

@@ -9,7 +9,8 @@ import type { Logger } from '../../services/logger/index';
 export * from './events/index';
 import { AuthEventTypes, createAuthEventSystem } from './events/index';
 import type { PersistenceClient } from '../../types';
-import { classifySyncError } from '../../utils/error-classification';
+import { classifySyncError, isRefusedSessionError } from '../../utils/error-classification';
+import { DatabaseEventTypes } from '../../services/database/events/index';
 import { encodeRecordId } from '../../utils/index';
 import { RecordId } from 'surrealdb';
 import {
@@ -53,6 +54,13 @@ export type SignOutHook = (ctx: SignOutContext) => Promise<void> | void;
 /** Upper bound on the before-sign-out hooks, so a dead socket never holds a sign-out. */
 export const SIGN_OUT_HOOK_TIMEOUT_MS = 2_000;
 
+/**
+ * Floor between two session re-checks started by refused statements. A
+ * refused session fails every statement at once, and a check that keeps the
+ * session (the server was unreachable) must not be re-run by each of them.
+ */
+export const REFUSAL_RECHECK_MIN_MS = 30_000;
+
 // Helper to pretty print types
 type Prettify<T> = {
   [K in keyof T]: T[K];
@@ -111,6 +119,11 @@ export class AuthService<S extends SchemaStructure> {
   private stopping: Promise<void> | null = null;
   /** A token renewal in flight, which a stop waits out (see `renewImpersonation`). */
   private renewing: Promise<void> | null = null;
+  /** The session re-check in flight (see `watchSession`), shared by every trigger. */
+  private reverifying: Promise<void> | null = null;
+  /** When a refused statement last started a re-check. */
+  private lastRefusalCheckAt = Number.NEGATIVE_INFINITY;
+  private watchingSession = false;
   private impersonationTimers = new ImpersonationTimers({
     current: () => this.impersonation,
     renew: () => this.renewImpersonation(),
@@ -141,6 +154,60 @@ export class AuthService<S extends SchemaStructure> {
 
   async init() {
     await this.check();
+    this.watchSession();
+  }
+
+  /**
+   * Check the session again whenever the socket comes back, and whenever the
+   * server refuses a statement because of the session.
+   *
+   * The server judges a token only when a socket authenticates: the SDK
+   * replays `authenticate` on its own reconnects, `RemoteDatabaseService` on a
+   * socket it rebuilds. When the replay is refused (the app ended the session,
+   * say with a password reset) the SDK drops to an anonymous session, and the
+   * supervisor swallows the rebuild's error, so the socket reports `connected`
+   * while this service still announces the user. Every view registered from
+   * then on carried no identity: the page looked signed in and showed nothing
+   * of the user's. `check()` applies the token again and signs out when the
+   * server refuses it.
+   *
+   * A socket that never reconnects is ended by the app's session guard
+   * (`fn::sp00ky::session_live`) instead: its heartbeats stop finding rows,
+   * and the re-registration that follows is refused with "There was a problem
+   * with authentication", which starts a check here too.
+   */
+  private watchSession(): void {
+    if (this.watchingSession) return;
+    this.watchingSession = true;
+    this.remote.subscribeConnection('connected', () => this.reverify());
+    this.remote.getEvents().subscribe(DatabaseEventTypes.RemoteQuery, (event) => {
+      const { success, error } = event.payload;
+      if (success || !isRefusedSessionError(error ?? '')) return;
+      const now = Date.now();
+      if (now - this.lastRefusalCheckAt < REFUSAL_RECHECK_MIN_MS) return;
+      this.lastRefusalCheckAt = now;
+      this.reverify();
+    });
+  }
+
+  /** One `check()` for every trigger that lands while it runs. */
+  private reverify(): void {
+    if (!this.isAuthenticated || this.reverifying) return;
+    this.reverifying = (async () => {
+      // A rebuilt socket reports `connected` before its namespace and token
+      // are applied: check against the finished handshake.
+      await this.remote.whenConnected();
+      if (this.isAuthenticated) await this.check();
+    })()
+      .catch((error) => {
+        this.logger.warn(
+          { error, Category: 'sp00ky-client::AuthService::reverify' },
+          'Session re-check failed'
+        );
+      })
+      .finally(() => {
+        this.reverifying = null;
+      });
   }
 
   getAccessDefinition<Name extends keyof S['access']>(name: Name): AccessDefinition | undefined {

package/src/modules/crdt/crdt.test.ts

@@ -36,6 +36,8 @@ class World {
     for (const go of this.held.splice(0)) go();
   }
   private watchers = new Set<{ table: string; where: Record<string, unknown>; cb: (rows: any[]) => void }>();
+  /** Every query a client registered, in order. */
+  watched: string[] = [];
 
   client(user: string, store = new Map<string, any>(), logger: any = silent) {
     const local = {
@@ -64,9 +66,10 @@ class World {
         return [[]];
       },
     } as any;
-    const manager = new CrdtManager(schema, local, remote, logger, 300);
+    const manager = new CrdtManager(schema, local, remote, logger);
     const ports: CrdtPorts = {
       watch: async (table, where, cb) => {
+        this.watched.push(table);
         const w = { table, where, cb };
         this.watchers.add(w);
         if (this.slow) {
@@ -158,17 +161,60 @@ describe('CRDT fields', () => {
     expect(text(fb)).toBe(text(fa));
   });
 
-  it('a burst of typing goes out after the pause, or after the max wait at the latest', async () => {
+  it('while typing continues, edits go out on a steady cadence instead of waiting for a pause', async () => {
     const world = new World();
     const a = world.client('user:a');
     const f = await a.manager.open('doc', 'doc:1', 'body');
-    for (let i = 0; i < 10; i++) {
+    // A key every 50 ms for a second: a trailing debounce would send nothing
+    // until the typing stopped. The first edit goes out after 50 ms, the rest
+    // every 200 ms.
+    for (let i = 0; i < 20; i++) {
       f.getDoc().getText('body').insert(i, 'x');
       f.getDoc().commit();
-      await vi.advanceTimersByTimeAsync(250);
+      await vi.advanceTimersByTimeAsync(50);
+      if (i === 0) expect(world.log).toHaveLength(1);
     }
-    expect(world.log.length).toBeGreaterThanOrEqual(1);
-    expect(world.log.length).toBeLessThan(10);
+    expect(world.log.length).toBeGreaterThanOrEqual(4);
+    expect(world.log.length).toBeLessThanOrEqual(6);
+    await vi.advanceTimersByTimeAsync(300);
+    const copy = new LoroDoc();
+    for (const row of world.log) copy.import(row.data);
+    expect(copy.getText('body').toString()).toBe('x'.repeat(20));
+  });
+
+  it('edits made while a send waits on the server go out right after it', async () => {
+    const world = new World();
+    const a = world.client('user:a');
+    const f = await a.manager.open('doc', 'doc:1', 'body');
+    world.slow = true;
+    // A fresh peer: the next send claims it first, and that claim hangs.
+    a.manager.setSessionId('');
+    f.getDoc().getText('body').insert(0, 'a');
+    f.getDoc().commit();
+    await vi.advanceTimersByTimeAsync(100);
+    f.getDoc().getText('body').insert(1, 'b');
+    f.getDoc().commit();
+    await vi.advanceTimersByTimeAsync(300);
+    world.slow = false;
+    world.release();
+    await vi.advanceTimersByTimeAsync(10);
+    const copy = new LoroDoc();
+    for (const row of world.log) copy.import(row.data);
+    expect(copy.getText('body').toString()).toBe('ab');
+  });
+
+  it('a first open reads the published document while its log query registers, not before', async () => {
+    const world = new World();
+    world.slow = true;
+    const a = world.client('user:a');
+    const opening = a.manager.open('doc', 'doc:1', 'body');
+    await vi.advanceTimersByTimeAsync(0);
+    // The published-document read is still out, and the log query is already registered.
+    expect(world.watched).toEqual(['doc__crdt_log']);
+    world.slow = false;
+    world.release();
+    await vi.advanceTimersByTimeAsync(10);
+    expect((await opening).isLoaded()).toBe(true);
   });
 
   it('send nothing until the peer is claimed, then everything at once', async () => {