@taladb/web 0.7.10 → 0.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taladb/web",
-  "version": "0.7.10",
+  "version": "0.8.0",
   "description": "TalaDB WASM bindings — document queries and vector search in the browser",
   "main": "pkg/taladb_web.js",
   "types": "pkg/taladb_web.d.ts",

package/pkg/package.json

@@ -5,7 +5,7 @@
     "thinkgrid-labs"
   ],
   "description": "TalaDB browser WASM bindings (wasm-bindgen + OPFS) and Cloudflare Workers",
-  "version": "0.7.10",
+  "version": "0.8.0",
   "license": "MIT",
   "files": [
     "taladb_web_bg.wasm",

package/pkg/taladb_web.d.ts

@@ -416,12 +416,12 @@ export interface InitOutput {
     readonly idb_load_snapshot: (a: number, b: number) => any;
     readonly idb_save_snapshot: (a: number, b: number, c: number, d: number) => any;
     readonly opfs_open_backend: (a: number, b: number) => any;
-    readonly wasm_bindgen__closure__destroy__hbd944d59f3b4cf07: (a: number, b: number) => void;
+    readonly wasm_bindgen__closure__destroy__h960c953e41cc5153: (a: number, b: number) => void;
     readonly wasm_bindgen__closure__destroy__h48e8a8f67ee293c6: (a: number, b: number) => void;
     readonly wasm_bindgen__closure__destroy__h8b8dc50e88fa67bc: (a: number, b: number) => void;
     readonly wasm_bindgen__convert__closures_____invoke__hfb64ebab929241fc: (a: number, b: number, c: any) => [number, number];
     readonly wasm_bindgen__convert__closures_____invoke__h31b79bb0cf86afae: (a: number, b: number, c: any, d: any) => void;
-    readonly wasm_bindgen__convert__closures_____invoke__h92535b583e69b17f: (a: number, b: number, c: any) => void;
+    readonly wasm_bindgen__convert__closures_____invoke__hc4897ede22d87615: (a: number, b: number, c: any) => void;
     readonly wasm_bindgen__convert__closures_____invoke__had96e062ebd712a6: (a: number, b: number) => void;
     readonly __wbindgen_malloc: (a: number, b: number) => number;
     readonly __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;

package/pkg/taladb_web.js

@@ -1636,8 +1636,8 @@ function __wbg_get_imports() {
             return ret;
         },
         __wbindgen_cast_0000000000000001: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { dtor_idx: 137, function: Function { arguments: [Externref], shim_idx: 138, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__hbd944d59f3b4cf07, wasm_bindgen__convert__closures_____invoke__h92535b583e69b17f);
+            // Cast intrinsic for `Closure(Closure { dtor_idx: 138, function: Function { arguments: [Externref], shim_idx: 139, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__h960c953e41cc5153, wasm_bindgen__convert__closures_____invoke__hc4897ede22d87615);
             return ret;
         },
         __wbindgen_cast_0000000000000002: function(arg0, arg1) {
@@ -1697,8 +1697,8 @@ function wasm_bindgen__convert__closures_____invoke__had96e062ebd712a6(arg0, arg
     wasm.wasm_bindgen__convert__closures_____invoke__had96e062ebd712a6(arg0, arg1);
 }
 
-function wasm_bindgen__convert__closures_____invoke__h92535b583e69b17f(arg0, arg1, arg2) {
-    wasm.wasm_bindgen__convert__closures_____invoke__h92535b583e69b17f(arg0, arg1, arg2);
+function wasm_bindgen__convert__closures_____invoke__hc4897ede22d87615(arg0, arg1, arg2) {
+    wasm.wasm_bindgen__convert__closures_____invoke__hc4897ede22d87615(arg0, arg1, arg2);
 }
 
 function wasm_bindgen__convert__closures_____invoke__hfb64ebab929241fc(arg0, arg1, arg2) {

package/pkg/taladb_web_bg.wasm.d.ts

@@ -60,12 +60,12 @@ export const opfs_load_snapshot: (a: number, b: number) => any;
 export const idb_load_snapshot: (a: number, b: number) => any;
 export const idb_save_snapshot: (a: number, b: number, c: number, d: number) => any;
 export const opfs_open_backend: (a: number, b: number) => any;
-export const wasm_bindgen__closure__destroy__hbd944d59f3b4cf07: (a: number, b: number) => void;
+export const wasm_bindgen__closure__destroy__h960c953e41cc5153: (a: number, b: number) => void;
 export const wasm_bindgen__closure__destroy__h48e8a8f67ee293c6: (a: number, b: number) => void;
 export const wasm_bindgen__closure__destroy__h8b8dc50e88fa67bc: (a: number, b: number) => void;
 export const wasm_bindgen__convert__closures_____invoke__hfb64ebab929241fc: (a: number, b: number, c: any) => [number, number];
 export const wasm_bindgen__convert__closures_____invoke__h31b79bb0cf86afae: (a: number, b: number, c: any, d: any) => void;
-export const wasm_bindgen__convert__closures_____invoke__h92535b583e69b17f: (a: number, b: number, c: any) => void;
+export const wasm_bindgen__convert__closures_____invoke__hc4897ede22d87615: (a: number, b: number, c: any) => void;
 export const wasm_bindgen__convert__closures_____invoke__had96e062ebd712a6: (a: number, b: number) => void;
 export const __wbindgen_malloc: (a: number, b: number) => number;
 export const __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;

package/worker/taladb.worker.js

@@ -124,6 +124,22 @@ const isDev = typeof location !== 'undefined' && (location.hostname === 'localho
 const log = isDev ? console.log.bind(console, '[TalaDB Worker]') : () => {};
 const warn = isDev ? console.warn.bind(console, '[TalaDB Worker]') : () => {};
 
+/**
+ * Origin of the page that spawned this DedicatedWorker. Messages from any
+ * other origin are silently dropped. Null only in edge environments where
+ * `location` is unavailable, in which case the check is skipped.
+ */
+const WORKER_ORIGIN = typeof location !== 'undefined' ? location.origin : null;
+
+/**
+ * Per-worker-instance random token. Included in every `taladb:secondary-write`
+ * BroadcastChannel message so the primary tab can reject unauthenticated
+ * injections that omit a token.
+ */
+const SESSION_TOKEN = (typeof self.crypto !== 'undefined' && typeof self.crypto.randomUUID === 'function')
+  ? self.crypto.randomUUID()
+  : Array.from(self.crypto.getRandomValues(new Uint8Array(16)), b => b.toString(16).padStart(2, '0')).join('');
+
 /**
  * Resolving this releases the Web Lock and closes the sync handle.
  * Set inside doInit; called by the 'close' op or when the worker terminates.
@@ -288,7 +304,7 @@ function pushChangesetToPrimary() {
     const parsed = JSON.parse(changeset);
     if (parsed.length === 0) return;
     lastSecondaryPushMs = Date.now();
-    broadcastChannel.postMessage({ type: 'taladb:secondary-write', changeset });
+    broadcastChannel.postMessage({ type: 'taladb:secondary-write', token: SESSION_TOKEN, changeset });
     log(`Broadcast ${parsed.length} change(s) to primary tab`);
   } catch (err) {
     warn('Failed to export changeset for primary tab:', err);
@@ -314,6 +330,12 @@ function onWriteCommitted() {
 // ---------------------------------------------------------------------------
 
 self.onmessage = async (e) => {
+  // Reject messages from unexpected origins. In a DedicatedWorker only the
+  // creating page can post messages (browser-enforced), but this guard is a
+  // defence-in-depth measure in case the worker is ever repurposed.
+  if (WORKER_ORIGIN && e.origin && e.origin !== WORKER_ORIGIN) {
+    return;
+  }
   const { id, op, ...args } = e.data;
   try {
     const result = await dispatch(op, args);
@@ -531,8 +553,11 @@ async function doInit(dbName, configJson) {
         const resolve = pendingSnapshotResolve;
         pendingSnapshotResolve = null;
         resolve();
-      } else if (e.data?.type === 'taladb:secondary-write' && !idbFallback && db) {
+      } else if (e.data?.type === 'taladb:secondary-write' && typeof e.data.token === 'string' && e.data.token.length > 0 && !idbFallback && db) {
         // Primary (OPFS) tab: a secondary tab made a write — merge it in via LWW.
+        // The token requirement rejects unauthenticated injection attempts that
+        // omit the SESSION_TOKEN field (not a guarantee against same-origin attackers
+        // who observe the token, but defence-in-depth against naive injection).
         try {
           const applied = db.importChangeset(e.data.changeset);
           if (applied > 0) {