@spooky-sync/core 0.0.1-canary.332 → 0.0.1-canary.333

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as WebPushModule, A as RegistrationTimings, At as LogTap, B as SyncHealthConfig, Bt as ORIGIN_TOKEN_KEY, C as QueryStatusCallback, Ct as SignOutContext, D as ReconnectConfig, Dt as AuthEventTypes, E as QueryUpdateCallback, Et as AuthEventTypeMap, F as Sp00kyQueryResultPromise, Ft as EventSystem, G as PushDeviceKind, Gt as renewDelayMs, H as TimingPhase, Ht as TokenClaims, I as StorageHealth, It as IMPERSONATION_ACCESS, J as WebPushError, K as WebPushConfig, Kt as sameImpersonation, L as StorageHealthStatus, Lt as ImpersonationInfo, M as ServerViewMeta, Mt as LocalStore, N as Sp00kyConfig, Nt as SealedQuery, O as RecordVersionArray, Ot as createAuthEventSystem, P as Sp00kyQueryResult, Pt as EventDefinition, Q as WebPushMessageInput, R as StoreType, Rt as ImpersonationTimerHost, S as QueryStatus, St as SIGN_OUT_HOOK_TIMEOUT_MS, T as QueryTimings, Tt as AuthEventSystem, U as UpdateOptions, Ut as decodeTokenClaims, V as SyncHealthStatus, Vt as SESSION_POLL_MS, W as PUSH_ENDPOINT_KEY, Wt as impersonationFromToken, X as WebPushInfo, Y as WebPushErrorCode, Z as WebPushMessage, _ as QueryAuthorityCallback, _t as WebPushClientMessage, a as InlineRow, at as WebPushUnsupportedReason, b as QueryHash, bt as AuthService, c as MembershipOutcome, ct as BridgeSignOutMessage, d as MutationEventType, dt as PushNotification, et as WebPushSubscribeOptions, f as PersistenceClient, ft as PushNotificationAction, g as PreloadRefresh, gt as PushUrgency, h as PreloadOptions, ht as PushPayloadKind, i as EventSubscriptionOptions, it as WebPushUnsubscribeOptions, j as RunOptions, jt as Logger$1, k as RecordVersionDiff, kt as RemoteDatabaseService, l as MutationCallback, lt as BridgeTokenMessage, m as PinoTransmit, mt as PushPayload, n as DebounceOptions, nt as WebPushSyncOptions, o as Level, ot as WebPushUpdateOptions, p as PhaseStat, pt as PushOp, q as WebPushDevice, r as EdgeDelta, rt as WebPushSyncStatus, s as MATERIALIZATION_SAMPLE_WINDOW, st as detectWebPushSupport, t as ConnectionState, tt as WebPushSupport, u as MutationEvent, ut as PUSH_PAYLOAD_VERSION, v as QueryConfig, vt as isPushPayload, w as QueryTimeToLive, wt as SignOutHook, x as QueryState, xt as ImpersonationCandidate, y as QueryConfigRecord, yt as ActiveImpersonation, z as SyncHealth, zt as ImpersonationTimers } from "./types.js";
+import { $ as WebPushModule, A as RegistrationTimings, At as RemoteDatabaseService, B as SyncHealthConfig, Bt as ImpersonationTimers, C as QueryStatusCallback, Ct as SIGN_OUT_HOOK_TIMEOUT_MS, D as ReconnectConfig, Dt as AuthEventTypeMap, E as QueryUpdateCallback, Et as AuthEventSystem, F as Sp00kyQueryResultPromise, Ft as EventDefinition, G as PushDeviceKind, Gt as impersonationFromToken, H as TimingPhase, Ht as SESSION_POLL_MS, I as StorageHealth, It as EventSystem, J as WebPushError, K as WebPushConfig, Kt as renewDelayMs, L as StorageHealthStatus, Lt as IMPERSONATION_ACCESS, M as ServerViewMeta, Mt as Logger$1, N as Sp00kyConfig, Nt as LocalStore, O as RecordVersionArray, Ot as AuthEventTypes, P as Sp00kyQueryResult, Pt as SealedQuery, Q as WebPushMessageInput, R as StoreType, Rt as ImpersonationInfo, S as QueryStatus, St as REFUSAL_RECHECK_MIN_MS, T as QueryTimings, Tt as SignOutHook, U as UpdateOptions, Ut as TokenClaims, V as SyncHealthStatus, Vt as ORIGIN_TOKEN_KEY, W as PUSH_ENDPOINT_KEY, Wt as decodeTokenClaims, X as WebPushInfo, Y as WebPushErrorCode, Z as WebPushMessage, _ as QueryAuthorityCallback, _t as WebPushClientMessage, a as InlineRow, at as WebPushUnsupportedReason, b as QueryHash, bt as AuthService, c as MembershipOutcome, ct as BridgeSignOutMessage, d as MutationEventType, dt as PushNotification, et as WebPushSubscribeOptions, f as PersistenceClient, ft as PushNotificationAction, g as PreloadRefresh, gt as PushUrgency, h as PreloadOptions, ht as PushPayloadKind, i as EventSubscriptionOptions, it as WebPushUnsubscribeOptions, j as RunOptions, jt as LogTap, k as RecordVersionDiff, kt as createAuthEventSystem, l as MutationCallback, lt as BridgeTokenMessage, m as PinoTransmit, mt as PushPayload, n as DebounceOptions, nt as WebPushSyncOptions, o as Level, ot as WebPushUpdateOptions, p as PhaseStat, pt as PushOp, q as WebPushDevice, qt as sameImpersonation, r as EdgeDelta, rt as WebPushSyncStatus, s as MATERIALIZATION_SAMPLE_WINDOW, st as detectWebPushSupport, t as ConnectionState, tt as WebPushSupport, u as MutationEvent, ut as PUSH_PAYLOAD_VERSION, v as QueryConfig, vt as isPushPayload, w as QueryTimeToLive, wt as SignOutContext, x as QueryState, xt as ImpersonationCandidate, y as QueryConfigRecord, yt as ActiveImpersonation, z as SyncHealth, zt as ImpersonationTimerHost } from "./types.js";
 import { BackendNames, BackendRoutes, BucketNames, FinalQuery, GetTable, QueryBuilder, QueryOptions, QueryPlan, RecordId, RoutePayload, SchemaStructure, TableModel, TableNames } from "@spooky-sync/query-builder";
 import * as surrealdb0 from "surrealdb";
 import { Duration, RecordId as RecordId$1, Surreal } from "surrealdb";
@@ -2212,4 +2212,4 @@ declare class LocalOpTimeoutError extends Error {
  *  select on a throttled tab is seconds, not tens of seconds. */
 declare const DEFAULT_LOCAL_OP_TIMEOUT_MS = 30000;
 //#endregion
-export { ActiveImpersonation, AppReleaseHandle, AppReleaseModule, type AppReleaseOptions, type AppReleaseSnapshot, AuthEventSystem, AuthEventTypeMap, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, type BlobCacheStats, type BlobEntry, type BlobKey, type BlobReadOptions, type BlobUrlLease, type BlurhashEncodeOptions, type BlurhashSetting, type BridgeSignOutMessage, type BridgeTokenMessage, BucketHandle, BucketPutOptions, BucketPutResult, CURSOR_COLORS, ConnectionState, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, DebounceOptions, EdgeDelta, EventSubscriptionOptions, type FailedMutationRow as FailedMutation, FeatureFlagHandle, FeatureFlagModule, type FeatureFlagOptions, type FeatureFlagOverride, type FeatureFlagSnapshot, IMPERSONATION_ACCESS, ImpersonationCandidate, ImpersonationInfo, ImpersonationTimerHost, ImpersonationTimers, InlineRow, Level, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, MembershipOutcome, MutationCallback, MutationEvent, MutationEventType, ORIGIN_TOKEN_KEY, PUSH_ENDPOINT_KEY, PUSH_PAYLOAD_VERSION, PersistenceClient, PhaseStat, PinoTransmit, PreloadOptions, PreloadRefresh, type PushDeviceKind, type PushNotification, type PushNotificationAction, type PushOp, type PushPayload, type PushPayloadKind, type PushUrgency, QueryAuthorityCallback, QueryConfig, QueryConfigRecord, QueryHash, QueryState, QueryStatus, QueryStatusCallback, QueryTimeToLive, QueryTimings, QueryUpdateCallback, ReconnectConfig, RecordVersionArray, RecordVersionDiff, RegistrationTimings, RunOptions, SESSION_POLL_MS, SIGN_OUT_HOOK_TIMEOUT_MS, ServerViewMeta, SignOutContext, SignOutHook, Sp00kyClient, Sp00kyClientDeps, Sp00kyConfig, Sp00kyQueryResult, Sp00kyQueryResultPromise, StorageHealth, StorageHealthStatus, StoreType, SyncHealth, SyncHealthConfig, SyncHealthStatus, TimingPhase, TokenClaims, UpdateOptions, type WebPushClientMessage, type WebPushConfig, type WebPushDevice, WebPushError, type WebPushErrorCode, type WebPushInfo, type WebPushMessage, type WebPushMessageInput, WebPushModule, type WebPushSubscribeOptions, type WebPushSupport, type WebPushSyncOptions, type WebPushSyncStatus, type WebPushUnsubscribeOptions, type WebPushUnsupportedReason, type WebPushUpdateOptions, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, detectWebPushSupport, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, isPushPayload, renewDelayMs, sameImpersonation, semverGt, textToHtml };
+export { ActiveImpersonation, AppReleaseHandle, AppReleaseModule, type AppReleaseOptions, type AppReleaseSnapshot, AuthEventSystem, AuthEventTypeMap, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, type BlobCacheStats, type BlobEntry, type BlobKey, type BlobReadOptions, type BlobUrlLease, type BlurhashEncodeOptions, type BlurhashSetting, type BridgeSignOutMessage, type BridgeTokenMessage, BucketHandle, BucketPutOptions, BucketPutResult, CURSOR_COLORS, ConnectionState, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, DebounceOptions, EdgeDelta, EventSubscriptionOptions, type FailedMutationRow as FailedMutation, FeatureFlagHandle, FeatureFlagModule, type FeatureFlagOptions, type FeatureFlagOverride, type FeatureFlagSnapshot, IMPERSONATION_ACCESS, ImpersonationCandidate, ImpersonationInfo, ImpersonationTimerHost, ImpersonationTimers, InlineRow, Level, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, MembershipOutcome, MutationCallback, MutationEvent, MutationEventType, ORIGIN_TOKEN_KEY, PUSH_ENDPOINT_KEY, PUSH_PAYLOAD_VERSION, PersistenceClient, PhaseStat, PinoTransmit, PreloadOptions, PreloadRefresh, type PushDeviceKind, type PushNotification, type PushNotificationAction, type PushOp, type PushPayload, type PushPayloadKind, type PushUrgency, QueryAuthorityCallback, QueryConfig, QueryConfigRecord, QueryHash, QueryState, QueryStatus, QueryStatusCallback, QueryTimeToLive, QueryTimings, QueryUpdateCallback, REFUSAL_RECHECK_MIN_MS, ReconnectConfig, RecordVersionArray, RecordVersionDiff, RegistrationTimings, RunOptions, SESSION_POLL_MS, SIGN_OUT_HOOK_TIMEOUT_MS, ServerViewMeta, SignOutContext, SignOutHook, Sp00kyClient, Sp00kyClientDeps, Sp00kyConfig, Sp00kyQueryResult, Sp00kyQueryResultPromise, StorageHealth, StorageHealthStatus, StoreType, SyncHealth, SyncHealthConfig, SyncHealthStatus, TimingPhase, TokenClaims, UpdateOptions, type WebPushClientMessage, type WebPushConfig, type WebPushDevice, WebPushError, type WebPushErrorCode, type WebPushInfo, type WebPushMessage, type WebPushMessageInput, WebPushModule, type WebPushSubscribeOptions, type WebPushSupport, type WebPushSyncOptions, type WebPushSyncStatus, type WebPushUnsubscribeOptions, type WebPushUnsupportedReason, type WebPushUpdateOptions, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, detectWebPushSupport, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, isPushPayload, renewDelayMs, sameImpersonation, semverGt, textToHtml };

package/dist/index.js

@@ -551,6 +551,16 @@ function classifySyncError(error) {
 	for (const pattern of NETWORK_ERROR_PATTERNS) if (message.includes(pattern)) return "network";
 	return "application";
 }
+/**
+* Whether the server refused the SESSION rather than the statement: its own
+* wording for a token it will not accept ("There was a problem with
+* authentication"), which is also what an app's AUTHENTICATE clause and
+* sp00ky's session guard throw, and a session past its `DURATION FOR SESSION`.
+*/
+function isRefusedSessionError(error) {
+	const message = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+	return message.includes("problem with authentication") || message.includes("session has expired");
+}
 
 //#endregion
 //#region src/utils/index.ts
@@ -2188,8 +2198,8 @@ function trimHistory(history, cap) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.332";
-const WASM_VERSION = "0.0.1-canary.332";
+const CORE_VERSION = "0.0.1-canary.333";
+const WASM_VERSION = "0.0.1-canary.333";
 const SURREAL_VERSION = "3.1.0";
 var DevToolsService = class DevToolsService {
 	version = CORE_VERSION;
@@ -11901,6 +11911,12 @@ var ImpersonationTimers = class {
 //#region src/modules/auth/index.ts
 /** Upper bound on the before-sign-out hooks, so a dead socket never holds a sign-out. */
 const SIGN_OUT_HOOK_TIMEOUT_MS = 2e3;
+/**
+* Floor between two session re-checks started by refused statements. A
+* refused session fails every statement at once, and a check that keeps the
+* session (the server was unreachable) must not be re-run by each of them.
+*/
+const REFUSAL_RECHECK_MIN_MS = 3e4;
 function decodeAccessFromToken(token) {
 	return decodeTokenClaims(token).access;
 }
@@ -11930,6 +11946,11 @@ var AuthService = class {
 	stopping = null;
 	/** A token renewal in flight, which a stop waits out (see `renewImpersonation`). */
 	renewing = null;
+	/** The session re-check in flight (see `watchSession`), shared by every trigger. */
+	reverifying = null;
+	/** When a refused statement last started a re-check. */
+	lastRefusalCheckAt = Number.NEGATIVE_INFINITY;
+	watchingSession = false;
 	impersonationTimers = new ImpersonationTimers({
 		current: () => this.impersonation,
 		renew: () => this.renewImpersonation(),
@@ -11957,6 +11978,54 @@ var AuthService = class {
 	}
 	async init() {
 		await this.check();
+		this.watchSession();
+	}
+	/**
+	* Check the session again whenever the socket comes back, and whenever the
+	* server refuses a statement because of the session.
+	*
+	* The server judges a token only when a socket authenticates: the SDK
+	* replays `authenticate` on its own reconnects, `RemoteDatabaseService` on a
+	* socket it rebuilds. When the replay is refused (the app ended the session,
+	* say with a password reset) the SDK drops to an anonymous session, and the
+	* supervisor swallows the rebuild's error, so the socket reports `connected`
+	* while this service still announces the user. Every view registered from
+	* then on carried no identity: the page looked signed in and showed nothing
+	* of the user's. `check()` applies the token again and signs out when the
+	* server refuses it.
+	*
+	* A socket that never reconnects is ended by the app's session guard
+	* (`fn::sp00ky::session_live`) instead: its heartbeats stop finding rows,
+	* and the re-registration that follows is refused with "There was a problem
+	* with authentication", which starts a check here too.
+	*/
+	watchSession() {
+		if (this.watchingSession) return;
+		this.watchingSession = true;
+		this.remote.subscribeConnection("connected", () => this.reverify());
+		this.remote.getEvents().subscribe(DatabaseEventTypes.RemoteQuery, (event) => {
+			const { success, error } = event.payload;
+			if (success || !isRefusedSessionError(error ?? "")) return;
+			const now = Date.now();
+			if (now - this.lastRefusalCheckAt < REFUSAL_RECHECK_MIN_MS) return;
+			this.lastRefusalCheckAt = now;
+			this.reverify();
+		});
+	}
+	/** One `check()` for every trigger that lands while it runs. */
+	reverify() {
+		if (!this.isAuthenticated || this.reverifying) return;
+		this.reverifying = (async () => {
+			await this.remote.whenConnected();
+			if (this.isAuthenticated) await this.check();
+		})().catch((error) => {
+			this.logger.warn({
+				error,
+				Category: "sp00ky-client::AuthService::reverify"
+			}, "Session re-check failed");
+		}).finally(() => {
+			this.reverifying = null;
+		});
 	}
 	getAccessDefinition(name) {
 		return this.schema.access?.[name];
@@ -15676,7 +15745,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.332",
+			coreVersion: "0.0.1-canary.333",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,
@@ -16796,4 +16865,4 @@ var Sp00kyClient = class {
 };
 
 //#endregion
-export { AppReleaseHandle, AppReleaseModule, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, BucketHandle, CURSOR_COLORS, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, FeatureFlagHandle, FeatureFlagModule, IMPERSONATION_ACCESS, ImpersonationTimers, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, ORIGIN_TOKEN_KEY, PUSH_ENDPOINT_KEY, PUSH_PAYLOAD_VERSION, SESSION_POLL_MS, SIGN_OUT_HOOK_TIMEOUT_MS, Sp00kyClient, WebPushError, WebPushModule, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, detectWebPushSupport, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, isPushPayload, renewDelayMs, sameImpersonation, semverGt, textToHtml };
+export { AppReleaseHandle, AppReleaseModule, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, BucketHandle, CURSOR_COLORS, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, FeatureFlagHandle, FeatureFlagModule, IMPERSONATION_ACCESS, ImpersonationTimers, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, ORIGIN_TOKEN_KEY, PUSH_ENDPOINT_KEY, PUSH_PAYLOAD_VERSION, REFUSAL_RECHECK_MIN_MS, SESSION_POLL_MS, SIGN_OUT_HOOK_TIMEOUT_MS, Sp00kyClient, WebPushError, WebPushModule, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, detectWebPushSupport, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, isPushPayload, renewDelayMs, sameImpersonation, semverGt, textToHtml };

package/dist/types.d.ts

@@ -822,6 +822,12 @@ interface SignOutContext {
 type SignOutHook = (ctx: SignOutContext) => Promise<void> | void;
 /** Upper bound on the before-sign-out hooks, so a dead socket never holds a sign-out. */
 declare const SIGN_OUT_HOOK_TIMEOUT_MS = 2000;
+/**
+ * Floor between two session re-checks started by refused statements. A
+ * refused session fails every statement at once, and a check that keeps the
+ * session (the server was unreachable) must not be re-run by each of them.
+ */
+declare const REFUSAL_RECHECK_MIN_MS = 30000;
 type Prettify<T> = { [K in keyof T]: T[K] } & {};
 type MapColumnType<T extends ColumnSchema> = T['optional'] extends true ? TypeNameToTypeMap[T['type']] | undefined : TypeNameToTypeMap[T['type']];
 type ExtractAccessParams<S extends SchemaStructure, Name extends keyof S['access'], Method extends 'signIn' | 'signup'> = S['access'] extends undefined ? never : S['access'][Name] extends AccessDefinition ? Prettify<{ [K in keyof S['access'][Name][Method]['params']]: MapColumnType<S['access'][Name][Method]['params'][K]> }> : never;
@@ -855,10 +861,37 @@ declare class AuthService<S extends SchemaStructure> {
   private stopping;
   /** A token renewal in flight, which a stop waits out (see `renewImpersonation`). */
   private renewing;
+  /** The session re-check in flight (see `watchSession`), shared by every trigger. */
+  private reverifying;
+  /** When a refused statement last started a re-check. */
+  private lastRefusalCheckAt;
+  private watchingSession;
   private impersonationTimers;
   get eventSystem(): AuthEventSystem;
   constructor(schema: S, remote: RemoteDatabaseService, persistenceClient: PersistenceClient, logger: Logger$1);
   init(): Promise<void>;
+  /**
+   * Check the session again whenever the socket comes back, and whenever the
+   * server refuses a statement because of the session.
+   *
+   * The server judges a token only when a socket authenticates: the SDK
+   * replays `authenticate` on its own reconnects, `RemoteDatabaseService` on a
+   * socket it rebuilds. When the replay is refused (the app ended the session,
+   * say with a password reset) the SDK drops to an anonymous session, and the
+   * supervisor swallows the rebuild's error, so the socket reports `connected`
+   * while this service still announces the user. Every view registered from
+   * then on carried no identity: the page looked signed in and showed nothing
+   * of the user's. `check()` applies the token again and signs out when the
+   * server refuses it.
+   *
+   * A socket that never reconnects is ended by the app's session guard
+   * (`fn::sp00ky::session_live`) instead: its heartbeats stop finding rows,
+   * and the re-registration that follows is refused with "There was a problem
+   * with authentication", which starts a check here too.
+   */
+  private watchSession;
+  /** One `check()` for every trigger that lands while it runs. */
+  private reverify;
   getAccessDefinition<Name extends keyof S['access']>(name: Name): AccessDefinition | undefined;
   /**
    * Subscribe to auth state changes.
@@ -2193,4 +2226,4 @@ interface DebounceOptions {
   flushOnHide?: boolean;
 }
 //#endregion
-export { WebPushModule as $, RegistrationTimings as A, LogTap as At, SyncHealthConfig as B, ORIGIN_TOKEN_KEY as Bt, QueryStatusCallback as C, SignOutContext as Ct, ReconnectConfig as D, AuthEventTypes as Dt, QueryUpdateCallback as E, AuthEventTypeMap as Et, Sp00kyQueryResultPromise as F, EventSystem as Ft, PushDeviceKind as G, renewDelayMs as Gt, TimingPhase as H, TokenClaims as Ht, StorageHealth as I, IMPERSONATION_ACCESS as It, WebPushError as J, WebPushConfig as K, sameImpersonation as Kt, StorageHealthStatus as L, ImpersonationInfo as Lt, ServerViewMeta as M, LocalStore as Mt, Sp00kyConfig as N, SealedQuery as Nt, RecordVersionArray as O, createAuthEventSystem as Ot, Sp00kyQueryResult as P, EventDefinition as Pt, WebPushMessageInput as Q, StoreType as R, ImpersonationTimerHost as Rt, QueryStatus as S, SIGN_OUT_HOOK_TIMEOUT_MS as St, QueryTimings as T, AuthEventSystem as Tt, UpdateOptions as U, decodeTokenClaims as Ut, SyncHealthStatus as V, SESSION_POLL_MS as Vt, PUSH_ENDPOINT_KEY as W, impersonationFromToken as Wt, WebPushInfo as X, WebPushErrorCode as Y, WebPushMessage as Z, QueryAuthorityCallback as _, WebPushClientMessage as _t, InlineRow as a, WebPushUnsupportedReason as at, QueryHash as b, AuthService as bt, MembershipOutcome as c, BridgeSignOutMessage as ct, MutationEventType as d, PushNotification as dt, WebPushSubscribeOptions as et, PersistenceClient as f, PushNotificationAction as ft, PreloadRefresh as g, PushUrgency as gt, PreloadOptions as h, PushPayloadKind as ht, EventSubscriptionOptions as i, WebPushUnsubscribeOptions as it, RunOptions as j, Logger$1 as jt, RecordVersionDiff as k, RemoteDatabaseService as kt, MutationCallback as l, BridgeTokenMessage as lt, PinoTransmit as m, PushPayload as mt, DebounceOptions as n, WebPushSyncOptions as nt, Level$1 as o, WebPushUpdateOptions as ot, PhaseStat as p, PushOp as pt, WebPushDevice as q, EdgeDelta as r, WebPushSyncStatus as rt, MATERIALIZATION_SAMPLE_WINDOW as s, detectWebPushSupport as st, ConnectionState as t, WebPushSupport as tt, MutationEvent as u, PUSH_PAYLOAD_VERSION as ut, QueryConfig as v, isPushPayload as vt, QueryTimeToLive as w, SignOutHook as wt, QueryState as x, ImpersonationCandidate as xt, QueryConfigRecord as y, ActiveImpersonation as yt, SyncHealth as z, ImpersonationTimers as zt };
+export { WebPushModule as $, RegistrationTimings as A, RemoteDatabaseService as At, SyncHealthConfig as B, ImpersonationTimers as Bt, QueryStatusCallback as C, SIGN_OUT_HOOK_TIMEOUT_MS as Ct, ReconnectConfig as D, AuthEventTypeMap as Dt, QueryUpdateCallback as E, AuthEventSystem as Et, Sp00kyQueryResultPromise as F, EventDefinition as Ft, PushDeviceKind as G, impersonationFromToken as Gt, TimingPhase as H, SESSION_POLL_MS as Ht, StorageHealth as I, EventSystem as It, WebPushError as J, WebPushConfig as K, renewDelayMs as Kt, StorageHealthStatus as L, IMPERSONATION_ACCESS as Lt, ServerViewMeta as M, Logger$1 as Mt, Sp00kyConfig as N, LocalStore as Nt, RecordVersionArray as O, AuthEventTypes as Ot, Sp00kyQueryResult as P, SealedQuery as Pt, WebPushMessageInput as Q, StoreType as R, ImpersonationInfo as Rt, QueryStatus as S, REFUSAL_RECHECK_MIN_MS as St, QueryTimings as T, SignOutHook as Tt, UpdateOptions as U, TokenClaims as Ut, SyncHealthStatus as V, ORIGIN_TOKEN_KEY as Vt, PUSH_ENDPOINT_KEY as W, decodeTokenClaims as Wt, WebPushInfo as X, WebPushErrorCode as Y, WebPushMessage as Z, QueryAuthorityCallback as _, WebPushClientMessage as _t, InlineRow as a, WebPushUnsupportedReason as at, QueryHash as b, AuthService as bt, MembershipOutcome as c, BridgeSignOutMessage as ct, MutationEventType as d, PushNotification as dt, WebPushSubscribeOptions as et, PersistenceClient as f, PushNotificationAction as ft, PreloadRefresh as g, PushUrgency as gt, PreloadOptions as h, PushPayloadKind as ht, EventSubscriptionOptions as i, WebPushUnsubscribeOptions as it, RunOptions as j, LogTap as jt, RecordVersionDiff as k, createAuthEventSystem as kt, MutationCallback as l, BridgeTokenMessage as lt, PinoTransmit as m, PushPayload as mt, DebounceOptions as n, WebPushSyncOptions as nt, Level$1 as o, WebPushUpdateOptions as ot, PhaseStat as p, PushOp as pt, WebPushDevice as q, sameImpersonation as qt, EdgeDelta as r, WebPushSyncStatus as rt, MATERIALIZATION_SAMPLE_WINDOW as s, detectWebPushSupport as st, ConnectionState as t, WebPushSupport as tt, MutationEvent as u, PUSH_PAYLOAD_VERSION as ut, QueryConfig as v, isPushPayload as vt, QueryTimeToLive as w, SignOutContext as wt, QueryState as x, ImpersonationCandidate as xt, QueryConfigRecord as y, ActiveImpersonation as yt, SyncHealth as z, ImpersonationTimerHost as zt };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.332",
+  "version": "0.0.1-canary.333",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -75,8 +75,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.332",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.332",
+    "@spooky-sync/query-builder": "0.0.1-canary.333",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.333",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.1.0",
     "@surrealdb/wasm-native": "^3.3.4",

package/src/modules/auth/auth.session-recheck.test.ts

@@ -0,0 +1,140 @@
+import { describe, it, expect, vi } from 'vitest';
+import { AuthService, REFUSAL_RECHECK_MIN_MS } from './index';
+import {
+  createDatabaseEventSystem,
+  DatabaseEventTypes,
+} from '../../services/database/events/index';
+
+// The session is re-checked after every reconnect and after a statement the
+// server refused because of the session: a token refused on a socket's own
+// handshake used to leave the page on an anonymous `connected` socket while
+// it kept announcing the user.
+
+function jwt(claims: Record<string, unknown>): string {
+  return `header.${Buffer.from(JSON.stringify(claims)).toString('base64url')}.signature`;
+}
+
+const silentLogger = () =>
+  ({ debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn(), child: () => silentLogger() }) as any;
+
+const REFUSED = 'There was a problem with authentication: this session has ended, sign in again';
+
+function makeAuth() {
+  const token = jwt({ AC: 'account', ID: 'user:abc' });
+  const store = new Map<string, unknown>([['sp00ky_auth_token', token]]);
+  const persistence = {
+    get: vi.fn(async (k: string) => store.get(k) ?? null),
+    set: vi.fn(async (k: string, v: unknown) => void store.set(k, v)),
+    remove: vi.fn(async (k: string) => void store.delete(k)),
+  } as any;
+  const connected = new Set<() => void>();
+  const events = createDatabaseEventSystem();
+  let refuse = false;
+  const authenticate = vi.fn(async () => {
+    if (refuse) throw new Error(REFUSED);
+  });
+  const remote = {
+    query: vi.fn(async () => [{ id: 'user:abc' }]),
+    setAuthToken: vi.fn(),
+    whenConnected: vi.fn(async () => undefined),
+    subscribeConnection: (_event: 'connected', cb: () => void) => {
+      connected.add(cb);
+      return () => connected.delete(cb);
+    },
+    getEvents: () => events,
+    getClient: () => ({ authenticate, invalidate: vi.fn(async () => undefined) }),
+  } as any;
+  const auth = new AuthService({} as any, remote, persistence, silentLogger());
+  const settle = () => new Promise((r) => setTimeout(r, 0));
+  return {
+    auth,
+    authenticate,
+    store,
+    refuseFromNowOn: () => void (refuse = true),
+    reconnect: async () => {
+      for (const cb of connected) cb();
+      await settle();
+    },
+    statementFails: async (error: string) => {
+      events.emit(DatabaseEventTypes.RemoteQuery, {
+        query: 'RETURN fn::query::register($config)',
+        duration: 1,
+        success: false,
+        error,
+        timestamp: Date.now(),
+      });
+      await settle();
+    },
+  };
+}
+
+describe('AuthService session re-check', () => {
+  it('signs out when a reconnected socket can no longer use the token', async () => {
+    const t = makeAuth();
+    await t.auth.init();
+    expect(t.auth.isAuthenticated).toBe(true);
+
+    t.refuseFromNowOn();
+    await t.reconnect();
+
+    expect(t.authenticate).toHaveBeenCalledTimes(2);
+    expect(t.auth.isAuthenticated).toBe(false);
+    expect(t.store.get('sp00ky_auth_token')).toBeUndefined();
+  });
+
+  it('keeps a session the server still accepts after a reconnect', async () => {
+    const t = makeAuth();
+    await t.auth.init();
+    await t.reconnect();
+
+    expect(t.authenticate).toHaveBeenCalledTimes(2);
+    expect(t.auth.isAuthenticated).toBe(true);
+  });
+
+  it('signs out when a statement on an open socket is refused for the session', async () => {
+    const t = makeAuth();
+    await t.auth.init();
+
+    t.refuseFromNowOn();
+    await t.statementFails(`An error occurred: ${REFUSED}`);
+
+    expect(t.auth.isAuthenticated).toBe(false);
+  });
+
+  it('ignores statement errors that are not about the session', async () => {
+    const t = makeAuth();
+    await t.auth.init();
+    await t.statementFails('Found 3 for field `n`, but expected a string');
+    await t.statementFails('There was a problem with the underlying connection');
+
+    expect(t.authenticate).toHaveBeenCalledTimes(1);
+  });
+
+  it('re-checks once per window however many statements are refused', async () => {
+    vi.useFakeTimers({ toFake: ['Date'] });
+    try {
+      const t = makeAuth();
+      await t.auth.init();
+      await t.statementFails(REFUSED);
+      await t.statementFails(REFUSED);
+      expect(t.authenticate).toHaveBeenCalledTimes(2);
+
+      vi.setSystemTime(Date.now() + REFUSAL_RECHECK_MIN_MS);
+      await t.statementFails(REFUSED);
+      expect(t.authenticate).toHaveBeenCalledTimes(3);
+      expect(t.auth.isAuthenticated).toBe(true);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('does nothing for a signed-out page', async () => {
+    const t = makeAuth();
+    t.store.clear();
+    await t.auth.init();
+    await t.reconnect();
+    await t.statementFails(REFUSED);
+
+    expect(t.authenticate).not.toHaveBeenCalled();
+  });
+});

package/src/modules/auth/index.ts

@@ -9,7 +9,8 @@ import type { Logger } from '../../services/logger/index';
 export * from './events/index';
 import { AuthEventTypes, createAuthEventSystem } from './events/index';
 import type { PersistenceClient } from '../../types';
-import { classifySyncError } from '../../utils/error-classification';
+import { classifySyncError, isRefusedSessionError } from '../../utils/error-classification';
+import { DatabaseEventTypes } from '../../services/database/events/index';
 import { encodeRecordId } from '../../utils/index';
 import { RecordId } from 'surrealdb';
 import {
@@ -53,6 +54,13 @@ export type SignOutHook = (ctx: SignOutContext) => Promise<void> | void;
 /** Upper bound on the before-sign-out hooks, so a dead socket never holds a sign-out. */
 export const SIGN_OUT_HOOK_TIMEOUT_MS = 2_000;
 
+/**
+ * Floor between two session re-checks started by refused statements. A
+ * refused session fails every statement at once, and a check that keeps the
+ * session (the server was unreachable) must not be re-run by each of them.
+ */
+export const REFUSAL_RECHECK_MIN_MS = 30_000;
+
 // Helper to pretty print types
 type Prettify<T> = {
   [K in keyof T]: T[K];
@@ -111,6 +119,11 @@ export class AuthService<S extends SchemaStructure> {
   private stopping: Promise<void> | null = null;
   /** A token renewal in flight, which a stop waits out (see `renewImpersonation`). */
   private renewing: Promise<void> | null = null;
+  /** The session re-check in flight (see `watchSession`), shared by every trigger. */
+  private reverifying: Promise<void> | null = null;
+  /** When a refused statement last started a re-check. */
+  private lastRefusalCheckAt = Number.NEGATIVE_INFINITY;
+  private watchingSession = false;
   private impersonationTimers = new ImpersonationTimers({
     current: () => this.impersonation,
     renew: () => this.renewImpersonation(),
@@ -141,6 +154,60 @@ export class AuthService<S extends SchemaStructure> {
 
   async init() {
     await this.check();
+    this.watchSession();
+  }
+
+  /**
+   * Check the session again whenever the socket comes back, and whenever the
+   * server refuses a statement because of the session.
+   *
+   * The server judges a token only when a socket authenticates: the SDK
+   * replays `authenticate` on its own reconnects, `RemoteDatabaseService` on a
+   * socket it rebuilds. When the replay is refused (the app ended the session,
+   * say with a password reset) the SDK drops to an anonymous session, and the
+   * supervisor swallows the rebuild's error, so the socket reports `connected`
+   * while this service still announces the user. Every view registered from
+   * then on carried no identity: the page looked signed in and showed nothing
+   * of the user's. `check()` applies the token again and signs out when the
+   * server refuses it.
+   *
+   * A socket that never reconnects is ended by the app's session guard
+   * (`fn::sp00ky::session_live`) instead: its heartbeats stop finding rows,
+   * and the re-registration that follows is refused with "There was a problem
+   * with authentication", which starts a check here too.
+   */
+  private watchSession(): void {
+    if (this.watchingSession) return;
+    this.watchingSession = true;
+    this.remote.subscribeConnection('connected', () => this.reverify());
+    this.remote.getEvents().subscribe(DatabaseEventTypes.RemoteQuery, (event) => {
+      const { success, error } = event.payload;
+      if (success || !isRefusedSessionError(error ?? '')) return;
+      const now = Date.now();
+      if (now - this.lastRefusalCheckAt < REFUSAL_RECHECK_MIN_MS) return;
+      this.lastRefusalCheckAt = now;
+      this.reverify();
+    });
+  }
+
+  /** One `check()` for every trigger that lands while it runs. */
+  private reverify(): void {
+    if (!this.isAuthenticated || this.reverifying) return;
+    this.reverifying = (async () => {
+      // A rebuilt socket reports `connected` before its namespace and token
+      // are applied: check against the finished handshake.
+      await this.remote.whenConnected();
+      if (this.isAuthenticated) await this.check();
+    })()
+      .catch((error) => {
+        this.logger.warn(
+          { error, Category: 'sp00ky-client::AuthService::reverify' },
+          'Session re-check failed'
+        );
+      })
+      .finally(() => {
+        this.reverifying = null;
+      });
   }
 
   getAccessDefinition<Name extends keyof S['access']>(name: Name): AccessDefinition | undefined {

package/src/query/anon-query-isolation.integration.test.ts

@@ -58,14 +58,18 @@ function ownerGuard(): string {
 
 const sha256 = (text: string) => createHash('sha256').update(text).digest('hex');
 
-/** Just the `_00_query` block: the rest of the file needs tables and modules this test does not. */
+/**
+ * Just the session guard (its rule's user branch asks it) and the `_00_query`
+ * block: the rest of the file needs tables and modules this test does not.
+ */
 function queryTableSchema(): string {
   const meta = cliSource('meta_tables_remote.surql');
+  const guard = meta.indexOf('-- SPOOKY SESSION GUARD');
   const start = meta.indexOf('DEFINE TABLE OVERWRITE _00_query SCHEMALESS');
   const end = meta.indexOf('-- SPOOKY LIST REF');
-  if (start < 0 || end < start)
+  if (guard < 0 || start < guard || end < start)
     throw new Error('_00_query block not found in meta_tables_remote.surql');
-  return meta.slice(start, end);
+  return meta.slice(guard, meta.indexOf('-- SPOOKY INCANTATION')) + meta.slice(start, end);
 }
 
 const ACCESS = `

package/src/query/session-guard.integration.test.ts

@@ -0,0 +1,302 @@
+import { Socket } from 'node:net';
+import { createHash, randomUUID } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { afterEach, beforeAll, beforeEach, describe, expect, it } from 'vitest';
+import { RecordId, Surreal } from 'surrealdb';
+import { liveEndpoint } from '../live/index';
+import { isRefusedSessionError } from '../utils/error-classification';
+import { heartbeatBatch, heartbeatRowGone, queryRowCountSelect } from './sql';
+
+/**
+ * The app's session guard (`sessionGuard` in sp00ky.yml, the SESSION GUARD
+ * block of `meta_tables_remote.surql`) ends sync for a WebSocket that is still
+ * open. SurrealDB checks a token only when a socket authenticates, so before
+ * the guard a socket that authenticated before a password reset kept reading
+ * its user's edges, heartbeating its views and registering new ones until it
+ * happened to reconnect.
+ *
+ * Runs the shipped guard, `_00_query` and `_00_list_ref` blocks, the
+ * `fn::query::*` functions and the per-user edge-table rule ssp-node defines,
+ * against a real SurrealDB, because the guarantee is the engine's evaluation
+ * of those rules, LIVE notifications included. Boot one first, e.g.:
+ *   docker run -d --name spooky-surreal-it -p 18011:8000 \
+ *     surrealdb/surrealdb:v3.1.5 start --user root --pass root --allow-all memory
+ *
+ * Override the endpoint with SURREAL_IT_ENDPOINT. Skips if unreachable.
+ */
+const endpoint = liveEndpoint(process.env.SURREAL_IT_ENDPOINT ?? 'ws://127.0.0.1:18011');
+const NS = 'it';
+
+/** The guard WhitePawn ships: a password reset stamps `session_epoch`. */
+const GUARD = '$auth.session_epoch = NONE OR ($token.iat ?? 0) >= $auth.session_epoch';
+
+const repoFile = (path: string) =>
+  readFileSync(fileURLToPath(new URL(`../../../../${path}`, import.meta.url)), 'utf8');
+const cliSource = (file: string) => repoFile(`apps/cli/src/${file}`);
+
+function slice(src: string, from: string, to: string): string {
+  const start = src.indexOf(from);
+  const end = src.indexOf(to, start);
+  if (start < 0 || end < start) throw new Error(`block ${from} .. ${to} not found`);
+  return src.slice(start, end);
+}
+
+/**
+ * The SESSION GUARD block, with `expr` put in the way `spky migrate` does
+ * (`schema_builder::apply_session_guard`, whose marker is read from the Rust
+ * source so the two cannot drift).
+ */
+function guardSchema(expr?: string): string {
+  const block = slice(
+    cliSource('meta_tables_remote.surql'),
+    '-- SPOOKY SESSION GUARD',
+    '-- SPOOKY INCANTATION'
+  );
+  const m = /pub const SESSION_GUARD_DEFAULT: &str = "([^"]+)";/.exec(
+    repoFile('apps/cli/src/schema_builder.rs')
+  );
+  if (!m || !block.includes(m[1])) throw new Error('session guard marker not found');
+  return expr ? block.replace(m[1], `RETURN (${expr}) == true;`) : block;
+}
+
+/** Just the tables this test needs: the rest of the file needs modules. */
+const queryTableSchema = () =>
+  slice(
+    cliSource('meta_tables_remote.surql'),
+    'DEFINE TABLE OVERWRITE _00_query SCHEMALESS',
+    '-- SPOOKY LIST REF'
+  );
+const listRefSchema = () =>
+  slice(
+    cliSource('meta_tables_remote.surql'),
+    'DEFINE TABLE OVERWRITE _00_list_ref SCHEMALESS',
+    '-- SPOOKY STREAM PROCESSOR STATE'
+  );
+
+/** The rule ssp-node puts on `_00_list_ref_user_<uid>` (`user_list_ref_ddl` in tables.rs). */
+function userListRefTable(uid: string): string {
+  const m = /PERMISSIONS FOR select WHERE (\$auth\.id = user:\{uid\}[^,]*),/.exec(
+    repoFile('packages/ssp-node/src/tables.rs')
+  );
+  if (!m) throw new Error('per-user list_ref rule not found in ssp-node/src/tables.rs');
+  return `DEFINE TABLE OVERWRITE _00_list_ref_user_${uid} SCHEMALESS
+    PERMISSIONS FOR select WHERE ${m[1].replace('{uid}', uid)}, FOR create, update, delete WHERE false;`;
+}
+
+/** An app schema: a hidden `session_epoch` and an app table that asks the guard too. */
+const APP = `
+DEFINE TABLE OVERWRITE user SCHEMAFULL PERMISSIONS FOR select WHERE id = $auth.id;
+DEFINE FIELD OVERWRITE name ON TABLE user TYPE string;
+DEFINE FIELD OVERWRITE session_epoch ON TABLE user TYPE option<int>
+  PERMISSIONS FOR select WHERE false, FOR create, update WHERE false;
+DEFINE ACCESS OVERWRITE account ON DATABASE TYPE RECORD
+  SIGNUP (CREATE ONLY type::record('user', $name) SET name = $name)
+  SIGNIN (SELECT * FROM user WHERE name = $name)
+  DURATION FOR TOKEN 1h, FOR SESSION 1h;
+DEFINE TABLE OVERWRITE game SCHEMALESS
+  PERMISSIONS FOR select WHERE owner = $auth.id AND fn::sp00ky::session_live();
+CREATE game:1 SET owner = user:alice;
+`;
+
+/** What the SSP writes, as root, when a session registers a view (`node.rs`, cold path). */
+const SSP_REGISTER = `
+UPSERT $id SET clientId = $sid, auth_id = 'user:alice', surql = 'SELECT * FROM game',
+  params = { auth: { id: 'user:alice' }, access: 'account' }, ttl = 1h, lastActiveAt = time::now(),
+  rowCount = 1, state = 'ready',
+  subscribers = array::append(
+    array::filter(subscribers ?? [], |$s| <string>$s.id != $sid AND <datetime>$s.seenAt + 1h > time::now()),
+    { id: $sid, seenAt: time::now() })`;
+
+const viewId = () =>
+  new RecordId('_00_query', createHash('sha256').update(randomUUID()).digest('hex'));
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+describe('session guard ends sync for an open socket (real SurrealDB)', () => {
+  let root: Surreal;
+  let database = '';
+  let reachable = false;
+  const open: Surreal[] = [];
+
+  beforeAll(async () => {
+    const url = new URL(endpoint);
+    reachable = await new Promise<boolean>((resolve) => {
+      const socket = new Socket();
+      const done = (ok: boolean) => {
+        socket.destroy();
+        resolve(ok);
+      };
+      socket.setTimeout(1_000, () => done(false));
+      socket.once('error', () => done(false));
+      socket.connect(Number(url.port || 80), url.hostname, () => done(true));
+    });
+  });
+
+  /** Root, a fresh database, the app and sp00ky's rules with `guard` in place. */
+  async function boot(guard?: string): Promise<void> {
+    database = `session_guard_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+    root = new Surreal();
+    await root.connect(endpoint, { reconnect: false });
+    await root.signin({ username: 'root', password: 'root' });
+    await root.use({ namespace: NS, database });
+    await root.query(guardSchema(guard));
+    await root.query(APP);
+    await root.query(queryTableSchema());
+    await root.query(listRefSchema());
+    await root.query(userListRefTable('alice'));
+    await root.query(cliSource('functions_remote.surql'));
+    // The guard throws before the post; a live session's post fails on this
+    // closed port, which is not a refused session.
+    await root.query(
+      cliSource('functions_remote_singlenode.surql')
+        .replaceAll('{{ENDPOINT}}', 'http://127.0.0.1:9')
+        .replaceAll('{{SECRET}}', 'it-secret')
+    );
+  }
+
+  afterEach(async () => {
+    if (!reachable || !root) return;
+    for (const db of open.splice(0)) await db.close().catch(() => undefined);
+    await root.query(`REMOVE DATABASE ${database}`).catch(() => undefined);
+    await root.close();
+  });
+
+  /** Alice on a socket of her own, and that socket's `session::id()`. */
+  async function alice(how: 'signup' | 'signin'): Promise<[Surreal, string]> {
+    const db = new Surreal();
+    open.push(db);
+    await db.connect(endpoint, { reconnect: false });
+    await db.use({ namespace: NS, database });
+    await db[how]({ namespace: NS, database, access: 'account', variables: { name: 'alice' } });
+    const [sid] = (await db.query('RETURN <string>session::id()')) as [string];
+    return [db, sid];
+  }
+
+  /** What a password reset does: every token issued before now stops counting. */
+  async function resetPassword(stale: Surreal): Promise<void> {
+    const [iat] = (await stale.query('RETURN $token.iat')) as [number];
+    const epoch = iat + 1;
+    await root.query('UPDATE user:alice SET session_epoch = $epoch', { epoch });
+    // `iat` has second precision: the next sign-in must land at or past the epoch.
+    while (Date.now() / 1000 < epoch) await sleep(50);
+  }
+
+  /** LIVE on the per-user edge table; returns the notifications seen so far. */
+  async function watchEdges(db: Surreal): Promise<unknown[]> {
+    const seen: unknown[] = [];
+    const [id] = (await db.query('LIVE SELECT * FROM _00_list_ref_user_alice')) as [unknown];
+    const stream = await db.liveOf(id as never);
+    stream.subscribe((message: { action: string; value: unknown }) => {
+      if (message.action !== 'KILLED') seen.push(message.value);
+    });
+    return seen;
+  }
+
+  const edge = (n: number) =>
+    root.query(
+      `CREATE type::record('_00_list_ref_user_alice', $n) SET in = _00_query:q, out = game:1, version = $n`,
+      { n }
+    );
+
+  /** The client's register read-back, as `registerSelect` sends it. */
+  const readBack = async (db: Surreal, id: RecordId<string>) =>
+    ((await db.query(queryRowCountSelect(), { in: id })) as [unknown])[0] ?? null;
+
+  const heartbeatFound = async (db: Surreal, id: RecordId<string>) => {
+    const beat = heartbeatBatch([id]);
+    const [result] = (await db.query(beat.sql, beat.vars)) as [unknown];
+    return !heartbeatRowGone(result);
+  };
+
+  const registerError = async (db: Surreal): Promise<unknown> =>
+    db
+      .query('RETURN fn::query::register($config)', {
+        config: { id: viewId(), surql: 'SELECT * FROM game', params: {}, ttl: '1h' },
+      })
+      .then(
+        () => null,
+        (error: unknown) => error
+      );
+
+  it('a socket from before the reset stops receiving edges, a fresh sign-in keeps them', async (ctx) => {
+    if (!reachable) ctx.skip();
+    await boot(GUARD);
+    const [stale] = await alice('signup');
+    const staleSeen = await watchEdges(stale);
+    await edge(1);
+    await expect.poll(() => staleSeen.length).toBe(1);
+
+    await resetPassword(stale);
+    const [fresh] = await alice('signin');
+    const freshSeen = await watchEdges(fresh);
+    await edge(2);
+    await edge(3);
+
+    await expect.poll(() => freshSeen.length).toBe(2);
+    await sleep(200);
+    expect(staleSeen.length).toBe(1);
+  });
+
+  it('a socket from before the reset reads none of its user\'s edges, views or rows', async (ctx) => {
+    if (!reachable) ctx.skip();
+    await boot(GUARD);
+    const [stale, staleSid] = await alice('signup');
+    await edge(1);
+    await root.query(
+      `CREATE _00_list_ref:1 SET in = _00_query:q, out = game:1, clientId = 'x', auth_id = 'user:alice', version = 1`
+    );
+    await resetPassword(stale);
+    const [fresh, freshSid] = await alice('signin');
+    const q = viewId();
+    await root.query(SSP_REGISTER, { id: q, sid: staleSid });
+    await root.query(SSP_REGISTER, { id: q, sid: freshSid });
+
+    for (const table of ['_00_list_ref_user_alice', '_00_list_ref', 'game']) {
+      expect(await stale.query(`SELECT VALUE id FROM ${table}`), table).toEqual([[]]);
+      expect(((await fresh.query(`SELECT VALUE id FROM ${table}`)) as [unknown[]])[0], table).toHaveLength(1);
+    }
+    expect(await readBack(stale, q)).toBeNull();
+    expect(await heartbeatFound(stale, q)).toBe(false);
+    expect(await readBack(fresh, q)).toEqual({ rowCount: 1, state: 'ready' });
+    expect(await heartbeatFound(fresh, q)).toBe(true);
+  });
+
+  it('fn::query::register refuses the stale socket as a refused session, and only that one', async (ctx) => {
+    if (!reachable) ctx.skip();
+    await boot(GUARD);
+    const [stale] = await alice('signup');
+    expect(isRefusedSessionError(await registerError(stale))).toBe(false);
+
+    await resetPassword(stale);
+    const [fresh] = await alice('signin');
+
+    const refused = await registerError(stale);
+    expect(isRefusedSessionError(refused), String(refused)).toBe(true);
+    expect(isRefusedSessionError(await registerError(fresh))).toBe(false);
+  });
+
+  it('without a sessionGuard every session stays live, as before the guard', async (ctx) => {
+    if (!reachable) ctx.skip();
+    await boot();
+    const [stale, staleSid] = await alice('signup');
+    await edge(1);
+    const q = viewId();
+    await root.query(SSP_REGISTER, { id: q, sid: staleSid });
+    await resetPassword(stale);
+
+    expect(((await stale.query('SELECT VALUE id FROM _00_list_ref_user_alice')) as [unknown[]])[0]).toHaveLength(1);
+    expect(await heartbeatFound(stale, q)).toBe(true);
+    expect(isRefusedSessionError(await registerError(stale))).toBe(false);
+  });
+
+  it('a database without the probe row lets every registration through', async (ctx) => {
+    if (!reachable) ctx.skip();
+    await boot(GUARD);
+    const [stale] = await alice('signup');
+    await resetPassword(stale);
+    await root.query('DELETE _00_session_guard:probe');
+
+    expect(isRefusedSessionError(await registerError(stale))).toBe(false);
+  });
+});

package/src/utils/error-classification.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { classifySyncError } from './error-classification';
+import { classifySyncError, isRefusedSessionError } from './error-classification';
 
 describe('classifySyncError', () => {
   it('classifies surreal ConnectionUnavailableError as network', () => {
@@ -52,3 +52,21 @@ describe('classifySyncError', () => {
     expect(classifySyncError('boom')).toBe('application');
   });
 });
+
+describe('isRefusedSessionError', () => {
+  it.each([
+    'There was a problem with authentication',
+    'An error occurred: There was a problem with authentication: this session has ended, sign in again',
+    'The session has expired',
+  ])('takes %j as a refused session', (message) => {
+    expect(isRefusedSessionError(new Error(message))).toBe(true);
+  });
+
+  it.each([
+    'There was a problem with the database: Invalid token',
+    'There was a problem with the underlying connection',
+    'Permission denied',
+  ])('does not take %j as one', (message) => {
+    expect(isRefusedSessionError(new Error(message))).toBe(false);
+  });
+});

package/src/utils/error-classification.ts

@@ -51,3 +51,15 @@ export function classifySyncError(error: unknown): 'network' | 'application' {
 
   return 'application';
 }
+
+/**
+ * Whether the server refused the SESSION rather than the statement: its own
+ * wording for a token it will not accept ("There was a problem with
+ * authentication"), which is also what an app's AUTHENTICATE clause and
+ * sp00ky's session guard throw, and a session past its `DURATION FOR SESSION`.
+ */
+export function isRefusedSessionError(error: unknown): boolean {
+  const message =
+    error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+  return message.includes('problem with authentication') || message.includes('session has expired');
+}