orez-sync-cf-host 0.16.19 → 0.16.20

package/README.md

@@ -144,6 +144,12 @@ Pass a mint callback to the low-level HTTP transport. It calls `getToken()` for
 every socket attempt, including reconnects, so short-lived tokens are never
 reused after the wake connection drops:
 
+Calling `ensureHttpPullTransport` again with a custom token provider replaces
+that provider for future wake attempts while retaining the transport and
+WebSocket shim. Module reloads can recreate the callback without chaining
+transports. Switching between custom minting, auth-token wake and disabled wake,
+or changing transport routing or timing, remains a configuration conflict.
+
 ```ts
 import { ensureHttpPullTransport } from 'orez-lite/client'
 

package/dist/generated/sync_wasm.d.ts

@@ -115,6 +115,14 @@ export function engine_state(db: any): any;
 
 export function engine_version(): string;
 
+/**
+ * The clients a wake after an ingest should reach: every client whose group
+ * can see a row committed after `since`. `{ all: true }` means wake every
+ * socket; otherwise `clientIDs` lists the clients to wake. Call it with a
+ * transaction open, after the ingest that advanced past `since`.
+ */
+export function engine_wake_targets(db: any, schema: any, since: string): any;
+
 export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembly.Module;
 
 export interface InitOutput {
@@ -142,6 +150,7 @@ export interface InitOutput {
     readonly engine_schema_revision: () => [number, number];
     readonly engine_state: (a: any) => [number, number, number];
     readonly engine_version: () => [number, number];
+    readonly engine_wake_targets: (a: any, b: any, c: number, d: number) => [number, number, number];
     readonly __wbindgen_malloc: (a: number, b: number) => number;
     readonly __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
     readonly __wbindgen_exn_store: (a: number) => void;

package/dist/generated/sync_wasm.js

@@ -397,6 +397,26 @@ export function engine_version() {
         wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
     }
 }
+
+/**
+ * The clients a wake after an ingest should reach: every client whose group
+ * can see a row committed after `since`. `{ all: true }` means wake every
+ * socket; otherwise `clientIDs` lists the clients to wake. Call it with a
+ * transaction open, after the ingest that advanced past `since`.
+ * @param {any} db
+ * @param {any} schema
+ * @param {string} since
+ * @returns {any}
+ */
+export function engine_wake_targets(db, schema, since) {
+    const ptr0 = passStringToWasm0(since, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+    const len0 = WASM_VECTOR_LEN;
+    const ret = wasm.engine_wake_targets(db, schema, ptr0, len0);
+    if (ret[2]) {
+        throw takeFromExternrefTable0(ret[1]);
+    }
+    return takeFromExternrefTable0(ret[0]);
+}
 function __wbg_get_imports() {
     const import0 = {
         __proto__: null,

package/dist/generated/sync_wasm_bg.js

@@ -395,6 +395,26 @@ export function engine_version() {
         wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
     }
 }
+
+/**
+ * The clients a wake after an ingest should reach: every client whose group
+ * can see a row committed after `since`. `{ all: true }` means wake every
+ * socket; otherwise `clientIDs` lists the clients to wake. Call it with a
+ * transaction open, after the ingest that advanced past `since`.
+ * @param {any} db
+ * @param {any} schema
+ * @param {string} since
+ * @returns {any}
+ */
+export function engine_wake_targets(db, schema, since) {
+    const ptr0 = passStringToWasm0(since, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+    const len0 = WASM_VECTOR_LEN;
+    const ret = wasm.engine_wake_targets(db, schema, ptr0, len0);
+    if (ret[2]) {
+        throw takeFromExternrefTable0(ret[1]);
+    }
+    return takeFromExternrefTable0(ret[0]);
+}
 export function __wbg_Error_92b29b0548f8b746(arg0, arg1) {
     const ret = Error(getStringFromWasm0(arg0, arg1));
     return ret;

package/dist/host.js

@@ -7,7 +7,7 @@ import { resolveQueryPatch } from './query-patch.js';
 import { ServingLagTracker } from './serving-lag.js';
 import { decodeSqlParams, SqlStorageDirect, SqlStorageMutatorTransaction, SqlStorageSyncDb, } from './sql-storage-adapter.js';
 import { DEFAULT_UPSTREAM_MAX_RESPONSE_BYTES, DEFAULT_UPSTREAM_MAX_REQUEST_BYTES, DEFAULT_UPSTREAM_REQUEST_TIMEOUT_MS, fetchBoundedUpstreamJson, readBoundedJsonResponse, readBoundedStream, UpstreamResponseLimitError, } from './upstream-response.js';
-import { engine_authorize_realtime_subscription, engine_apply_snapshot_changes, engine_apply_snapshot_page, engine_apply_upstream, engine_begin_snapshot_generation, engine_finalize, engine_finalize_snapshot_generation, engine_handle_query_pull, engine_init_query_schema, engine_init_schema, engine_invalidate, engine_memory_bytes, engine_preflight, engine_prune, engine_push_validate, engine_read_snapshot_progress, engine_schema_revision, engine_state, engine_version, } from './wasm.js';
+import { engine_authorize_realtime_subscription, engine_apply_snapshot_changes, engine_apply_snapshot_page, engine_apply_upstream, engine_begin_snapshot_generation, engine_finalize, engine_finalize_snapshot_generation, engine_handle_query_pull, engine_init_query_schema, engine_init_schema, engine_invalidate, engine_memory_bytes, engine_preflight, engine_prune, engine_push_validate, engine_read_snapshot_progress, engine_schema_revision, engine_state, engine_version, engine_wake_targets, } from './wasm.js';
 import { IngestBreakerError, IngestCircuitBreaker, retryDelayMs, shouldRetryDelegatedPush, } from './write-safeguards.js';
 const NAMESPACE_HEADER = 'x-orez-sync-namespace';
 const UPSTREAM_PATH_HEADER = 'x-orez-sync-upstream-path';
@@ -18,6 +18,7 @@ const WAKE_SUBSCRIBER_TAG = 'orez:wake-subscriber';
 // the worker always deletes from the incoming request before setting its own,
 // so a client cannot present one.
 const IDENTITY_HEADER = 'x-orez-sync-identity';
+const WAKE_ISSUED_AT_HEADER = 'x-orez-wake-issued-at';
 const DEFAULT_SNAPSHOT_PAGE_ROWS = 2_000;
 const MIN_SNAPSHOT_PAGE_ROWS = 100;
 const WORKER_STAGE_TELEMETRY_SAMPLE_RATE = 0.01;
@@ -51,6 +52,14 @@ function upstreamBatchTables(batch) {
     }
     return tables;
 }
+function isRealtimeIdentity(identity) {
+    return (typeof identity === 'object' &&
+        identity !== null &&
+        typeof identity.userID === 'string' &&
+        typeof identity.clientID === 'string' &&
+        typeof identity.clientGroupID === 'string' &&
+        identity.clientGroupID.length > 0);
+}
 function freshCounters() {
     return {
         pulls: 0,
@@ -167,6 +176,14 @@ async function boundedRequestObject(request, maxBytes, timeoutMs) {
     }
 }
 function routeAfterNamespace(pathname) {
+    if (pathname.startsWith('/admin/') ||
+        pathname === '/wake' ||
+        pathname === '/notify' ||
+        pathname === '/pull' ||
+        pathname === '/push' ||
+        pathname.startsWith('/realtime/')) {
+        return pathname;
+    }
     const [, , ...parts] = pathname.split('/');
     return `/${parts.join('/')}`;
 }
@@ -324,6 +341,7 @@ export function createSyncWorker(config) {
                 const sampled = Math.random() < WORKER_STAGE_TELEMETRY_SAMPLE_RATE;
                 const isAdmin = route.startsWith('/admin/');
                 let wakeUserID = null;
+                let wakeIssuedAt = null;
                 if (route === '/wake') {
                     let wakeRequest = request;
                     const protocol = request.headers.get('sec-websocket-protocol')?.trim();
@@ -350,8 +368,13 @@ export function createSyncWorker(config) {
                     const wake = await config.authorizeWake(wakeRequest, env);
                     if (!wake)
                         return json({ error: 'missing wake capability' }, 401);
-                    if (typeof wake === 'object')
+                    if (typeof wake === 'object') {
                         wakeUserID = wake.userID;
+                        if (typeof wake.tokenIssuedAt === 'number' &&
+                            Number.isFinite(wake.tokenIssuedAt)) {
+                            wakeIssuedAt = wake.tokenIssuedAt;
+                        }
+                    }
                     // A namespace that streams fields authorizes every subscription against
                     // this userID, so a capability that does not carry one cannot open the
                     // socket. Failing here names the cause; accepting it would produce a
@@ -377,6 +400,7 @@ export function createSyncWorker(config) {
                 headers.delete(NAMESPACE_HEADER);
                 headers.delete(UPSTREAM_PATH_HEADER);
                 headers.delete(IDENTITY_HEADER);
+                headers.delete(WAKE_ISSUED_AT_HEADER);
                 headers.delete(NOTIFY_IF_SUBSCRIBED_HEADER);
                 let forwardedBody = null;
                 // /wake and /realtime/produce are both websocket upgrades and have no
@@ -432,6 +456,8 @@ export function createSyncWorker(config) {
                 // nothing gained by moving them here.
                 if (wakeUserID)
                     headers.set(IDENTITY_HEADER, encodeURIComponent(wakeUserID));
+                if (wakeIssuedAt !== null)
+                    headers.set(WAKE_ISSUED_AT_HEADER, String(wakeIssuedAt));
                 const hashedNamespace = await namespaceHash(namespace);
                 headers.set(NAMESPACE_HEADER, hashedNamespace);
                 try {
@@ -480,7 +506,7 @@ export function createSyncDurableObject(config) {
     validateSyncHostConfig(config);
     const compileQuery = createQueryCompiler(config.schema);
     const defaultRetainChanges = String(config.retainChanges ?? 4_096);
-    const idleTeardownMs = config.idleTeardownMs ?? 5_000;
+    const idleTeardownMs = config.idleTeardownMs ?? null;
     // A CF fan-out wakes every client into an HTTP pull. Give concurrent writer
     // requests a real batching window so a storm burst creates one pull wave.
     const wakeCoalesceMs = config.wakeCoalesceMs ?? 25;
@@ -522,6 +548,7 @@ export function createSyncDurableObject(config) {
         #wakeOrigins = new Set();
         #wakeRecipients = new Set();
         #wakeTables = new Set();
+        #wakeUntargeted = false;
         #wakePromise = null;
         #lastWake = null;
         // Streaming fields. Null when the namespace configures no manifest, which
@@ -543,6 +570,7 @@ export function createSyncDurableObject(config) {
         });
         constructor(ctx, env) {
             super(ctx, env);
+            ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair('ping', 'pong'));
             const recordRowsWritten = (rows) => {
                 this.#sqlBilling.rowsWritten += rows;
                 if (this.#recordingIngestBillable)
@@ -644,6 +672,13 @@ export function createSyncDurableObject(config) {
                 ]);
                 this.#initSkipped = this.#controlGet('initFingerprint') === initFingerprint;
                 if (!this.#initSkipped) {
+                    this.#directSql.exec(`CREATE TABLE IF NOT EXISTS orez_revocations (
+            user_id TEXT NOT NULL,
+            revoked_at INTEGER NOT NULL
+          )`);
+                    this.#directSql.exec('CREATE INDEX IF NOT EXISTS idx_orez_revocations_user_id ON orez_revocations(user_id, revoked_at)');
+                    this.#directSql.exec('CREATE VIEW IF NOT EXISTS revocations AS SELECT user_id, revoked_at FROM orez_revocations');
+                    this.#directSql.exec('CREATE TRIGGER IF NOT EXISTS trg_revocations_insert INSTEAD OF INSERT ON revocations BEGIN INSERT INTO orez_revocations(user_id, revoked_at) VALUES (NEW.user_id, NEW.revoked_at); END;');
                     config.initialize(this.#directSql);
                     this.#directSql.exec("INSERT OR IGNORE INTO _zsync_host_control (key, value) VALUES ('writerEnabled', '1')");
                     this.#wasm(() => engine_init_schema(this.#engineDb, config.schema));
@@ -673,6 +708,8 @@ export function createSyncDurableObject(config) {
             return call();
         }
         #simulateIdleTeardown(now) {
+            if (idleTeardownMs === null)
+                return;
             if (this.#lastRequestAt > 0 && now - this.#lastRequestAt >= idleTeardownMs) {
                 this.#bootID = crypto.randomUUID();
                 this.#hibernations++;
@@ -682,6 +719,7 @@ export function createSyncDurableObject(config) {
                 this.#wakeOrigins.clear();
                 this.#wakeRecipients.clear();
                 this.#wakeTables.clear();
+                this.#wakeUntargeted = false;
                 this.#wakePromise = null;
                 this.#lastWake = null;
                 // Real hibernation reconstructs the object, so the hub and every
@@ -1226,7 +1264,10 @@ export function createSyncDurableObject(config) {
                     }
                 }
                 if (snapshotCompleted || total > 0 || endingWatermark !== startingWatermark) {
-                    await this.#enqueueWake('__upstream__', changedTables);
+                    // a completed snapshot replaced the replica wholesale: every client
+                    // re-pulls. otherwise wake only the clients these rows can reach.
+                    const targets = snapshotCompleted ? null : this.#wakeTargets(startingWatermark);
+                    await this.#enqueueWake('__upstream__', changedTables, targets);
                 }
                 return total;
             })().finally(() => {
@@ -1302,11 +1343,33 @@ export function createSyncDurableObject(config) {
                 ...fields,
             }));
         }
-        #enqueueWake(originClientID, tables = []) {
+        // the clients a batch committed after `since` can reach, or null for every
+        // socket. a wake is advisory, so a targeting failure wakes everyone rather
+        // than failing the ingest that serves the pull waiting on it.
+        #wakeTargets(since) {
+            try {
+                const targets = this.ctx.storage.transactionSync(() => this.#wasm(() => engine_wake_targets(this.#engineDb, config.schema, since)));
+                return targets.all ? null : new Set(targets.clientIDs);
+            }
+            catch (error) {
+                console.error(JSON.stringify({
+                    event: 'sync_wake_target_error',
+                    hostVersion: config.hostVersion,
+                    error: errorMessage(error),
+                }));
+                return null;
+            }
+        }
+        #enqueueWake(originClientID, tables = [], targets = null) {
             this.#wakeOrigins.add(originClientID);
             for (const table of tables)
                 this.#wakeTables.add(table);
-            for (const socket of this.ctx.getWebSockets(WAKE_SUBSCRIBER_TAG)) {
+            if (targets === null)
+                this.#wakeUntargeted = true;
+            const sockets = targets === null
+                ? this.ctx.getWebSockets(WAKE_SUBSCRIBER_TAG)
+                : [...targets].flatMap((clientID) => this.ctx.getWebSockets(`client:${clientID}`));
+            for (const socket of sockets) {
                 const attachment = socketAttachment(socket);
                 if (!attachment ||
                     attachment.clientID === originClientID ||
@@ -1329,6 +1392,8 @@ export function createSyncDurableObject(config) {
                     this.#wakeRecipients = new Set();
                     const tables = [...this.#wakeTables].sort();
                     this.#wakeTables = new Set();
+                    const targeted = !this.#wakeUntargeted;
+                    this.#wakeUntargeted = false;
                     this.#counters.wakeBatches++;
                     let sent = 0;
                     const sockets = this.ctx.getWebSockets(WAKE_SUBSCRIBER_TAG);
@@ -1346,6 +1411,7 @@ export function createSyncDurableObject(config) {
                     const wakeStatus = {
                         at: Date.now(),
                         tables,
+                        targeted,
                         socketCount: sockets.length,
                         originCount: origins.size,
                         sent,
@@ -1724,7 +1790,7 @@ export function createSyncDurableObject(config) {
                         this.#realtimeConnections.set(socket, host.acceptProducer(socket, attachment.producerID));
                         continue;
                     }
-                    if (!attachment.identity)
+                    if (!isRealtimeIdentity(attachment.identity))
                         continue;
                     subscribers.push({
                         socket,
@@ -1760,19 +1826,31 @@ export function createSyncDurableObject(config) {
             const clientID = params.get('clientID');
             if (!clientID)
                 return json({ error: 'clientID is required' }, 400);
+            const encodedUserID = request.headers.get(IDENTITY_HEADER);
+            const rawIssuedAt = request.headers.get(WAKE_ISSUED_AT_HEADER);
+            const userID = encodedUserID ? decodeURIComponent(encodedUserID) : null;
+            if (userID) {
+                const rows = this.#directSql.query('SELECT MAX(revoked_at) AS revoked_at FROM orez_revocations WHERE user_id = ?', [userID]);
+                const latestRevocation = rows[0]?.revoked_at;
+                if (typeof latestRevocation === 'number' && Number.isFinite(latestRevocation)) {
+                    const tokenIssuedAt = rawIssuedAt !== null ? Number(rawIssuedAt) : -Infinity;
+                    if (Number.isNaN(tokenIssuedAt) || tokenIssuedAt < latestRevocation) {
+                        return json({ error: 'revoked wake capability' }, 401);
+                    }
+                }
+            }
             const pair = new WebSocketPair();
             const [client, server] = Object.values(pair);
             // The userID is the worker's, taken from the authenticated request. The
             // group is the client's own claim, and stays a claim: every subscription
             // is checked against this userID before a row is read, so asserting
             // someone else's group buys nothing.
-            const encodedUserID = request.headers.get(IDENTITY_HEADER);
             const clientGroupID = params.get('clientGroupID');
-            const identity = encodedUserID && clientGroupID
+            const identity = encodedUserID
                 ? {
                     userID: decodeURIComponent(encodedUserID),
                     clientID,
-                    clientGroupID,
+                    ...(clientGroupID ? { clientGroupID } : {}),
                 }
                 : undefined;
             server.serializeAttachment({
@@ -1780,7 +1858,7 @@ export function createSyncDurableObject(config) {
                 identity,
             });
             this.ctx.acceptWebSocket(server, [WAKE_SUBSCRIBER_TAG, `client:${clientID}`]);
-            if (identity) {
+            if (isRealtimeIdentity(identity)) {
                 const host = this.#realtimeHost();
                 if (host) {
                     this.#realtimeConnections.set(server, host.acceptSubscriber(server, identity, clientID));
@@ -1802,6 +1880,47 @@ export function createSyncDurableObject(config) {
         #admin(route, request, upstreamPath) {
             if (route === '/admin/health')
                 return json({ ok: true });
+            if (route === '/admin/revoke') {
+                if (request.method !== 'POST') {
+                    return json({ error: 'method not allowed' }, 405);
+                }
+                return request
+                    .json()
+                    .catch(() => ({}))
+                    .then((body) => {
+                    const parsed = typeof body === 'object' && body !== null ? body : {};
+                    const targetUserID = 'userID' in parsed && typeof parsed.userID === 'string'
+                        ? parsed.userID
+                        : 'userId' in parsed && typeof parsed.userId === 'string'
+                            ? parsed.userId
+                            : null;
+                    if (!targetUserID) {
+                        return json({ error: 'userID is required' }, 400);
+                    }
+                    const revokedAt = 'now' in parsed &&
+                        typeof parsed.now === 'number' &&
+                        Number.isFinite(parsed.now)
+                        ? parsed.now
+                        : Date.now();
+                    this.ctx.storage.transactionSync(() => {
+                        this.#directSql.exec(`CREATE TABLE IF NOT EXISTS orez_revocations (
+                user_id TEXT NOT NULL,
+                revoked_at INTEGER NOT NULL
+              )`);
+                        this.#directSql.exec('INSERT INTO orez_revocations (user_id, revoked_at) VALUES (?, ?)', [targetUserID, revokedAt]);
+                    });
+                    let closedSockets = 0;
+                    for (const socket of this.ctx.getWebSockets(WAKE_SUBSCRIBER_TAG)) {
+                        const attachment = socketAttachment(socket);
+                        if (attachment?.identity?.userID === targetUserID) {
+                            this.#realtimeDrop(socket);
+                            socketCloseQuietly(socket, 1008, 'user revoked');
+                            closedSockets++;
+                        }
+                    }
+                    return json({ ok: true, userID: targetUserID, revokedAt, closedSockets });
+                });
+            }
             if (route === '/admin/sql-billing')
                 return json({ ...this.#sqlBilling });
             if (route === '/admin/upstream-write-budget' && request.method === 'GET')
@@ -2061,10 +2180,6 @@ export function createSyncDurableObject(config) {
             return new Response(null, { status: 101, webSocket: client });
         }
         async webSocketMessage(socket, message) {
-            if (message === 'ping') {
-                socket.send('pong');
-                return;
-            }
             this.#initialize();
             const host = this.#realtimeHost();
             if (!host || typeof message !== 'string')

package/dist/types.d.ts

@@ -91,8 +91,10 @@ export type SyncHostConfig<Env extends SyncHostEnv = SyncHostEnv, S extends Sche
      * never arrives. */
     authorizeWake(request: Request, env: Env): boolean | {
         userID: string;
+        tokenIssuedAt?: number;
     } | Promise<boolean | {
         userID: string;
+        tokenIssuedAt?: number;
     }>;
     /** Authorize upstream service notifications before selecting a namespace DO. */
     authorizeNotify(request: Request, env: Env): boolean | Promise<boolean>;
@@ -143,6 +145,13 @@ export type SyncHostConfig<Env extends SyncHostEnv = SyncHostEnv, S extends Sche
     /** Server-owned invalidation epoch for permission/schema transforms. */
     queryTransformVersion?: number | ((claims: NormalizedClaims) => number);
     retainChanges?: number;
+    /**
+     * Test model of a hibernation eviction: after this much inactivity the next
+     * request resets the object's in-memory state the way a real eviction would.
+     * Leave it unset in production, where the runtime evicts for real; a
+     * simulated reset there drops pending wakes whenever one request blocks the
+     * object for longer than the window.
+     */
     idleTeardownMs?: number;
     wakeCoalesceMs?: number;
     /** per-query guard for recursive transaction query materialization. */

package/dist/wasm.d.ts

@@ -21,3 +21,4 @@ export declare const engine_record_app_error: (db: any, client_group_id: string,
 export declare const engine_schema_revision: () => string;
 export declare const engine_state: (db: any) => any;
 export declare const engine_version: () => string;
+export declare const engine_wake_targets: (db: any, schema: any, since: string) => any;

package/dist/wasm.js

@@ -38,3 +38,4 @@ export const engine_record_app_error = withWasm(generated.engine_record_app_erro
 export const engine_schema_revision = withWasm(generated.engine_schema_revision);
 export const engine_state = withWasm(generated.engine_state);
 export const engine_version = withWasm(generated.engine_version);
+export const engine_wake_targets = withWasm(generated.engine_wake_targets);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orez-sync-cf-host",
-  "version": "0.16.19",
+  "version": "0.16.20",
   "description": "Internal orez Cloudflare sync host. Do not import directly: consumers use orez-lite/cloudflare/sync.",
   "type": "module",
   "exports": {
@@ -60,7 +60,7 @@
   },
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
-    "orez-sync-executor": "0.16.19"
+    "orez-sync-executor": "0.16.20"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "4.20260617.1",
@@ -87,5 +87,6 @@
     "type": "git",
     "url": "git+https://github.com/natew/orez.git",
     "directory": "packages/sync-cf-host"
-  }
+  },
+  "releaseSourceCommit": "ea248201d35f2c30b74a6401eda49b9bdd3d2287"
 }