@tldraw/sync-core 5.3.0-canary.fceaae5e9feb → 5.3.0-internal.d205573d66cb

package/src/lib/TLSocketRoom.ts

@@ -3,7 +3,7 @@ import { createTLSchema, TLInstancePresence, TLStoreSnapshot } from '@tldraw/tls
 import { getOwnProperty, hasOwnProperty, isEqual, structuredClone } from '@tldraw/utils'
 import { JsonChunkAssembler } from './chunk'
 import { DEFAULT_INITIAL_SNAPSHOT, InMemorySyncStorage } from './InMemorySyncStorage'
-import { TLSocketServerSentEvent } from './protocol'
+import { TLObjectStoreAccess, TLSocketServerSentEvent } from './protocol'
 import { RoomSessionState } from './RoomSession'
 import { ServerSocketAdapter, WebSocketMinimal } from './ServerSocketAdapter'
 import { TLSyncErrorCloseEventReason } from './TLSyncClient'
@@ -11,6 +11,7 @@ import { RoomSnapshot, TLSyncRoom } from './TLSyncRoom'
 import {
 	convertStoreSnapshotToRoomSnapshot,
 	loadSnapshotIntoStorage,
+	TLSyncForwardDiff,
 	TLSyncStorage,
 } from './TLSyncStorage'
 
@@ -71,6 +72,11 @@ export interface TLSyncLog {
 export interface SessionStateSnapshot {
 	serializedSchema: SerializedSchema
 	isReadonly: boolean
+	/**
+	 * Write access for the record types listed in `objectTypes`. Optional so snapshots persisted
+	 * before this field existed resume cleanly (they fail closed to 'read').
+	 */
+	objectAccess?: TLObjectStoreAccess
 	presenceId: string | null
 	presenceRecord: UnknownRecord | null
 	requiresLegacyRejection: boolean
@@ -120,6 +126,24 @@ export interface TLSocketRoomOptions<R extends UnknownRecord, SessionMeta> {
 	}) => void
 	/** @internal */
 	onPresenceChange?(): void
+	/**
+	 * Called once after a client push commits, with the committed document diff. Use to react to
+	 * document changes as soon as they commit — e.g. project certain record types to an external
+	 * store. Best-effort: do not throw and do not block.
+	 *
+	 * Only fires for client pushes. Server-initiated changes — `updateStore`, `loadSnapshot`, or
+	 * writing to the storage directly — do not trigger it, so anything mirroring room state through
+	 * this callback must handle those paths itself.
+	 */
+	// eslint-disable-next-line tldraw/method-signature-style
+	onCommittedChanges?: (args: { diff: TLSyncForwardDiff<R>; documentClock: number }) => void
+	/**
+	 * Record type names to serve through the object-store lane instead of the document lane.
+	 * Each must be a document-scoped type registered in the schema. Object-lane writes are gated
+	 * per session by `objectAccess` (see {@link TLSocketRoom.handleSocketConnect}) rather than
+	 * `isReadonly`, so e.g. a session can be allowed to comment without being allowed to edit.
+	 */
+	objectTypes?: readonly string[]
 	/**
 	 * When set, the room will call {@link TLSocketRoom.getSessionSnapshot} after
 	 * no message activity for a session for 5s and pass the result to this callback.
@@ -230,6 +254,8 @@ export class TLSocketRoom<R extends UnknownRecord = UnknownRecord, SessionMeta =
 						// eslint-disable-next-line @typescript-eslint/no-deprecated
 						opts.initialSnapshot ?? DEFAULT_INITIAL_SNAPSHOT
 					),
+					// keep the storage partition in step with the room's object lane
+					objectTypes: opts.objectTypes,
 				})
 
 		// eslint-disable-next-line @typescript-eslint/no-deprecated
@@ -243,6 +269,8 @@ export class TLSocketRoom<R extends UnknownRecord = UnknownRecord, SessionMeta =
 		}
 		this.room = new TLSyncRoom<R, SessionMeta>({
 			onPresenceChange: opts.onPresenceChange,
+			onCommittedChanges: opts.onCommittedChanges,
+			objectTypes: opts.objectTypes,
 			schema: opts.schema ?? (createTLSchema() as any),
 			log: opts.log,
 			storage,
@@ -283,6 +311,9 @@ export class TLSocketRoom<R extends UnknownRecord = UnknownRecord, SessionMeta =
 	 *   - sessionId - Unique identifier for the client session (typically from browser tab)
 	 *   - socket - WebSocket-like object for client communication
 	 *   - isReadonly - Whether the client can modify the document (defaults to false)
+	 *   - objectAccess - Write access for object-store lane record types (defaults to 'write').
+	 *     Independent of isReadonly, so a session can be allowed to write objects (e.g. comments)
+	 *     without being allowed to edit the document.
 	 *   - meta - Additional session metadata (required if SessionMeta is not void)
 	 *
 	 * @example
@@ -310,9 +341,10 @@ export class TLSocketRoom<R extends UnknownRecord = UnknownRecord, SessionMeta =
 			sessionId: string
 			socket: WebSocketMinimal
 			isReadonly?: boolean
+			objectAccess?: TLObjectStoreAccess
 		} & (SessionMeta extends void ? object : { meta: SessionMeta })
 	) {
-		const { sessionId, socket, isReadonly = false } = opts
+		const { sessionId, socket, isReadonly = false, objectAccess = 'write' } = opts
 		const handleSocketMessage = (event: MessageEvent) =>
 			this.handleSocketMessage(sessionId, event.data)
 		const handleSocketError = this.handleSocketError.bind(this, sessionId)
@@ -331,6 +363,7 @@ export class TLSocketRoom<R extends UnknownRecord = UnknownRecord, SessionMeta =
 		this.room.handleNewSession({
 			sessionId,
 			isReadonly,
+			objectAccess,
 			socket: new ServerSocketAdapter({
 				ws: socket,
 				onBeforeSendMessage: this.opts.onBeforeSendMessage
@@ -540,6 +573,9 @@ export class TLSocketRoom<R extends UnknownRecord = UnknownRecord, SessionMeta =
 		this.room.handleResumedSession({
 			sessionId,
 			isReadonly: snapshot.isReadonly,
+			// snapshots persisted before this field existed fail closed — those sessions predate
+			// the record types gated by objectAccess, so they have nothing to write anyway
+			objectAccess: snapshot.objectAccess ?? 'read',
 			serializedSchema: snapshot.serializedSchema,
 			presenceId: snapshot.presenceId,
 			presenceRecord: snapshot.presenceRecord,
@@ -595,6 +631,7 @@ export class TLSocketRoom<R extends UnknownRecord = UnknownRecord, SessionMeta =
 		return {
 			serializedSchema: session.serializedSchema,
 			isReadonly: session.isReadonly,
+			objectAccess: session.objectAccess,
 			presenceId: session.presenceId,
 			presenceRecord,
 			requiresLegacyRejection: session.requiresLegacyRejection,
@@ -670,6 +707,7 @@ export class TLSocketRoom<R extends UnknownRecord = UnknownRecord, SessionMeta =
 		sessionId: string
 		isConnected: boolean
 		isReadonly: boolean
+		objectAccess: TLObjectStoreAccess
 		meta: SessionMeta
 	}> {
 		return [...this.room.sessions.values()].map((session) => {
@@ -677,6 +715,7 @@ export class TLSocketRoom<R extends UnknownRecord = UnknownRecord, SessionMeta =
 				sessionId: session.sessionId,
 				isConnected: session.state === RoomSessionState.Connected,
 				isReadonly: session.isReadonly,
+				objectAccess: session.objectAccess,
 				meta: session.meta,
 			}
 		})
@@ -708,6 +747,18 @@ export class TLSocketRoom<R extends UnknownRecord = UnknownRecord, SessionMeta =
 		throw new Error('getCurrentSnapshot is not supported for this storage type')
 	}
 
+	/**
+	 * Returns a snapshot of the object-store lane (see `objectTypes`), for persisting
+	 * object-lane records separately from the document. Same entry shape as
+	 * {@link RoomSnapshot.documents}.
+	 */
+	getCurrentObjectsSnapshot(): RoomSnapshot['documents'] {
+		if (this.storage.getObjectsSnapshot) {
+			return this.storage.getObjectsSnapshot()
+		}
+		throw new Error('getCurrentObjectsSnapshot is not supported for this storage type')
+	}
+
 	/**
 	 * Retrieves all presence records from the document store. Presence records
 	 * contain ephemeral user state like cursor positions and selections.

package/src/lib/TLSyncClient.test.ts

@@ -476,13 +476,20 @@ describe('TLSyncClient', () => {
 			client = createClient()
 			socket.mockServerMessage(createConnectMessage({ isReadonly: false }))
 			expect(client.isConnectedToRoom).toBe(true)
-			expect(onAfterConnect).toHaveBeenCalledWith(client, { isReadonly: false })
+			// objectAccess defaults to 'write' when the server doesn't send it
+			expect(onAfterConnect).toHaveBeenCalledWith(client, {
+				isReadonly: false,
+				objectAccess: 'write',
+			})
 
 			// reconnect as readonly
 			socket.mockConnectionStatus('offline')
 			socket.mockConnectionStatus('online')
 			socket.mockServerMessage(createConnectMessage({ isReadonly: true }))
-			expect(onAfterConnect).toHaveBeenLastCalledWith(client, { isReadonly: true })
+			expect(onAfterConnect).toHaveBeenLastCalledWith(client, {
+				isReadonly: true,
+				objectAccess: 'write',
+			})
 		})
 
 		it('[CL7] pushes the current presence state after connecting', () => {

package/src/lib/TLSyncClient.ts

@@ -24,6 +24,7 @@ import {
 } from './diff'
 import { interval } from './interval'
 import {
+	TLObjectStoreAccess,
 	TLPushRequest,
 	TLSocketClientSentEvent,
 	TLSocketServerSentDataEvent,
@@ -437,8 +438,13 @@ export class TLSyncClient<R extends UnknownRecord, S extends Store<R> = Store<R>
 	 * @param self - The TLSyncClient instance that connected
 	 * @param details - Connection details
 	 *   - isReadonly - Whether the connection is in read-only mode
+	 *   - objectAccess - Write access for object-store lane record types (defaults to 'write'
+	 *     when the server doesn't send it, e.g. older servers or rooms with no object lane)
 	 */
-	private readonly onAfterConnect?: (self: this, details: { isReadonly: boolean }) => void
+	private readonly onAfterConnect?: (
+		self: this,
+		details: { isReadonly: boolean; objectAccess: TLObjectStoreAccess }
+	) => void
 
 	private readonly onCustomMessageReceived?: TLCustomMessageHandler
 
@@ -478,7 +484,10 @@ export class TLSyncClient<R extends UnknownRecord, S extends Store<R> = Store<R>
 		onLoad(self: TLSyncClient<R, S>): void
 		onSyncError(reason: string): void
 		onCustomMessageReceived?: TLCustomMessageHandler
-		onAfterConnect?(self: TLSyncClient<R, S>, details: { isReadonly: boolean }): void
+		onAfterConnect?(
+			self: TLSyncClient<R, S>,
+			details: { isReadonly: boolean; objectAccess: TLObjectStoreAccess }
+		): void
 		didCancel?(): boolean
 	}) {
 		this.didCancel = config.didCancel
@@ -757,7 +766,10 @@ export class TLSyncClient<R extends UnknownRecord, S extends Store<R> = Store<R>
 			// this.isConnectedToRoom = true
 			// this.store.applyDiff(stashedChanges, false)
 
-			this.onAfterConnect?.(this, { isReadonly: event.isReadonly })
+			this.onAfterConnect?.(this, {
+				isReadonly: event.isReadonly,
+				objectAccess: event.objectAccess ?? 'write',
+			})
 			const presence = this.presenceState?.get()
 			if (presence) {
 				this.pushPresence(presence)

package/src/lib/TLSyncRoom.ts

@@ -31,6 +31,7 @@ import { interval } from './interval'
 import {
 	getTlsyncProtocolVersion,
 	TLIncompatibilityReason,
+	TLObjectStoreAccess,
 	TLSocketClientSentEvent,
 	TLSocketServerSentDataEvent,
 	TLSocketServerSentEvent,
@@ -236,22 +237,43 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 	readonly serializedSchema: SerializedSchema
 
 	readonly documentTypes: Set<string>
+	/**
+	 * Record types served by the object-store lane. Object records ride the same wire messages
+	 * as document records but are gated by the session's `objectAccess` instead of `isReadonly`,
+	 * and are excluded from `documentTypes` so hosts can persist them in a separate lane.
+	 */
+	readonly objectTypes: Set<string>
 	readonly presenceType: RecordType<R, any> | null
 	private log?: TLSyncLog
 	public readonly schema: StoreSchema<R, any>
 	private onPresenceChange?(): void
+	private onCommittedChanges?(args: { diff: TLSyncForwardDiff<R>; documentClock: number }): void
 	private readonly sessionIdleTimeout: number
 
 	constructor(opts: {
 		log?: TLSyncLog
 		schema: StoreSchema<R, any>
 		onPresenceChange?(): void
+		/**
+		 * Called once after a client push commits, with the committed document diff. Fires for
+		 * local and remote pushes. Use this to react to document changes (e.g. persist certain
+		 * record types to a separate lane, or project them to an external store) as soon as they
+		 * commit. Best-effort — do not throw; do not block.
+		 */
+		onCommittedChanges?(args: { diff: TLSyncForwardDiff<R>; documentClock: number }): void
+		/**
+		 * Record type names to serve through the object-store lane instead of the document lane.
+		 * Each must be a document-scoped type registered in the schema. Object-lane writes are
+		 * gated per session by `objectAccess` rather than `isReadonly`.
+		 */
+		objectTypes?: readonly string[]
 		storage: TLSyncStorage<R>
 		clientTimeout?: number
 	}) {
 		this.schema = opts.schema
 		this.log = opts.log
 		this.onPresenceChange = opts.onPresenceChange
+		this.onCommittedChanges = opts.onCommittedChanges
 		this.storage = opts.storage
 		this.sessionIdleTimeout = opts.clientTimeout ?? SESSION_IDLE_TIMEOUT
 
@@ -264,9 +286,20 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 		// do a json serialization cycle to make sure the schema has no 'undefined' values
 		this.serializedSchema = JSON.parse(JSON.stringify(this.schema.serialize()))
 
+		this.objectTypes = new Set(opts.objectTypes ?? [])
+		for (const typeName of this.objectTypes) {
+			const type = getOwnProperty(this.schema.types, typeName)
+			assert(type, `TLSyncRoom: object type '${typeName}' is not registered in the schema`)
+			assert(
+				type.scope === 'document',
+				`TLSyncRoom: object type '${typeName}' must have scope 'document', got '${type.scope}'`
+			)
+		}
+
+		// object-lane types are partitioned out of the document lane
 		this.documentTypes = new Set(
 			Object.values<RecordType<R, any>>(this.schema.types)
-				.filter((t) => t.scope === 'document')
+				.filter((t) => t.scope === 'document' && !this.objectTypes.has(t.typeName))
 				.map((t) => t.typeName)
 		)
 
@@ -442,6 +475,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 			cancellationTime: Date.now(),
 			meta: session.meta,
 			isReadonly: session.isReadonly,
+			objectAccess: session.objectAccess,
 			requiresLegacyRejection: session.requiresLegacyRejection,
 			supportsStringAppend: session.supportsStringAppend,
 		})
@@ -552,8 +586,9 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 		socket: TLRoomSocket<R>
 		meta: SessionMeta
 		isReadonly: boolean
+		objectAccess?: TLObjectStoreAccess
 	}) {
-		const { sessionId, socket, meta, isReadonly } = opts
+		const { sessionId, socket, meta, isReadonly, objectAccess } = opts
 		const existing = this.sessions.get(sessionId)
 		this.sessions.set(sessionId, {
 			state: RoomSessionState.AwaitingConnectMessage,
@@ -563,6 +598,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 			sessionStartTime: Date.now(),
 			meta,
 			isReadonly: isReadonly ?? false,
+			objectAccess: objectAccess ?? 'write',
 			// this gets set later during handleConnectMessage
 			requiresLegacyRejection: false,
 			supportsStringAppend: true,
@@ -582,6 +618,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 		socket: TLRoomSocket<R>
 		meta: SessionMeta
 		isReadonly: boolean
+		objectAccess?: TLObjectStoreAccess
 		serializedSchema: SerializedSchema
 		presenceId: string | null
 		presenceRecord: UnknownRecord | null
@@ -593,6 +630,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 			socket,
 			meta,
 			isReadonly,
+			objectAccess,
 			serializedSchema,
 			presenceId,
 			presenceRecord,
@@ -615,6 +653,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 			outstandingDataMessages: [],
 			meta,
 			isReadonly,
+			objectAccess: objectAccess ?? 'write',
 			requiresLegacyRejection,
 			supportsStringAppend,
 		})
@@ -927,6 +966,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 				supportsStringAppend: session.supportsStringAppend,
 				meta: session.meta,
 				isReadonly: session.isReadonly,
+				objectAccess: session.objectAccess,
 				requiresLegacyRejection: session.requiresLegacyRejection,
 			})
 			this._unsafe_sendMessage(session.sessionId, msg)
@@ -977,6 +1017,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 				serverClock: txn.getClock(),
 				diff: { ...presenceDiff.value, ...docDiff },
 				isReadonly: session.isReadonly,
+				objectAccess: session.objectAccess,
 			} satisfies Extract<TLSocketServerSentEvent<R>, { type: 'connect' }>
 		}) // no id needed because this only reads, no writes.
 
@@ -1158,14 +1199,29 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 						}
 					}
 				}
-				if (message.diff && !session?.isReadonly) {
+				// Per-op write gate: document-lane records are gated by `isReadonly`, object-lane
+				// records by `objectAccess`. Denied ops are skipped (the client is corrected by the
+				// resulting discard/rebase push_result, exactly as whole-diff readonly skips were).
+				// Server-initiated pushes (no session) are always allowed.
+				const canWrite = (typeName: string) =>
+					!session ||
+					(this.objectTypes.has(typeName) ? session.objectAccess !== 'read' : !session.isReadonly)
+
+				if (message.diff) {
 					// The push request was for the document scope.
 					for (const [id, op] of objectMapEntriesIterable(message.diff!)) {
 						switch (op[0]) {
 							case RecordOpType.Put: {
+								// The write gate is checked before type validation so that a denied
+								// session's ops are skipped without rejection, matching the previous
+								// whole-diff readonly behavior.
+								if (!canWrite(op[1].typeName)) continue
 								// Try to add the document.
 								// If we're putting a record with a type that we don't recognize, fail
-								if (!this.documentTypes.has(op[1].typeName)) {
+								if (
+									!this.documentTypes.has(op[1].typeName) &&
+									!this.objectTypes.has(op[1].typeName)
+								) {
 									throw new TLSyncError(
 										'invalid record',
 										TLSyncErrorCloseEventReason.INVALID_RECORD
@@ -1175,6 +1231,10 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 								break
 							}
 							case RecordOpType.Patch: {
+								const doc = txn.get(id) as R | undefined
+								// if it was already deleted, there's no need to apply the patch
+								if (!doc) continue
+								if (!canWrite(doc.typeName)) continue
 								// Try to patch the document. If it fails, stop here.
 								patchDocument(txn, docChanges, id, op[1])
 								break
@@ -1185,6 +1245,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 									// If the doc was already deleted, don't do anything, no need to propagate a delete op
 									continue
 								}
+								if (!canWrite(doc.typeName)) continue
 
 								// Delete the document and propagate the delete op
 								// delete automatically creates tombstones
@@ -1272,6 +1333,17 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 				this.onPresenceChange?.()
 			})
 		}
+
+		if (result.docChanges.diffs && this.onCommittedChanges) {
+			const diff = result.docChanges.diffs.diff
+			queueMicrotask(() => {
+				try {
+					this.onCommittedChanges?.({ diff, documentClock })
+				} catch (e) {
+					this.log?.error?.('onCommittedChanges threw', e)
+				}
+			})
+		}
 	}
 
 	/**

package/src/lib/TLSyncStorage.ts

@@ -83,7 +83,15 @@ export interface TLSyncStorage<R extends UnknownRecord> {
 
 	onChange(callback: (arg: TLSyncStorageOnChangeCallbackProps) => unknown): () => void
 
+	/** A snapshot of the document lane only — never contains object-store lane records. */
 	getSnapshot?(): RoomSnapshot
+
+	/**
+	 * A snapshot of the object-store lane (see `objectTypes` on the storage), for hosts that
+	 * persist object-lane records separately from the document. Same entry shape as
+	 * `RoomSnapshot['documents']` so a lane can be persisted and re-seeded via a merged snapshot.
+	 */
+	getObjectsSnapshot?(): RoomSnapshot['documents']
 }
 
 /**

package/src/lib/protocol.ts

@@ -24,6 +24,17 @@ export function getTlsyncProtocolVersion() {
 	return TLSYNC_PROTOCOL_VERSION
 }
 
+/**
+ * Access level for object-store lane record types (see `objectTypes` on the room).
+ *
+ * Object-lane records (e.g. comments) are gated by this per-session value instead of the
+ * document-lane `isReadonly` flag, so a session can be allowed to write objects without
+ * being allowed to edit the document ("can comment but not edit"), or vice versa.
+ *
+ * @public
+ */
+export type TLObjectStoreAccess = 'read' | 'write'
+
 /**
  * Constants defining the different types of protocol incompatibility reasons.
  *
@@ -108,6 +119,12 @@ export type TLSocketServerSentEvent<R extends UnknownRecord> =
 			diff: NetworkDiff<R>
 			serverClock: number
 			isReadonly: boolean
+			/**
+			 * Write access for object-store lane record types, when the room has an object lane.
+			 * Optional and additive: servers without an object lane (or older servers) omit it, and
+			 * older clients ignore it — no protocol version bump needed.
+			 */
+			objectAccess?: TLObjectStoreAccess
 	  }
 	| {
 			type: 'incompatibility_error'

package/src/test/TLSocketRoom.test.ts

@@ -48,8 +48,13 @@ function createMockSocket(overrides: Partial<WebSocketMinimal> = {}): WebSocketM
 }
 
 // Connect a session and complete the connect handshake
-function connectSession(room: TLSocketRoom<any, any>, sessionId: string, socket: WebSocketMinimal) {
-	room.handleSocketConnect({ sessionId, socket })
+function connectSession(
+	room: TLSocketRoom<any, any>,
+	sessionId: string,
+	socket: WebSocketMinimal,
+	opts: { objectAccess?: 'read' | 'write' } = {}
+) {
+	room.handleSocketConnect({ sessionId, socket, ...opts })
 	const connectRequest = {
 		type: 'connect' as const,
 		connectRequestId: `connect-${sessionId}`,
@@ -997,11 +1002,41 @@ describe('28. TLSocketRoom (SR)', () => {
 			expect(snapshot).not.toBeNull()
 			expect(snapshot!.serializedSchema).toBeDefined()
 			expect(snapshot!.isReadonly).toBe(false)
+			expect(snapshot!.objectAccess).toBe('write')
 			expect(snapshot!.presenceId).toBeDefined()
 			expect(snapshot!.requiresLegacyRejection).toBe(false)
 			expect(snapshot!.supportsStringAppend).toBe(true)
 		})
 
+		it('[SR13] round-trips objectAccess through snapshot and resume', () => {
+			const room = new TLSocketRoom({})
+			const socket = createMockSocket()
+			connectSession(room, 'test', socket, { objectAccess: 'read' })
+
+			const snapshot = room.getSessionSnapshot('test')!
+			expect(snapshot.objectAccess).toBe('read')
+
+			// Simulate hibernation: resume in a new room
+			const room2 = new TLSocketRoom({})
+			room2.handleSocketResume({ sessionId: 'test', socket: createMockSocket(), snapshot })
+			expect(room2.getSessions()[0].objectAccess).toBe('read')
+		})
+
+		it('[SR13] resumes legacy snapshots without objectAccess as read (fail closed)', () => {
+			const room = new TLSocketRoom({})
+			const socket = createMockSocket()
+			connectSession(room, 'test', socket)
+
+			const snapshot = room.getSessionSnapshot('test')!
+			// simulate a snapshot persisted before the objectAccess field existed
+			delete snapshot.objectAccess
+
+			const room2 = new TLSocketRoom({})
+			room2.handleSocketResume({ sessionId: 'test', socket: createMockSocket(), snapshot })
+			// such sessions predate the record types gated by objectAccess, so they have nothing to write anyway
+			expect(room2.getSessions()[0].objectAccess).toBe('read')
+		})
+
 		it('[SR13] includes presence record when present', () => {
 			const store = getStore()
 			store.ensureStoreIsUsable()