@taladb/web 0.7.10 → 0.8.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taladb/web",
-  "version": "0.7.10",
+  "version": "0.8.2",
   "description": "TalaDB WASM bindings — document queries and vector search in the browser",
   "main": "pkg/taladb_web.js",
   "types": "pkg/taladb_web.d.ts",

package/pkg/package.json

@@ -5,7 +5,7 @@
     "thinkgrid-labs"
   ],
   "description": "TalaDB browser WASM bindings (wasm-bindgen + OPFS) and Cloudflare Workers",
-  "version": "0.7.10",
+  "version": "0.8.2",
   "license": "MIT",
   "files": [
     "taladb_web_bg.wasm",

package/pkg/taladb_web.d.ts

@@ -416,13 +416,13 @@ export interface InitOutput {
     readonly idb_load_snapshot: (a: number, b: number) => any;
     readonly idb_save_snapshot: (a: number, b: number, c: number, d: number) => any;
     readonly opfs_open_backend: (a: number, b: number) => any;
-    readonly wasm_bindgen__closure__destroy__hbd944d59f3b4cf07: (a: number, b: number) => void;
-    readonly wasm_bindgen__closure__destroy__h48e8a8f67ee293c6: (a: number, b: number) => void;
-    readonly wasm_bindgen__closure__destroy__h8b8dc50e88fa67bc: (a: number, b: number) => void;
-    readonly wasm_bindgen__convert__closures_____invoke__hfb64ebab929241fc: (a: number, b: number, c: any) => [number, number];
-    readonly wasm_bindgen__convert__closures_____invoke__h31b79bb0cf86afae: (a: number, b: number, c: any, d: any) => void;
-    readonly wasm_bindgen__convert__closures_____invoke__h92535b583e69b17f: (a: number, b: number, c: any) => void;
-    readonly wasm_bindgen__convert__closures_____invoke__had96e062ebd712a6: (a: number, b: number) => void;
+    readonly wasm_bindgen__closure__destroy__h019ad81c65a5ac2e: (a: number, b: number) => void;
+    readonly wasm_bindgen__closure__destroy__h53c506fd33a34156: (a: number, b: number) => void;
+    readonly wasm_bindgen__closure__destroy__h60a9a75571791338: (a: number, b: number) => void;
+    readonly wasm_bindgen__convert__closures_____invoke__hc8d470a46e185f12: (a: number, b: number, c: any) => [number, number];
+    readonly wasm_bindgen__convert__closures_____invoke__h19185396894e5dfb: (a: number, b: number, c: any, d: any) => void;
+    readonly wasm_bindgen__convert__closures_____invoke__h48d87b3a361fad65: (a: number, b: number, c: any) => void;
+    readonly wasm_bindgen__convert__closures_____invoke__h88d126a9c69f3dfa: (a: number, b: number) => void;
     readonly __wbindgen_malloc: (a: number, b: number) => number;
     readonly __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
     readonly __wbindgen_exn_store: (a: number) => void;

package/pkg/taladb_web.js

@@ -1453,7 +1453,7 @@ function __wbg_get_imports() {
                     const a = state0.a;
                     state0.a = 0;
                     try {
-                        return wasm_bindgen__convert__closures_____invoke__h31b79bb0cf86afae(a, state0.b, arg0, arg1);
+                        return wasm_bindgen__convert__closures_____invoke__h19185396894e5dfb(a, state0.b, arg0, arg1);
                     } finally {
                         state0.a = a;
                     }
@@ -1475,7 +1475,7 @@ function __wbg_get_imports() {
                     const a = state0.a;
                     state0.a = 0;
                     try {
-                        return wasm_bindgen__convert__closures_____invoke__h31b79bb0cf86afae(a, state0.b, arg0, arg1);
+                        return wasm_bindgen__convert__closures_____invoke__h19185396894e5dfb(a, state0.b, arg0, arg1);
                     } finally {
                         state0.a = a;
                     }
@@ -1636,18 +1636,18 @@ function __wbg_get_imports() {
             return ret;
         },
         __wbindgen_cast_0000000000000001: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { dtor_idx: 137, function: Function { arguments: [Externref], shim_idx: 138, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__hbd944d59f3b4cf07, wasm_bindgen__convert__closures_____invoke__h92535b583e69b17f);
+            // Cast intrinsic for `Closure(Closure { dtor_idx: 197, function: Function { arguments: [], shim_idx: 198, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__h019ad81c65a5ac2e, wasm_bindgen__convert__closures_____invoke__h88d126a9c69f3dfa);
             return ret;
         },
         __wbindgen_cast_0000000000000002: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { dtor_idx: 187, function: Function { arguments: [], shim_idx: 188, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__h48e8a8f67ee293c6, wasm_bindgen__convert__closures_____invoke__had96e062ebd712a6);
+            // Cast intrinsic for `Closure(Closure { dtor_idx: 633, function: Function { arguments: [Externref], shim_idx: 634, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__h53c506fd33a34156, wasm_bindgen__convert__closures_____invoke__hc8d470a46e185f12);
             return ret;
         },
         __wbindgen_cast_0000000000000003: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { dtor_idx: 629, function: Function { arguments: [Externref], shim_idx: 630, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__h8b8dc50e88fa67bc, wasm_bindgen__convert__closures_____invoke__hfb64ebab929241fc);
+            // Cast intrinsic for `Closure(Closure { dtor_idx: 89, function: Function { arguments: [Externref], shim_idx: 90, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm.wasm_bindgen__closure__destroy__h60a9a75571791338, wasm_bindgen__convert__closures_____invoke__h48d87b3a361fad65);
             return ret;
         },
         __wbindgen_cast_0000000000000004: function(arg0) {
@@ -1693,23 +1693,23 @@ function __wbg_get_imports() {
     };
 }
 
-function wasm_bindgen__convert__closures_____invoke__had96e062ebd712a6(arg0, arg1) {
-    wasm.wasm_bindgen__convert__closures_____invoke__had96e062ebd712a6(arg0, arg1);
+function wasm_bindgen__convert__closures_____invoke__h88d126a9c69f3dfa(arg0, arg1) {
+    wasm.wasm_bindgen__convert__closures_____invoke__h88d126a9c69f3dfa(arg0, arg1);
 }
 
-function wasm_bindgen__convert__closures_____invoke__h92535b583e69b17f(arg0, arg1, arg2) {
-    wasm.wasm_bindgen__convert__closures_____invoke__h92535b583e69b17f(arg0, arg1, arg2);
+function wasm_bindgen__convert__closures_____invoke__h48d87b3a361fad65(arg0, arg1, arg2) {
+    wasm.wasm_bindgen__convert__closures_____invoke__h48d87b3a361fad65(arg0, arg1, arg2);
 }
 
-function wasm_bindgen__convert__closures_____invoke__hfb64ebab929241fc(arg0, arg1, arg2) {
-    const ret = wasm.wasm_bindgen__convert__closures_____invoke__hfb64ebab929241fc(arg0, arg1, arg2);
+function wasm_bindgen__convert__closures_____invoke__hc8d470a46e185f12(arg0, arg1, arg2) {
+    const ret = wasm.wasm_bindgen__convert__closures_____invoke__hc8d470a46e185f12(arg0, arg1, arg2);
     if (ret[1]) {
         throw takeFromExternrefTable0(ret[0]);
     }
 }
 
-function wasm_bindgen__convert__closures_____invoke__h31b79bb0cf86afae(arg0, arg1, arg2, arg3) {
-    wasm.wasm_bindgen__convert__closures_____invoke__h31b79bb0cf86afae(arg0, arg1, arg2, arg3);
+function wasm_bindgen__convert__closures_____invoke__h19185396894e5dfb(arg0, arg1, arg2, arg3) {
+    wasm.wasm_bindgen__convert__closures_____invoke__h19185396894e5dfb(arg0, arg1, arg2, arg3);
 }
 
 

package/pkg/taladb_web_bg.wasm.d.ts

@@ -60,13 +60,13 @@ export const opfs_load_snapshot: (a: number, b: number) => any;
 export const idb_load_snapshot: (a: number, b: number) => any;
 export const idb_save_snapshot: (a: number, b: number, c: number, d: number) => any;
 export const opfs_open_backend: (a: number, b: number) => any;
-export const wasm_bindgen__closure__destroy__hbd944d59f3b4cf07: (a: number, b: number) => void;
-export const wasm_bindgen__closure__destroy__h48e8a8f67ee293c6: (a: number, b: number) => void;
-export const wasm_bindgen__closure__destroy__h8b8dc50e88fa67bc: (a: number, b: number) => void;
-export const wasm_bindgen__convert__closures_____invoke__hfb64ebab929241fc: (a: number, b: number, c: any) => [number, number];
-export const wasm_bindgen__convert__closures_____invoke__h31b79bb0cf86afae: (a: number, b: number, c: any, d: any) => void;
-export const wasm_bindgen__convert__closures_____invoke__h92535b583e69b17f: (a: number, b: number, c: any) => void;
-export const wasm_bindgen__convert__closures_____invoke__had96e062ebd712a6: (a: number, b: number) => void;
+export const wasm_bindgen__closure__destroy__h019ad81c65a5ac2e: (a: number, b: number) => void;
+export const wasm_bindgen__closure__destroy__h53c506fd33a34156: (a: number, b: number) => void;
+export const wasm_bindgen__closure__destroy__h60a9a75571791338: (a: number, b: number) => void;
+export const wasm_bindgen__convert__closures_____invoke__hc8d470a46e185f12: (a: number, b: number, c: any) => [number, number];
+export const wasm_bindgen__convert__closures_____invoke__h19185396894e5dfb: (a: number, b: number, c: any, d: any) => void;
+export const wasm_bindgen__convert__closures_____invoke__h48d87b3a361fad65: (a: number, b: number, c: any) => void;
+export const wasm_bindgen__convert__closures_____invoke__h88d126a9c69f3dfa: (a: number, b: number) => void;
 export const __wbindgen_malloc: (a: number, b: number) => number;
 export const __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
 export const __wbindgen_exn_store: (a: number) => void;

package/worker/taladb.worker.js

@@ -124,6 +124,22 @@ const isDev = typeof location !== 'undefined' && (location.hostname === 'localho
 const log = isDev ? console.log.bind(console, '[TalaDB Worker]') : () => {};
 const warn = isDev ? console.warn.bind(console, '[TalaDB Worker]') : () => {};
 
+/**
+ * Origin of the page that spawned this DedicatedWorker. Messages from any
+ * other origin are silently dropped. Null only in edge environments where
+ * `location` is unavailable, in which case the check is skipped.
+ */
+const WORKER_ORIGIN = typeof location !== 'undefined' ? location.origin : null;
+
+/**
+ * Per-worker-instance random token. Included in every `taladb:secondary-write`
+ * BroadcastChannel message so the primary tab can reject unauthenticated
+ * injections that omit a token.
+ */
+const SESSION_TOKEN = (typeof self.crypto !== 'undefined' && typeof self.crypto.randomUUID === 'function')
+  ? self.crypto.randomUUID()
+  : Array.from(self.crypto.getRandomValues(new Uint8Array(16)), b => b.toString(16).padStart(2, '0')).join('');
+
 /**
  * Resolving this releases the Web Lock and closes the sync handle.
  * Set inside doInit; called by the 'close' op or when the worker terminates.
@@ -288,7 +304,7 @@ function pushChangesetToPrimary() {
     const parsed = JSON.parse(changeset);
     if (parsed.length === 0) return;
     lastSecondaryPushMs = Date.now();
-    broadcastChannel.postMessage({ type: 'taladb:secondary-write', changeset });
+    broadcastChannel.postMessage({ type: 'taladb:secondary-write', token: SESSION_TOKEN, changeset });
     log(`Broadcast ${parsed.length} change(s) to primary tab`);
   } catch (err) {
     warn('Failed to export changeset for primary tab:', err);
@@ -314,6 +330,12 @@ function onWriteCommitted() {
 // ---------------------------------------------------------------------------
 
 self.onmessage = async (e) => {
+  // Reject messages from unexpected origins. In a DedicatedWorker only the
+  // creating page can post messages (browser-enforced), but this guard is a
+  // defence-in-depth measure in case the worker is ever repurposed.
+  if (WORKER_ORIGIN && e.origin && e.origin !== WORKER_ORIGIN) {
+    return;
+  }
   const { id, op, ...args } = e.data;
   try {
     const result = await dispatch(op, args);
@@ -531,8 +553,11 @@ async function doInit(dbName, configJson) {
         const resolve = pendingSnapshotResolve;
         pendingSnapshotResolve = null;
         resolve();
-      } else if (e.data?.type === 'taladb:secondary-write' && !idbFallback && db) {
+      } else if (e.data?.type === 'taladb:secondary-write' && typeof e.data.token === 'string' && e.data.token.length > 0 && !idbFallback && db) {
         // Primary (OPFS) tab: a secondary tab made a write — merge it in via LWW.
+        // The token requirement rejects unauthenticated injection attempts that
+        // omit the SESSION_TOKEN field (not a guarantee against same-origin attackers
+        // who observe the token, but defence-in-depth against naive injection).
         try {
           const applied = db.importChangeset(e.data.changeset);
           if (applied > 0) {