@spooky-sync/core 0.0.1-canary.332 → 0.0.1-canary.334

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as WebPushModule, A as RegistrationTimings, At as LogTap, B as SyncHealthConfig, Bt as ORIGIN_TOKEN_KEY, C as QueryStatusCallback, Ct as SignOutContext, D as ReconnectConfig, Dt as AuthEventTypes, E as QueryUpdateCallback, Et as AuthEventTypeMap, F as Sp00kyQueryResultPromise, Ft as EventSystem, G as PushDeviceKind, Gt as renewDelayMs, H as TimingPhase, Ht as TokenClaims, I as StorageHealth, It as IMPERSONATION_ACCESS, J as WebPushError, K as WebPushConfig, Kt as sameImpersonation, L as StorageHealthStatus, Lt as ImpersonationInfo, M as ServerViewMeta, Mt as LocalStore, N as Sp00kyConfig, Nt as SealedQuery, O as RecordVersionArray, Ot as createAuthEventSystem, P as Sp00kyQueryResult, Pt as EventDefinition, Q as WebPushMessageInput, R as StoreType, Rt as ImpersonationTimerHost, S as QueryStatus, St as SIGN_OUT_HOOK_TIMEOUT_MS, T as QueryTimings, Tt as AuthEventSystem, U as UpdateOptions, Ut as decodeTokenClaims, V as SyncHealthStatus, Vt as SESSION_POLL_MS, W as PUSH_ENDPOINT_KEY, Wt as impersonationFromToken, X as WebPushInfo, Y as WebPushErrorCode, Z as WebPushMessage, _ as QueryAuthorityCallback, _t as WebPushClientMessage, a as InlineRow, at as WebPushUnsupportedReason, b as QueryHash, bt as AuthService, c as MembershipOutcome, ct as BridgeSignOutMessage, d as MutationEventType, dt as PushNotification, et as WebPushSubscribeOptions, f as PersistenceClient, ft as PushNotificationAction, g as PreloadRefresh, gt as PushUrgency, h as PreloadOptions, ht as PushPayloadKind, i as EventSubscriptionOptions, it as WebPushUnsubscribeOptions, j as RunOptions, jt as Logger$1, k as RecordVersionDiff, kt as RemoteDatabaseService, l as MutationCallback, lt as BridgeTokenMessage, m as PinoTransmit, mt as PushPayload, n as DebounceOptions, nt as WebPushSyncOptions, o as Level, ot as WebPushUpdateOptions, p as PhaseStat, pt as PushOp, q as WebPushDevice, r as EdgeDelta, rt as WebPushSyncStatus, s as MATERIALIZATION_SAMPLE_WINDOW, st as detectWebPushSupport, t as ConnectionState, tt as WebPushSupport, u as MutationEvent, ut as PUSH_PAYLOAD_VERSION, v as QueryConfig, vt as isPushPayload, w as QueryTimeToLive, wt as SignOutHook, x as QueryState, xt as ImpersonationCandidate, y as QueryConfigRecord, yt as ActiveImpersonation, z as SyncHealth, zt as ImpersonationTimers } from "./types.js";
+import { $ as WebPushModule, A as RegistrationTimings, At as RemoteDatabaseService, B as SyncHealthConfig, Bt as ImpersonationTimers, C as QueryStatusCallback, Ct as SIGN_OUT_HOOK_TIMEOUT_MS, D as ReconnectConfig, Dt as AuthEventTypeMap, E as QueryUpdateCallback, Et as AuthEventSystem, F as Sp00kyQueryResultPromise, Ft as EventDefinition, G as PushDeviceKind, Gt as impersonationFromToken, H as TimingPhase, Ht as SESSION_POLL_MS, I as StorageHealth, It as EventSystem, J as WebPushError, K as WebPushConfig, Kt as renewDelayMs, L as StorageHealthStatus, Lt as IMPERSONATION_ACCESS, M as ServerViewMeta, Mt as Logger$1, N as Sp00kyConfig, Nt as LocalStore, O as RecordVersionArray, Ot as AuthEventTypes, P as Sp00kyQueryResult, Pt as SealedQuery, Q as WebPushMessageInput, R as StoreType, Rt as ImpersonationInfo, S as QueryStatus, St as REFUSAL_RECHECK_MIN_MS, T as QueryTimings, Tt as SignOutHook, U as UpdateOptions, Ut as TokenClaims, V as SyncHealthStatus, Vt as ORIGIN_TOKEN_KEY, W as PUSH_ENDPOINT_KEY, Wt as decodeTokenClaims, X as WebPushInfo, Y as WebPushErrorCode, Z as WebPushMessage, _ as QueryAuthorityCallback, _t as WebPushClientMessage, a as InlineRow, at as WebPushUnsupportedReason, b as QueryHash, bt as AuthService, c as MembershipOutcome, ct as BridgeSignOutMessage, d as MutationEventType, dt as PushNotification, et as WebPushSubscribeOptions, f as PersistenceClient, ft as PushNotificationAction, g as PreloadRefresh, gt as PushUrgency, h as PreloadOptions, ht as PushPayloadKind, i as EventSubscriptionOptions, it as WebPushUnsubscribeOptions, j as RunOptions, jt as LogTap, k as RecordVersionDiff, kt as createAuthEventSystem, l as MutationCallback, lt as BridgeTokenMessage, m as PinoTransmit, mt as PushPayload, n as DebounceOptions, nt as WebPushSyncOptions, o as Level, ot as WebPushUpdateOptions, p as PhaseStat, pt as PushOp, q as WebPushDevice, qt as sameImpersonation, r as EdgeDelta, rt as WebPushSyncStatus, s as MATERIALIZATION_SAMPLE_WINDOW, st as detectWebPushSupport, t as ConnectionState, tt as WebPushSupport, u as MutationEvent, ut as PUSH_PAYLOAD_VERSION, v as QueryConfig, vt as isPushPayload, w as QueryTimeToLive, wt as SignOutContext, x as QueryState, xt as ImpersonationCandidate, y as QueryConfigRecord, yt as ActiveImpersonation, z as SyncHealth, zt as ImpersonationTimerHost } from "./types.js";
 import { BackendNames, BackendRoutes, BucketNames, FinalQuery, GetTable, QueryBuilder, QueryOptions, QueryPlan, RecordId, RoutePayload, SchemaStructure, TableModel, TableNames } from "@spooky-sync/query-builder";
 import * as surrealdb0 from "surrealdb";
 import { Duration, RecordId as RecordId$1, Surreal } from "surrealdb";
@@ -1055,6 +1055,17 @@ type OutEvent = {
  * behind `status: 'fetching'`, `notified` says whether subscribers received
  * at least one materialization this registration.
  *
+ * `answered` says subscribers have been handed the rows of a known membership
+ * (the server's, or the durable one of an earlier session) at least once:
+ * a materialization ran past `cold`, with no body of a server set still to
+ * download, and the membership it drew was still the one in state when it
+ * committed. Only a re-seed (a new entry, a bucket switch) clears it, so a
+ * reconnect or a lost view does not send a painted query back to loading.
+ * It is what the bindings' `isAuthoritative()` mirrors (see `isAnswered`):
+ * a `cached` seed or a freshly applied server set alone is not enough,
+ * because `records` is still empty (or stale) until `materialize` paints, and
+ * "known and empty" read in that beat made apps create rows that existed.
+ *
  * `backgroundDepth` is the part of `fetchDepth` that re-verifies rows the
  * query already shows: a registration of a query that is not `cold`. It still
  * holds `status: 'fetching'` (results are not yet confirmed), but it is not
@@ -1068,6 +1079,7 @@ interface QueryLifecycle {
   readonly fetchDepth: number;
   readonly backgroundDepth: number;
   readonly notified: boolean;
+  readonly answered: boolean;
 }
 //#endregion
 //#region src/kernel/effects.d.ts
@@ -2212,4 +2224,4 @@ declare class LocalOpTimeoutError extends Error {
  *  select on a throttled tab is seconds, not tens of seconds. */
 declare const DEFAULT_LOCAL_OP_TIMEOUT_MS = 30000;
 //#endregion
-export { ActiveImpersonation, AppReleaseHandle, AppReleaseModule, type AppReleaseOptions, type AppReleaseSnapshot, AuthEventSystem, AuthEventTypeMap, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, type BlobCacheStats, type BlobEntry, type BlobKey, type BlobReadOptions, type BlobUrlLease, type BlurhashEncodeOptions, type BlurhashSetting, type BridgeSignOutMessage, type BridgeTokenMessage, BucketHandle, BucketPutOptions, BucketPutResult, CURSOR_COLORS, ConnectionState, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, DebounceOptions, EdgeDelta, EventSubscriptionOptions, type FailedMutationRow as FailedMutation, FeatureFlagHandle, FeatureFlagModule, type FeatureFlagOptions, type FeatureFlagOverride, type FeatureFlagSnapshot, IMPERSONATION_ACCESS, ImpersonationCandidate, ImpersonationInfo, ImpersonationTimerHost, ImpersonationTimers, InlineRow, Level, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, MembershipOutcome, MutationCallback, MutationEvent, MutationEventType, ORIGIN_TOKEN_KEY, PUSH_ENDPOINT_KEY, PUSH_PAYLOAD_VERSION, PersistenceClient, PhaseStat, PinoTransmit, PreloadOptions, PreloadRefresh, type PushDeviceKind, type PushNotification, type PushNotificationAction, type PushOp, type PushPayload, type PushPayloadKind, type PushUrgency, QueryAuthorityCallback, QueryConfig, QueryConfigRecord, QueryHash, QueryState, QueryStatus, QueryStatusCallback, QueryTimeToLive, QueryTimings, QueryUpdateCallback, ReconnectConfig, RecordVersionArray, RecordVersionDiff, RegistrationTimings, RunOptions, SESSION_POLL_MS, SIGN_OUT_HOOK_TIMEOUT_MS, ServerViewMeta, SignOutContext, SignOutHook, Sp00kyClient, Sp00kyClientDeps, Sp00kyConfig, Sp00kyQueryResult, Sp00kyQueryResultPromise, StorageHealth, StorageHealthStatus, StoreType, SyncHealth, SyncHealthConfig, SyncHealthStatus, TimingPhase, TokenClaims, UpdateOptions, type WebPushClientMessage, type WebPushConfig, type WebPushDevice, WebPushError, type WebPushErrorCode, type WebPushInfo, type WebPushMessage, type WebPushMessageInput, WebPushModule, type WebPushSubscribeOptions, type WebPushSupport, type WebPushSyncOptions, type WebPushSyncStatus, type WebPushUnsubscribeOptions, type WebPushUnsupportedReason, type WebPushUpdateOptions, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, detectWebPushSupport, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, isPushPayload, renewDelayMs, sameImpersonation, semverGt, textToHtml };
+export { ActiveImpersonation, AppReleaseHandle, AppReleaseModule, type AppReleaseOptions, type AppReleaseSnapshot, AuthEventSystem, AuthEventTypeMap, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, type BlobCacheStats, type BlobEntry, type BlobKey, type BlobReadOptions, type BlobUrlLease, type BlurhashEncodeOptions, type BlurhashSetting, type BridgeSignOutMessage, type BridgeTokenMessage, BucketHandle, BucketPutOptions, BucketPutResult, CURSOR_COLORS, ConnectionState, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, DebounceOptions, EdgeDelta, EventSubscriptionOptions, type FailedMutationRow as FailedMutation, FeatureFlagHandle, FeatureFlagModule, type FeatureFlagOptions, type FeatureFlagOverride, type FeatureFlagSnapshot, IMPERSONATION_ACCESS, ImpersonationCandidate, ImpersonationInfo, ImpersonationTimerHost, ImpersonationTimers, InlineRow, Level, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, MembershipOutcome, MutationCallback, MutationEvent, MutationEventType, ORIGIN_TOKEN_KEY, PUSH_ENDPOINT_KEY, PUSH_PAYLOAD_VERSION, PersistenceClient, PhaseStat, PinoTransmit, PreloadOptions, PreloadRefresh, type PushDeviceKind, type PushNotification, type PushNotificationAction, type PushOp, type PushPayload, type PushPayloadKind, type PushUrgency, QueryAuthorityCallback, QueryConfig, QueryConfigRecord, QueryHash, QueryState, QueryStatus, QueryStatusCallback, QueryTimeToLive, QueryTimings, QueryUpdateCallback, REFUSAL_RECHECK_MIN_MS, ReconnectConfig, RecordVersionArray, RecordVersionDiff, RegistrationTimings, RunOptions, SESSION_POLL_MS, SIGN_OUT_HOOK_TIMEOUT_MS, ServerViewMeta, SignOutContext, SignOutHook, Sp00kyClient, Sp00kyClientDeps, Sp00kyConfig, Sp00kyQueryResult, Sp00kyQueryResultPromise, StorageHealth, StorageHealthStatus, StoreType, SyncHealth, SyncHealthConfig, SyncHealthStatus, TimingPhase, TokenClaims, UpdateOptions, type WebPushClientMessage, type WebPushConfig, type WebPushDevice, WebPushError, type WebPushErrorCode, type WebPushInfo, type WebPushMessage, type WebPushMessageInput, WebPushModule, type WebPushSubscribeOptions, type WebPushSupport, type WebPushSyncOptions, type WebPushSyncStatus, type WebPushUnsubscribeOptions, type WebPushUnsupportedReason, type WebPushUpdateOptions, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, detectWebPushSupport, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, isPushPayload, renewDelayMs, sameImpersonation, semverGt, textToHtml };

package/dist/index.js

@@ -551,6 +551,16 @@ function classifySyncError(error) {
 	for (const pattern of NETWORK_ERROR_PATTERNS) if (message.includes(pattern)) return "network";
 	return "application";
 }
+/**
+* Whether the server refused the SESSION rather than the statement: its own
+* wording for a token it will not accept ("There was a problem with
+* authentication"), which is also what an app's AUTHENTICATE clause and
+* sp00ky's session guard throw, and a session past its `DURATION FOR SESSION`.
+*/
+function isRefusedSessionError(error) {
+	const message = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+	return message.includes("problem with authentication") || message.includes("session has expired");
+}
 
 //#endregion
 //#region src/utils/index.ts
@@ -2188,8 +2198,8 @@ function trimHistory(history, cap) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.332";
-const WASM_VERSION = "0.0.1-canary.332";
+const CORE_VERSION = "0.0.1-canary.334";
+const WASM_VERSION = "0.0.1-canary.334";
 const SURREAL_VERSION = "3.1.0";
 var DevToolsService = class DevToolsService {
 	version = CORE_VERSION;
@@ -2328,7 +2338,7 @@ var DevToolsService = class DevToolsService {
 				remoteIds: remoteArray.slice(0, DevToolsService.STATE_IDS_CAP).map(([id]) => id),
 				idsTruncated: localArray.length > DevToolsService.STATE_IDS_CAP || remoteArray.length > DevToolsService.STATE_IDS_CAP,
 				membershipKnown: q.config.membershipKnown === true,
-				authoritative: q.config.membershipKnown === true,
+				authoritative: q.answered === true,
 				viewLost: q.viewLost === true,
 				serverState: q.serverState ?? null,
 				timings: this.dataManager.phaseTimings(q)
@@ -2921,7 +2931,8 @@ function seedLifecycle(resolvedBefore) {
 		remote: "unregistered",
 		fetchDepth: 0,
 		backgroundDepth: 0,
-		notified: false
+		notified: false,
+		answered: false
 	};
 }
 /** Total on every (lifecycle, event) pair the sagas can produce; throws on the rest. */
@@ -2970,17 +2981,27 @@ function transition(l, ev) {
 				backgroundDepth
 			};
 		}
-		case "notified": return l.notified ? l : {
-			...l,
-			notified: true
-		};
+		case "notified": {
+			const answered = l.answered || ev.answered === true && l.phase !== "cold";
+			return l.notified && answered === l.answered ? l : {
+				...l,
+				notified: true,
+				answered
+			};
+		}
 		case "bucket-switch": return {
 			...seedLifecycle(ev.resolvedBefore),
 			fetchDepth: 0
 		};
 	}
 }
+/** Membership is known (server set or durable seed); its rows may not be painted yet. */
 const isAuthoritative = (l) => l.phase !== "cold";
+/**
+* Subscribers hold the rows of a known membership: what the authority channel
+* (`subscribeQueryAuthority`, the bindings' `isAuthoritative()`) reports.
+*/
+const isAnswered = (l) => l.answered;
 const hasServerMembership = (l) => l.phase === "live" || l.phase === "view-lost";
 const deriveStatus = (l) => l.fetchDepth > 0 ? "fetching" : "idle";
 /** A fetch cycle the user is waiting on: rows to download, or a first registration. */
@@ -3198,7 +3219,12 @@ const setSubqueryRemoteArray = (hash, subqueryRemoteArray) => (s) => {
 	if (!entry || entry.lifecycle.phase === "cold") return next;
 	return withView(next, entry.def.viewKey, vouchedIds(entry.remoteArray, subqueryRemoteArray));
 };
-const setRecords = (hash, records, changed, materializeMs) => (s) => {
+/**
+* Commit a materialization. `answered`: it drew a known membership with no
+* body still to download, and that membership is still current (see
+* `QueryLifecycle`).
+*/
+const setRecords = (hash, records, changed, materializeMs, answered = false) => (s) => {
 	const next = withEntry(s, hash, (e) => {
 		const prev = e.telemetry.phaseSamples.localFetch ?? [];
 		const telemetry = {
@@ -3217,7 +3243,10 @@ const setRecords = (hash, records, changed, materializeMs) => (s) => {
 			...e,
 			records: changed ? records : e.records,
 			telemetry,
-			lifecycle: transition(e.lifecycle, { type: "notified" })
+			lifecycle: transition(e.lifecycle, {
+				type: "notified",
+				answered
+			})
 		};
 	});
 	return next === s ? s : {
@@ -3474,7 +3503,13 @@ const setIdentity = (patch) => (s) => ({
 	...s,
 	...patch
 });
-/** Re-home a query after a bucket switch: new store, same hash, fresh sync state. */
+/**
+* Re-home a query after a bucket switch: new store, same hash, fresh sync state.
+* `records` is kept: it is what subscribers were last handed, and the next
+* render diffs against it. Blanking it here (without telling anyone) let a
+* new store that renders `[]` read as unchanged, so the previous principal's
+* rows stayed on screen under an authority flip that vouched for them.
+*/
 const rebindQuery = (hash, next) => (s) => {
 	const rebound = withEntry(s, hash, (e) => ({
 		...e,
@@ -3486,7 +3521,6 @@ const rebindQuery = (hash, next) => (s) => {
 		remoteArray: next.remoteArray,
 		localArray: next.localArray,
 		subqueryRemoteArray: [],
-		records: [],
 		serverState: null,
 		lastHeartbeatAt: null,
 		lastPolledAt: null,
@@ -3719,6 +3753,7 @@ function toQueryState(e) {
 		viewLost: l.phase === "view-lost",
 		serverState: e.serverState,
 		syncNotified: l.notified,
+		answered: l.answered,
 		ttlTimer: null,
 		ttlDurationMs: e.def.ttlMs,
 		lastHeartbeatAt: e.lastHeartbeatAt ?? void 0,
@@ -4810,14 +4845,8 @@ function* applyMembership(hash, remoteArray, meta, verifiedRemoval) {
 		});
 		return outcome;
 	}
-	const wasAuthoritative = isAuthoritative(entry.lifecycle);
 	yield fx.state.update(commitMembership(hash, remoteArray, meta?.present ?? true));
 	yield* forgetDeparted(hash, departedIds(entry.remoteArray, remoteArray));
-	if (!wasAuthoritative) yield fx.emit({
-		type: "query:authority",
-		hash,
-		known: true
-	});
 	const now = yield fx.now();
 	try {
 		yield fx.local.upsert(VIEW_TABLE, viewRecordId(entry.def.viewKey), viewRow(remoteArray, entry.subqueryRemoteArray, true, now), "replace");
@@ -6661,14 +6690,18 @@ const NONE = /* @__PURE__ */ new Set();
 * only writer of `records`. Runs on the `mat:<hash>` dedupe lane whenever the
 * query is dirty. Before the server has answered (`cold`) only bodies some
 * durable view vouches for paint (see `paintsCold`).
+*
+* Also the only place a query becomes answered (see `QueryLifecycle`): the
+* authority flip is emitted here, after the rows it vouches for.
 */
 function* materialize(hash) {
-	const [entry, ov, known] = yield fx.state.read((s) => {
+	const [entry, ov, known, complete] = yield fx.state.read((s) => {
 		const e = s.queries.get(hash);
 		return [
 			e,
 			overlay(s),
-			e?.lifecycle.phase === "cold" ? vouched(s) : NONE
+			e?.lifecycle.phase === "cold" ? vouched(s) : NONE,
+			needed(s, hash).length === 0
 		];
 	});
 	if (!entry) return;
@@ -6708,12 +6741,18 @@ function* materialize(hash) {
 	if (!current) return;
 	const t1 = yield fx.now();
 	const changed = !rowsEqual(rows, current.records);
-	yield fx.state.update(compose(setRecords(hash, rows, changed, t1 - t0), changed ? stampUpdated(hash, t1) : (s) => s));
+	const answered = complete && entry.lifecycle.phase !== "cold" && current.lifecycle.phase !== "cold" && current.remoteArray === entry.remoteArray;
+	yield fx.state.update(compose(setRecords(hash, rows, changed, t1 - t0, answered), changed ? stampUpdated(hash, t1) : (s) => s));
 	if (changed) yield fx.emit({
 		type: "query:records",
 		hash,
 		records: rows
 	});
+	if (answered && !isAnswered(current.lifecycle)) yield fx.emit({
+		type: "query:authority",
+		hash,
+		known: true
+	});
 }
 /**
 * A view update from the in-browser SSP: the query's local id-set moved.
@@ -7196,10 +7235,10 @@ function* rebindQueries() {
 			remoteArray: view?.ids ?? [],
 			localArray
 		}));
-		if (isAuthoritative(entry.lifecycle) !== isAuthoritative(lifecycle)) yield fx.emit({
+		if (isAnswered(entry.lifecycle)) yield fx.emit({
 			type: "query:authority",
 			hash: entry.def.hash,
-			known: isAuthoritative(lifecycle)
+			known: false
 		});
 	}
 }
@@ -7678,7 +7717,7 @@ var Runtime = class {
 		this.authoritySubs.set(hash, set);
 		if (options.immediate) {
 			const entry = this.stateValue.queries.get(hash);
-			if (entry) this.safely(() => cb(isAuthoritative(entry.lifecycle)));
+			if (entry) this.safely(() => cb(isAnswered(entry.lifecycle)));
 		}
 		return () => {
 			set.delete(cb);
@@ -11901,6 +11940,12 @@ var ImpersonationTimers = class {
 //#region src/modules/auth/index.ts
 /** Upper bound on the before-sign-out hooks, so a dead socket never holds a sign-out. */
 const SIGN_OUT_HOOK_TIMEOUT_MS = 2e3;
+/**
+* Floor between two session re-checks started by refused statements. A
+* refused session fails every statement at once, and a check that keeps the
+* session (the server was unreachable) must not be re-run by each of them.
+*/
+const REFUSAL_RECHECK_MIN_MS = 3e4;
 function decodeAccessFromToken(token) {
 	return decodeTokenClaims(token).access;
 }
@@ -11930,6 +11975,11 @@ var AuthService = class {
 	stopping = null;
 	/** A token renewal in flight, which a stop waits out (see `renewImpersonation`). */
 	renewing = null;
+	/** The session re-check in flight (see `watchSession`), shared by every trigger. */
+	reverifying = null;
+	/** When a refused statement last started a re-check. */
+	lastRefusalCheckAt = Number.NEGATIVE_INFINITY;
+	watchingSession = false;
 	impersonationTimers = new ImpersonationTimers({
 		current: () => this.impersonation,
 		renew: () => this.renewImpersonation(),
@@ -11957,6 +12007,54 @@ var AuthService = class {
 	}
 	async init() {
 		await this.check();
+		this.watchSession();
+	}
+	/**
+	* Check the session again whenever the socket comes back, and whenever the
+	* server refuses a statement because of the session.
+	*
+	* The server judges a token only when a socket authenticates: the SDK
+	* replays `authenticate` on its own reconnects, `RemoteDatabaseService` on a
+	* socket it rebuilds. When the replay is refused (the app ended the session,
+	* say with a password reset) the SDK drops to an anonymous session, and the
+	* supervisor swallows the rebuild's error, so the socket reports `connected`
+	* while this service still announces the user. Every view registered from
+	* then on carried no identity: the page looked signed in and showed nothing
+	* of the user's. `check()` applies the token again and signs out when the
+	* server refuses it.
+	*
+	* A socket that never reconnects is ended by the app's session guard
+	* (`fn::sp00ky::session_live`) instead: its heartbeats stop finding rows,
+	* and the re-registration that follows is refused with "There was a problem
+	* with authentication", which starts a check here too.
+	*/
+	watchSession() {
+		if (this.watchingSession) return;
+		this.watchingSession = true;
+		this.remote.subscribeConnection("connected", () => this.reverify());
+		this.remote.getEvents().subscribe(DatabaseEventTypes.RemoteQuery, (event) => {
+			const { success, error } = event.payload;
+			if (success || !isRefusedSessionError(error ?? "")) return;
+			const now = Date.now();
+			if (now - this.lastRefusalCheckAt < REFUSAL_RECHECK_MIN_MS) return;
+			this.lastRefusalCheckAt = now;
+			this.reverify();
+		});
+	}
+	/** One `check()` for every trigger that lands while it runs. */
+	reverify() {
+		if (!this.isAuthenticated || this.reverifying) return;
+		this.reverifying = (async () => {
+			await this.remote.whenConnected();
+			if (this.isAuthenticated) await this.check();
+		})().catch((error) => {
+			this.logger.warn({
+				error,
+				Category: "sp00ky-client::AuthService::reverify"
+			}, "Session re-check failed");
+		}).finally(() => {
+			this.reverifying = null;
+		});
 	}
 	getAccessDefinition(name) {
 		return this.schema.access?.[name];
@@ -15676,7 +15774,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.332",
+			coreVersion: "0.0.1-canary.334",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,
@@ -16796,4 +16894,4 @@ var Sp00kyClient = class {
 };
 
 //#endregion
-export { AppReleaseHandle, AppReleaseModule, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, BucketHandle, CURSOR_COLORS, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, FeatureFlagHandle, FeatureFlagModule, IMPERSONATION_ACCESS, ImpersonationTimers, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, ORIGIN_TOKEN_KEY, PUSH_ENDPOINT_KEY, PUSH_PAYLOAD_VERSION, SESSION_POLL_MS, SIGN_OUT_HOOK_TIMEOUT_MS, Sp00kyClient, WebPushError, WebPushModule, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, detectWebPushSupport, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, isPushPayload, renewDelayMs, sameImpersonation, semverGt, textToHtml };
+export { AppReleaseHandle, AppReleaseModule, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, BucketHandle, CURSOR_COLORS, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, FeatureFlagHandle, FeatureFlagModule, IMPERSONATION_ACCESS, ImpersonationTimers, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, ORIGIN_TOKEN_KEY, PUSH_ENDPOINT_KEY, PUSH_PAYLOAD_VERSION, REFUSAL_RECHECK_MIN_MS, SESSION_POLL_MS, SIGN_OUT_HOOK_TIMEOUT_MS, Sp00kyClient, WebPushError, WebPushModule, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, detectWebPushSupport, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, isPushPayload, renewDelayMs, sameImpersonation, semverGt, textToHtml };

package/dist/types.d.ts

@@ -822,6 +822,12 @@ interface SignOutContext {
 type SignOutHook = (ctx: SignOutContext) => Promise<void> | void;
 /** Upper bound on the before-sign-out hooks, so a dead socket never holds a sign-out. */
 declare const SIGN_OUT_HOOK_TIMEOUT_MS = 2000;
+/**
+ * Floor between two session re-checks started by refused statements. A
+ * refused session fails every statement at once, and a check that keeps the
+ * session (the server was unreachable) must not be re-run by each of them.
+ */
+declare const REFUSAL_RECHECK_MIN_MS = 30000;
 type Prettify<T> = { [K in keyof T]: T[K] } & {};
 type MapColumnType<T extends ColumnSchema> = T['optional'] extends true ? TypeNameToTypeMap[T['type']] | undefined : TypeNameToTypeMap[T['type']];
 type ExtractAccessParams<S extends SchemaStructure, Name extends keyof S['access'], Method extends 'signIn' | 'signup'> = S['access'] extends undefined ? never : S['access'][Name] extends AccessDefinition ? Prettify<{ [K in keyof S['access'][Name][Method]['params']]: MapColumnType<S['access'][Name][Method]['params'][K]> }> : never;
@@ -855,10 +861,37 @@ declare class AuthService<S extends SchemaStructure> {
   private stopping;
   /** A token renewal in flight, which a stop waits out (see `renewImpersonation`). */
   private renewing;
+  /** The session re-check in flight (see `watchSession`), shared by every trigger. */
+  private reverifying;
+  /** When a refused statement last started a re-check. */
+  private lastRefusalCheckAt;
+  private watchingSession;
   private impersonationTimers;
   get eventSystem(): AuthEventSystem;
   constructor(schema: S, remote: RemoteDatabaseService, persistenceClient: PersistenceClient, logger: Logger$1);
   init(): Promise<void>;
+  /**
+   * Check the session again whenever the socket comes back, and whenever the
+   * server refuses a statement because of the session.
+   *
+   * The server judges a token only when a socket authenticates: the SDK
+   * replays `authenticate` on its own reconnects, `RemoteDatabaseService` on a
+   * socket it rebuilds. When the replay is refused (the app ended the session,
+   * say with a password reset) the SDK drops to an anonymous session, and the
+   * supervisor swallows the rebuild's error, so the socket reports `connected`
+   * while this service still announces the user. Every view registered from
+   * then on carried no identity: the page looked signed in and showed nothing
+   * of the user's. `check()` applies the token again and signs out when the
+   * server refuses it.
+   *
+   * A socket that never reconnects is ended by the app's session guard
+   * (`fn::sp00ky::session_live`) instead: its heartbeats stop finding rows,
+   * and the re-registration that follows is refused with "There was a problem
+   * with authentication", which starts a check here too.
+   */
+  private watchSession;
+  /** One `check()` for every trigger that lands while it runs. */
+  private reverify;
   getAccessDefinition<Name extends keyof S['access']>(name: Name): AccessDefinition | undefined;
   /**
    * Subscribe to auth state changes.
@@ -2036,6 +2069,12 @@ interface QueryState {
    * always emits at least once even when its records are unchanged — otherwise
    * an empty re-registered window would never notify and stay "loading". */
   syncNotified?: boolean;
+  /**
+   * Subscribers hold the rows of a known membership (see `QueryLifecycle`'s
+   * `answered`): what the authority channel and the bindings'
+   * `isAuthoritative()` report. Ephemeral.
+   */
+  answered?: boolean;
   /** Timer for TTL expiration. */
   ttlTimer: NodeJS.Timeout | null;
   /** TTL duration in milliseconds. */
@@ -2114,9 +2153,12 @@ interface QueryTimings {
 type QueryUpdateCallback = (records: Record<string, any>[]) => void;
 type QueryStatusCallback = (status: QueryStatus) => void;
 /**
- * Observer for a query's authority flips: `true` once server membership is
- * known for it (registration, poll, durable seed), `false` when it is reset
- * (bucket switch). What the bindings' `isAuthoritative()` mirrors.
+ * Observer for a query's authority flips: `true` once subscribers hold the
+ * rendered rows of a known membership (a server answer whose bodies are
+ * local, or the durable membership of an earlier session), delivered after
+ * the rows that vouch for it; `false` when it is reset (bucket switch). Knowing the set is
+ * not enough: a `cached` re-seed or a just-applied server set has no rows
+ * painted yet. What the bindings' `isAuthoritative()` mirrors.
  */
 type QueryAuthorityCallback = (known: boolean) => void;
 type MutationCallback = (mutations: MutationEvent[]) => void;
@@ -2193,4 +2235,4 @@ interface DebounceOptions {
   flushOnHide?: boolean;
 }
 //#endregion
-export { WebPushModule as $, RegistrationTimings as A, LogTap as At, SyncHealthConfig as B, ORIGIN_TOKEN_KEY as Bt, QueryStatusCallback as C, SignOutContext as Ct, ReconnectConfig as D, AuthEventTypes as Dt, QueryUpdateCallback as E, AuthEventTypeMap as Et, Sp00kyQueryResultPromise as F, EventSystem as Ft, PushDeviceKind as G, renewDelayMs as Gt, TimingPhase as H, TokenClaims as Ht, StorageHealth as I, IMPERSONATION_ACCESS as It, WebPushError as J, WebPushConfig as K, sameImpersonation as Kt, StorageHealthStatus as L, ImpersonationInfo as Lt, ServerViewMeta as M, LocalStore as Mt, Sp00kyConfig as N, SealedQuery as Nt, RecordVersionArray as O, createAuthEventSystem as Ot, Sp00kyQueryResult as P, EventDefinition as Pt, WebPushMessageInput as Q, StoreType as R, ImpersonationTimerHost as Rt, QueryStatus as S, SIGN_OUT_HOOK_TIMEOUT_MS as St, QueryTimings as T, AuthEventSystem as Tt, UpdateOptions as U, decodeTokenClaims as Ut, SyncHealthStatus as V, SESSION_POLL_MS as Vt, PUSH_ENDPOINT_KEY as W, impersonationFromToken as Wt, WebPushInfo as X, WebPushErrorCode as Y, WebPushMessage as Z, QueryAuthorityCallback as _, WebPushClientMessage as _t, InlineRow as a, WebPushUnsupportedReason as at, QueryHash as b, AuthService as bt, MembershipOutcome as c, BridgeSignOutMessage as ct, MutationEventType as d, PushNotification as dt, WebPushSubscribeOptions as et, PersistenceClient as f, PushNotificationAction as ft, PreloadRefresh as g, PushUrgency as gt, PreloadOptions as h, PushPayloadKind as ht, EventSubscriptionOptions as i, WebPushUnsubscribeOptions as it, RunOptions as j, Logger$1 as jt, RecordVersionDiff as k, RemoteDatabaseService as kt, MutationCallback as l, BridgeTokenMessage as lt, PinoTransmit as m, PushPayload as mt, DebounceOptions as n, WebPushSyncOptions as nt, Level$1 as o, WebPushUpdateOptions as ot, PhaseStat as p, PushOp as pt, WebPushDevice as q, EdgeDelta as r, WebPushSyncStatus as rt, MATERIALIZATION_SAMPLE_WINDOW as s, detectWebPushSupport as st, ConnectionState as t, WebPushSupport as tt, MutationEvent as u, PUSH_PAYLOAD_VERSION as ut, QueryConfig as v, isPushPayload as vt, QueryTimeToLive as w, SignOutHook as wt, QueryState as x, ImpersonationCandidate as xt, QueryConfigRecord as y, ActiveImpersonation as yt, SyncHealth as z, ImpersonationTimers as zt };
+export { WebPushModule as $, RegistrationTimings as A, RemoteDatabaseService as At, SyncHealthConfig as B, ImpersonationTimers as Bt, QueryStatusCallback as C, SIGN_OUT_HOOK_TIMEOUT_MS as Ct, ReconnectConfig as D, AuthEventTypeMap as Dt, QueryUpdateCallback as E, AuthEventSystem as Et, Sp00kyQueryResultPromise as F, EventDefinition as Ft, PushDeviceKind as G, impersonationFromToken as Gt, TimingPhase as H, SESSION_POLL_MS as Ht, StorageHealth as I, EventSystem as It, WebPushError as J, WebPushConfig as K, renewDelayMs as Kt, StorageHealthStatus as L, IMPERSONATION_ACCESS as Lt, ServerViewMeta as M, Logger$1 as Mt, Sp00kyConfig as N, LocalStore as Nt, RecordVersionArray as O, AuthEventTypes as Ot, Sp00kyQueryResult as P, SealedQuery as Pt, WebPushMessageInput as Q, StoreType as R, ImpersonationInfo as Rt, QueryStatus as S, REFUSAL_RECHECK_MIN_MS as St, QueryTimings as T, SignOutHook as Tt, UpdateOptions as U, TokenClaims as Ut, SyncHealthStatus as V, ORIGIN_TOKEN_KEY as Vt, PUSH_ENDPOINT_KEY as W, decodeTokenClaims as Wt, WebPushInfo as X, WebPushErrorCode as Y, WebPushMessage as Z, QueryAuthorityCallback as _, WebPushClientMessage as _t, InlineRow as a, WebPushUnsupportedReason as at, QueryHash as b, AuthService as bt, MembershipOutcome as c, BridgeSignOutMessage as ct, MutationEventType as d, PushNotification as dt, WebPushSubscribeOptions as et, PersistenceClient as f, PushNotificationAction as ft, PreloadRefresh as g, PushUrgency as gt, PreloadOptions as h, PushPayloadKind as ht, EventSubscriptionOptions as i, WebPushUnsubscribeOptions as it, RunOptions as j, LogTap as jt, RecordVersionDiff as k, createAuthEventSystem as kt, MutationCallback as l, BridgeTokenMessage as lt, PinoTransmit as m, PushPayload as mt, DebounceOptions as n, WebPushSyncOptions as nt, Level$1 as o, WebPushUpdateOptions as ot, PhaseStat as p, PushOp as pt, WebPushDevice as q, sameImpersonation as qt, EdgeDelta as r, WebPushSyncStatus as rt, MATERIALIZATION_SAMPLE_WINDOW as s, detectWebPushSupport as st, ConnectionState as t, WebPushSupport as tt, MutationEvent as u, PUSH_PAYLOAD_VERSION as ut, QueryConfig as v, isPushPayload as vt, QueryTimeToLive as w, SignOutContext as wt, QueryState as x, ImpersonationCandidate as xt, QueryConfigRecord as y, ActiveImpersonation as yt, SyncHealth as z, ImpersonationTimerHost as zt };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.332",
+  "version": "0.0.1-canary.334",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -75,8 +75,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.332",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.332",
+    "@spooky-sync/query-builder": "0.0.1-canary.334",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.334",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.1.0",
     "@surrealdb/wasm-native": "^3.3.4",

package/src/boot/bucket-switch.saga.test.ts

@@ -158,9 +158,9 @@ describe('dropImpersonatedBucket', () => {
 });
 
 describe('rebindQueries', () => {
-  it('re-seeds from the new store, rebuilds the local view (tolerating failures), emits authority flips', async () => {
+  it('re-seeds from the new store, rebuilds the local view (tolerating failures), withdraws authority it held', async () => {
     const s = R.compose(
-      R.putQuery(buildEntry({ def: { hash: 'a' }, lifecycle: { phase: 'live' } })),
+      R.putQuery(buildEntry({ def: { hash: 'a' }, lifecycle: { phase: 'live', answered: true }, records: [{ id: 't:9' }] })),
       R.putQuery(buildEntry({ def: { hash: 'b' }, lifecycle: { phase: 'cold' } }))
     )({ ...buildState(), sessionId: 's' });
     const out = await runPure(rebindQueries(), {
@@ -177,11 +177,13 @@ describe('rebindQueries', () => {
       },
     });
     expect(out.state.queries.get('a')!.lifecycle.phase).toBe('cold');
-    expect(out.state.queries.get('b')!.lifecycle.phase).toBe('cached');
-    expect(out.emitted.filter((e) => e.type === 'query:authority')).toEqual([
-      { type: 'query:authority', hash: 'a', known: false },
-      { type: 'query:authority', hash: 'b', known: true },
-    ]);
+    expect(out.state.queries.get('b')!.lifecycle).toMatchObject({ phase: 'cached', answered: false });
+    // `b` found a durable view, but its rows are not painted until the
+    // render: announcing "known" here is what let an app read the empty
+    // `records` of a re-seed as "the user has none" and create a duplicate.
+    expect(out.emitted.filter((e) => e.type === 'query:authority')).toEqual([{ type: 'query:authority', hash: 'a', known: false }]);
+    expect(out.state.queries.get('a')!.records).toEqual([{ id: 't:9' }]);
+    expect([...out.state.dirty].sort()).toEqual(['a', 'b']);
     expect(out.emitted.some((e) => e.type === 'log')).toBe(true);
   });
 });

package/src/boot/bucket-switch.saga.ts

@@ -3,7 +3,7 @@ import type { Saga } from '../kernel/saga';
 import type { RegisterResult } from '../kernel/effects';
 import { fx } from '../kernel/effects';
 import type { ClientState, QueryEntry } from '../state/client-state';
-import { seedLifecycle, isAuthoritative } from '../state/lifecycle';
+import { seedLifecycle, isAnswered } from '../state/lifecycle';
 import * as R from '../state/reducers';
 import { ANON_USER_ID, bucketIdForUser } from '../modules/ref-tables';
 import type { SagaEnv } from '../query/env';
@@ -126,8 +126,11 @@ export function* rebindQueries(): Saga<void> {
     }
     const lifecycle = seedLifecycle(isResolvedBefore(view));
     yield fx.state.update(R.rebindQuery(entry.def.hash, { id: new RecordId('_00_query', hash), lifecycle, remoteArray: view?.ids ?? [], localArray }));
-    if (isAuthoritative(entry.lifecycle) !== isAuthoritative(lifecycle)) {
-      yield fx.emit({ type: 'query:authority', hash: entry.def.hash, known: isAuthoritative(lifecycle) });
+    // A re-seed is never answered, not even from a durable view: subscribers
+    // still hold the previous store's rows until `materialize` paints the new
+    // store's, and only that render flips authority back on.
+    if (isAnswered(entry.lifecycle)) {
+      yield fx.emit({ type: 'query:authority', hash: entry.def.hash, known: false });
     }
   }
 }

package/src/client/runtime.test.ts

@@ -6,6 +6,7 @@ import { fx } from '../kernel/effects';
 import type { Saga } from '../kernel/saga';
 import * as R from '../state/reducers';
 import { Runtime } from './runtime';
+import { rebindQueries } from '../boot/bucket-switch.saga';
 
 const env = defaultEnv({ tables: [] } as any, { materializeDebounceMs: 5 });
 const noop = () => {};
@@ -88,6 +89,45 @@ describe('Runtime state hooks', () => {
     expect(seen).toEqual([[{ id: 'thing:1' }]]);
     expect(rt.state.dirty.has('q')).toBe(false);
   });
+  it('the bucket-switch window: a re-seeded query never reads "known and idle" before its rows are painted', async () => {
+    // A sign-in: the query was registered in the anon bucket (cold, nothing
+    // painted), then the switch re-seeds it from the user's durable view.
+    // Before the fix the re-seed announced authority with `records` still
+    // empty, so a binding's `isSettled() && !row` held for a beat and the app
+    // created a row the user already had.
+    const { a, rt } = make(
+      {
+        local: {
+          getById: async () => ({ ids: [['thing:1', 1]], confirmed: true }),
+          select: async (plan: any) => (plan.ids ?? []).map((id: any) => ({ id: `${id.table}:${id.id}` })),
+        },
+      },
+      { ...buildState([buildEntry({ def: { hash: 'q', plan: { table: 'thing' } as any } })]), sessionId: 's' }
+    );
+    // What a binding derives `isSettled()` and `data()` from.
+    let known = false;
+    let idle = false;
+    let rows: unknown[] = [];
+    const verdicts: string[] = [];
+    const look = () => {
+      if (known && idle) verdicts.push(rows.length > 0 ? 'settled with rows' : 'settled empty');
+    };
+    rt.subscribe('q', (r) => ((rows = r), look()), { immediate: true });
+    rt.subscribeAuthority('q', (k) => ((known = k), look()), { immediate: true });
+    rt.subscribeStatus('q', (st) => ((idle = st === 'idle'), look()), { immediate: true });
+
+    await rt.run(rebindQueries());
+    expect(rt.state.queries.get('q')!.lifecycle).toMatchObject({ phase: 'cached', fetchDepth: 0, answered: false });
+    expect(idle).toBe(true);
+    expect(known).toBe(false);
+
+    a.timers.fire('mat:q');
+    await tick();
+    await tick();
+    expect(rows).toEqual([{ id: 'thing:1' }]);
+    expect(known).toBe(true);
+    expect(verdicts).toEqual(['settled with rows']);
+  });
   it('status and authority subscriptions fire on transitions, immediate delivers the current value', async () => {
     const { rt } = make({}, buildState([buildEntry({ def: { hash: 'q' } })]));
     const statuses: string[] = [];

package/src/client/runtime.ts

@@ -7,7 +7,7 @@ import type { Lane, Saga } from '../kernel/saga';
 import { runSaga } from '../kernel/saga';
 import type { ClientState } from '../state/client-state';
 import { emptyState } from '../state/client-state';
-import { isAuthoritative } from '../state/lifecycle';
+import { isAnswered } from '../state/lifecycle';
 import * as R from '../state/reducers';
 import { fetchingQueryCount, pendingMutationCount, queryStatus } from '../state/selectors';
 import type { SagaEnv } from '../query/env';
@@ -274,7 +274,7 @@ export class Runtime {
     this.authoritySubs.set(hash, set);
     if (options.immediate) {
       const entry = this.stateValue.queries.get(hash);
-      if (entry) this.safely(() => cb(isAuthoritative(entry.lifecycle)));
+      if (entry) this.safely(() => cb(isAnswered(entry.lifecycle)));
     }
     return () => {
       set.delete(cb);