@spooky-sync/core 0.0.1-canary.320 → 0.0.1-canary.322

package/AGENTS.md

@@ -42,7 +42,7 @@ re-materialized from state, never patched in place.
 - Types: `Sp00kyConfig` (client-solid wraps it as `SyncedDbConfig`), `QueryTimeToLive`, `PersistenceClient`, `StoreType`, `UpdateOptions`, `RunOptions`, `PreloadOptions`.
 - Subpath: `@spooky-sync/core/otel` — `createOtelTransmit(endpoint)` for piping pino logs to OpenTelemetry.
 - `client.webPush` (`WebPushModule`, `db.webPush` in the Solid bindings) - Web Push on the page: `support()`, `info()`, `subscribe(opts)` (call from a click), `unsubscribe(opts)`, `sync()`, `isSubscribed()`, `update(opts)`, `devices()`, `notify(msg)`, `cancel(id)`, `test()`, `bridge()`, `onMessage(cb)`. Server calls are `fn::push::*`; typed `WebPushError`; config `webPush` in `types.ts`. Sign-out runs through `AuthService.onBeforeSignOut`.
-- Subpaths for service workers, workers and Node (no wasm, no pino, no DOM; `scripts/check-worker-entries.mjs` enforces it in `build`): `@spooky-sync/core/pure` (protocol builders), `@spooky-sync/core/live` (`createLiveFeed`, the live subscriber over the pure-JS SDK), `@spooky-sync/core/sw` (`installPushHandlers`, `getBridgedToken`). Built by the second tsdown config; chunks are prefixed `worker-`. See `docs/web-push-design.md` at the repo root.
+- Subpaths for service workers, workers and Node (no wasm, no pino, no DOM; `scripts/check-worker-entries.mjs` enforces it in `build`): `@spooky-sync/core/pure` (protocol builders), `@spooky-sync/core/live` (`createLiveFeed`, the live subscriber over the pure-JS SDK; a feed that shares views with another through the same `sessionId` must also pass the same `ownerSecret`, or a signed-out feed's second registration is refused 409 `owner_mismatch`), `@spooky-sync/core/sw` (`installPushHandlers`, `getBridgedToken`). Built by the second tsdown config; chunks are prefixed `worker-`. See `docs/web-push-design.md` at the repo root.
 
 ## Common gotchas
 

package/dist/index.d.ts

@@ -1123,7 +1123,7 @@ type Effect = {
   kind: 'now';
 } | {
   kind: 'id';
-  scope: 'mutation' | 'salt';
+  scope: IdScope;
 } | {
   kind: 'hash';
   input: string;
@@ -1141,6 +1141,8 @@ type Effect = {
   name: ServiceName;
   args: unknown[];
 };
+/** `mutation`: an outbox row id. `salt`: a query-key salt. `owner`: a page's anonymous-view owner secret. */
+type IdScope = 'mutation' | 'salt' | 'owner';
 /**
  * Calls into the legacy services that are adapters, not state: auth, tabs,
  * blobs, migrator, crdt, persistence, the SSP lifecycle, the remote socket.
@@ -1149,8 +1151,12 @@ type Effect = {
 interface ServiceCalls {
   'hint.read': () => string | null;
   'hint.write': (bucketId: string) => void;
-  'salt.take': (authId: string | null) => string | null;
-  'salt.leave': (salt: string, authId: string | null) => void;
+  /** The salt (and owner secret) this tab's previous page left, if minted for `authId`. */
+  'salt.take': (authId: string | null) => {
+    salt: string;
+    owner: string | null;
+  } | null;
+  'salt.leave': (salt: string, authId: string | null, owner: string | null) => void;
   'local.connect': (bucketId: string) => Promise<void>;
   'local.switchStore': (bucketId: string) => Promise<void>;
   'local.beginSwitch': () => () => void;
@@ -1309,6 +1315,13 @@ interface ClientState {
   readonly userId: string | null;
   /** The principal the current session salt was minted for. */
   readonly saltUserId: string | null;
+  /**
+   * This page's secret, sent with every registration (`$config.owner`). An
+   * anonymous view answers only to the secret it was registered with, so it
+   * lives as long as the page's views: a reconnect keeps it, and a reload
+   * that keeps the salt keeps it too.
+   */
+  readonly ownerSecret: string | null;
   /** Latest bucket-switch target; an older switch that wakes up to a newer target skips. */
   readonly pendingBucket: string | null;
   readonly tabId: string;
@@ -1428,10 +1441,7 @@ interface Adapters {
   clock: {
     now(): number;
   };
-  ids: {
-    mutation(): string;
-    salt(): string;
-  };
+  ids: Record<IdScope, () => string>;
   hash(input: string): Promise<string>;
   services: ServiceCalls;
 }

package/dist/index.js

@@ -569,6 +569,16 @@ function generateId() {
 	return Uuid.v4().toString().replace(/-/g, "");
 }
 /**
+* 32 random bytes, hex: the secret a page proves it owns its anonymous views
+* with (`$config.owner` on `fn::query::register`). `getRandomValues` rather
+* than `randomUUID`, which a page served over plain http does not have.
+*/
+function mintOwnerSecret() {
+	const bytes = new Uint8Array(32);
+	globalThis.crypto.getRandomValues(bytes);
+	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
 * Read the millisecond count off a surrealdb `Duration`. Different `surrealdb`
 * releases expose it under `milliseconds` (current) or the older private
 * `_milliseconds` field, so read whichever is set; returns 0 when neither is.
@@ -2178,8 +2188,8 @@ function trimHistory(history, cap) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.320";
-const WASM_VERSION = "0.0.1-canary.320";
+const CORE_VERSION = "0.0.1-canary.322";
+const WASM_VERSION = "0.0.1-canary.322";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class DevToolsService {
 	version = CORE_VERSION;
@@ -3726,6 +3736,8 @@ function phaseTimings(e) {
 * both sides resolve it to the shared `_00_list_ref_anon` table.
 */
 const ANON_USER_ID = "anon";
+/** The one `_00_list_ref` table every signed-out session shares. */
+const ANON_LIST_REF_TABLE = "_00_list_ref_anon";
 /**
 * Default ref-storage mode for this client build. Mirrors the SSP's
 * default (`RefMode::Dedicated`) so cross-session sync works out of the
@@ -3774,7 +3786,7 @@ function bucketIdForUser(userId) {
 * single mode.
 */
 function listRefTableFor(mode, userId) {
-	if (userId === ANON_USER_ID) return "_00_list_ref_anon";
+	if (userId === ANON_USER_ID) return ANON_LIST_REF_TABLE;
 	if (mode === "single") return "_00_list_ref";
 	const uid = sanitizeUserId(userId);
 	return uid ? `_00_list_ref_user_${uid}` : "_00_list_ref";
@@ -3987,6 +3999,7 @@ function emptyState(init) {
 		sessionId: null,
 		userId: null,
 		saltUserId: null,
+		ownerSecret: null,
 		pendingBucket: null,
 		tabId: init.tabId,
 		tabRole: "solo",
@@ -4350,15 +4363,44 @@ const readViewRows = () => `SELECT * FROM ${VIEW_TABLE}`;
 /** Copy every legacy `_00_window` row into `_00_view` once. */
 const readLegacyViewRows = () => `SELECT * FROM ${LEGACY_VIEW_TABLE}`;
 const countViewRows = () => `SELECT count() FROM ${VIEW_TABLE} GROUP ALL`;
-const listRefSelect = (table) => `SELECT out, version FROM ${table} WHERE in = $in AND parent IS NONE`;
-const subqueryListRefSelect = (table) => `SELECT out, version FROM ${table} WHERE in = $in AND parent IS NOT NONE`;
+const listRefSelect = (table) => `SELECT out, version FROM $in->${table} WHERE parent IS NONE`;
+const subqueryListRefSelect = (table) => `SELECT out, version FROM $in->${table} WHERE parent IS NOT NONE`;
 const queryRowCountSelect = () => "SELECT VALUE { rowCount: rowCount, state: state } FROM ONLY $in";
-const listRefBatchSelect = (table) => `SELECT in, out, version, parent FROM ${table} WHERE in IN $ins`;
+const listRefBatchSelect = (table) => `SELECT in, out, version, parent FROM $ins->${table}`;
 const queryRowCountBatchSelect = () => "SELECT VALUE { id: id, rowCount: rowCount, state: state } FROM $ins";
 /** The single-query read: edges, meta, subquery children in one request. */
 const singleSnapshotSelect = (table) => `${listRefSelect(table)};\n${queryRowCountSelect()};\n${subqueryListRefSelect(table)}`;
 /** The many-query read: all edges + all metas in one request. */
 const batchSnapshotSelect = (table) => `${listRefBatchSelect(table)};\n${queryRowCountBatchSelect()}`;
+/**
+* The session's one LIVE subscription on its `_00_list_ref` table.
+*
+* `inlineBodies` adds `FETCH out`, which resolves the edge's target into the
+* notification so the body arrives with the doorbell.
+*
+* On the anon table it is filtered to this client's own edges. Every
+* signed-out session shares that table, so unfiltered each one received (and
+* the server fetched a body for) every anonymous edge change of every other
+* session, and the client then dropped all but its own. An edge carries the
+* `session::id()` of whichever socket last registered its view, which is a
+* socket of this client but not necessarily the current one: a view stays
+* registered across a reconnect, and a reload keeps its salt and its views,
+* so their older edges still name an earlier socket. `sessionIds` are those
+* earlier sockets. The current one is matched by `session::id()` itself,
+* which SurrealDB evaluates in the subscriber's own session, so the filter
+* holds before the client has learned its new id.
+*
+* The cast is load-bearing: `session::id()` is a uuid, `clientId` a string,
+* and without it nothing matches. Per-user tables need no filter.
+*/
+function listRefLive(table, opts) {
+	const join = opts.inlineBodies ? " FETCH out" : "";
+	if (table !== ANON_LIST_REF_TABLE) return { sql: `LIVE SELECT * FROM ${table}${join}` };
+	return {
+		sql: `LIVE SELECT * FROM ${table} WHERE clientId = <string>session::id() OR clientId IN $sids${join}`,
+		vars: { sids: [...opts.sessionIds] }
+	};
+}
 /** Register + read back edges/meta/children in ONE request. */
 const registerSelect = (table) => `fn::query::register($config);\n${singleSnapshotSelect(table)}`;
 const registerVars = (payload) => ({
@@ -4794,7 +4836,8 @@ function* registerRemote(env, hash, retry = false) {
 			id: entry.def.id,
 			surql: entry.def.surql,
 			params: { ...entry.def.params },
-			ttl: entry.def.ttl
+			ttl: entry.def.ttl,
+			...state.ownerSecret ? { owner: state.ownerSecret } : {}
 		}), env.remoteTimeoutMs);
 		if (!(yield fx.state.read((s) => s.queries.has(hash)))) return;
 		const register = stmt(results, 0);
@@ -5842,11 +5885,14 @@ function* boot(env, opts) {
 	yield fx.dispatch({ type: "PrimeCircuit" });
 	const restoredUserId = yield fx.service("auth.restoreSession");
 	const authId = yield fx.service("auth.sessionAuthId");
-	const salt = (yield fx.service("salt.take", authId)) ?? (yield fx.id("salt"));
+	const left = yield fx.service("salt.take", authId);
+	const salt = left?.salt ?? (yield fx.id("salt"));
+	const ownerSecret = left?.owner ?? (yield fx.id("owner"));
 	yield fx.state.update(setIdentity({
 		sessionId: salt,
 		userId: restoredUserId,
-		saltUserId: authId
+		saltUserId: authId,
+		ownerSecret
 	}));
 	yield fx.service("crdt.setSessionId", salt);
 	if (restoredUserId) yield fx.service("ssp.setSessionAuth", authId, yield fx.service("auth.access"));
@@ -5941,12 +5987,13 @@ function* versionsPrimed(entries) {
 * grace finds its views still warm.
 */
 function* pageHide() {
-	const [salt, saltUserId, ids] = yield fx.state.read((s) => [
+	const [salt, saltUserId, ownerSecret, ids] = yield fx.state.read((s) => [
 		s.sessionId,
 		s.saltUserId,
+		s.ownerSecret,
 		[...s.queries.values()].filter((e) => e.lifecycle.remote === "registered").map((e) => e.def.id)
 	]);
-	if (salt) yield fx.service("salt.leave", salt, saltUserId);
+	if (salt) yield fx.service("salt.leave", salt, saltUserId, ownerSecret);
 	if (ids.length > 0) yield fx.service("remote.releaseViews", ids);
 }
 function* warmBlobs() {
@@ -6053,7 +6100,7 @@ function createInterpreter(adapters, host) {
 			}
 			case "state.wait": return host.waitFor(effect.until, ctx?.signal);
 			case "now": return adapters.clock.now();
-			case "id": return effect.scope === "mutation" ? adapters.ids.mutation() : adapters.ids.salt();
+			case "id": return adapters.ids[effect.scope]();
 			case "hash": return adapters.hash(effect.input);
 			case "emit": return host.emit(effect.event);
 			case "dispatch": return host.dispatch(effect.event);
@@ -6657,9 +6704,9 @@ function* landInlineRows(env, rows) {
 //#region src/sync/connection.saga.ts
 /**
 * Transport state changes. A drop invalidates the live query and arms a
-* resubscribe; the next `connected` (outside the burst cooldown) drops every
-* remote registration so `ensureRegistered` rebuilds them behind the
-* `$auth.id` gate, and restarts LIVE.
+* resubscribe. The next `connected` restarts LIVE and drains the outbox;
+* outside the burst cooldown it also drops every remote registration so
+* `ensureRegistered` rebuilds them behind the `$auth.id` gate.
 */
 function* connectionChanged(env, connection) {
 	const state = yield fx.state.read((s) => s);
@@ -6672,18 +6719,17 @@ function* connectionChanged(env, connection) {
 	if (connection !== "connected" || !state.sync.needsResubscribe) return;
 	const now = yield fx.now();
 	const last = state.sync.lastReconnectRefetchAt;
-	if (last !== null && now - last < RECONNECT_REFETCH_COOLDOWN_MS) {
-		yield fx.state.update(patchSync({ needsResubscribe: false }));
-		return;
+	if (last !== null && now - last < RECONNECT_REFETCH_COOLDOWN_MS) yield fx.state.update(patchSync({ needsResubscribe: false }));
+	else {
+		yield fx.state.update(compose(patchSync({
+			needsResubscribe: false,
+			lastReconnectRefetchAt: now
+		}), ...[...state.queries.values()].filter((e) => e.lifecycle.remote !== "unregistered").map((e) => applyLifecycle(e.def.hash, { type: "remote-dropped" }))));
+		yield fx.dispatch({
+			type: "EnsureRegistered",
+			requireAuth: true
+		});
 	}
-	yield fx.state.update(compose(patchSync({
-		needsResubscribe: false,
-		lastReconnectRefetchAt: now
-	}), ...[...state.queries.values()].filter((e) => e.lifecycle.remote !== "unregistered").map((e) => applyLifecycle(e.def.hash, { type: "remote-dropped" }))));
-	yield fx.dispatch({
-		type: "EnsureRegistered",
-		requireAuth: true
-	});
 	yield fx.dispatch({ type: "LiveStart" });
 	yield fx.dispatch({ type: "Drain" });
 }
@@ -8213,8 +8259,12 @@ function resolveReconnectConfig(input) {
 */
 const REMOTE_MAX_CONCURRENT_QUERIES = 6;
 /**
-* Session ids a page remembers for its pagehide release. Only the sessions of
-* the last ttl matter; this many reconnects inside one ttl is a broken network.
+* Session ids a page remembers for its pagehide release and its anonymous LIVE
+* filter. The release only needs the sessions of the last ttl; this many
+* reconnects inside one ttl is a broken network. The LIVE filter would like
+* every session that stamped an edge still held, but the SSP restamps an edge
+* whenever its row changes, so an id that falls off costs at most the LIVE
+* removal of a row untouched since, which the membership poll still catches.
 */
 const MAX_SESSION_IDS = 16;
 var RemoteDatabaseService = class extends AbstractDatabaseService {
@@ -8256,6 +8306,10 @@ var RemoteDatabaseService = class extends AbstractDatabaseService {
 	* whose own session id matches none of them, so it names these instead. Kept
 	* for the page, not the socket: a view registered before a reconnect still
 	* carries the old id until its next heartbeat.
+	*
+	* The anonymous LIVE filters on the same ids (see `listRefLive`): its edges
+	* name the socket that registered their view, which may be an earlier one.
+	* A reload hands its ids to the next page with the salt.
 	*/
 	sessionIdsSeen = [];
 	constructor(config, logger) {
@@ -8281,6 +8335,14 @@ var RemoteDatabaseService = class extends AbstractDatabaseService {
 		return this.sessionIdsSeen;
 	}
 	/**
+	* Take on the session ids of the page this one reloaded from. It kept that
+	* page's salt, so the views it re-registers still carry edges stamped by
+	* those sockets. Older than anything this page has seen, so they go first.
+	*/
+	adoptSessionIds(ids) {
+		this.sessionIdsSeen = [...ids.filter((sid) => typeof sid === "string" && sid !== "" && !this.sessionIdsSeen.includes(sid)), ...this.sessionIdsSeen].slice(-MAX_SESSION_IDS);
+	}
+	/**
 	* Ask the socket that just connected for its session id. Straight to the
 	* SDK: it needs no namespace or identity, so it need not wait behind an
 	* in-flight connect or take a slot from the query queue.
@@ -14696,6 +14758,11 @@ const RELOAD_SALT_KEY = "sp00ky:salt";
 * query onto the `_00_query` row it already had, which the SSP answers from
 * the live view instead of building a new one.
 *
+* The page's owner secret travels with it: an anonymous row answers only to
+* the secret it was registered with, so the next page needs the same one to
+* rejoin those views. `null` from a page that predates it; the next page then
+* mints one, and the rows it left (which hold no secret) take the new one.
+*
 * Taken, not read: the key is absent while a page lives, so a duplicated tab
 * (which copies sessionStorage) mints its own salt rather than sharing this
 * tab's remote views.
@@ -14707,17 +14774,33 @@ function takeReloadSalt(authId) {
 		if (raw === null) return null;
 		sessionStorage.removeItem(RELOAD_SALT_KEY);
 		const left = JSON.parse(raw);
-		return typeof left.salt === "string" && left.salt !== "" && (left.authId ?? null) === authId ? left.salt : null;
+		if (typeof left.salt !== "string" || left.salt === "" || (left.authId ?? null) !== authId) return null;
+		const sessionIds = Array.isArray(left.sessionIds) ? left.sessionIds.filter((sid) => typeof sid === "string") : [];
+		const owner = typeof left.owner === "string" && left.owner !== "" ? left.owner : null;
+		return {
+			salt: left.salt,
+			sessionIds,
+			owner
+		};
 	} catch {
 		return null;
 	}
 }
-/** Leave this page's salt for the next page in this tab; see {@link takeReloadSalt}. */
-function leaveReloadSalt(salt, authId) {
+/**
+* Leave this page's salt for the next page in this tab; see {@link takeReloadSalt}.
+*
+* The session ids of this page's sockets go with it. The views the next page
+* re-registers keep the edges this page's sockets stamped, and the anonymous
+* LIVE only hears edges stamped by a session it knows (see `listRefLive`).
+* So does the page's owner secret, which those views answer to.
+*/
+function leaveReloadSalt(salt, authId, sessionIds = [], owner = null) {
 	try {
 		if (typeof sessionStorage !== "undefined") sessionStorage.setItem(RELOAD_SALT_KEY, JSON.stringify({
 			salt,
-			authId
+			authId,
+			sessionIds,
+			owner
 		}));
 	} catch {}
 }
@@ -14782,7 +14865,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.320",
+			coreVersion: "0.0.1-canary.322",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,
@@ -14886,8 +14969,16 @@ function createAdapters(config, s, host, lateModules) {
 	const services = {
 		"hint.read": readBootBucketHint,
 		"hint.write": writeBootBucketHint,
-		"salt.take": takeReloadSalt,
-		"salt.leave": leaveReloadSalt,
+		"salt.take": (authId) => {
+			const left = takeReloadSalt(authId);
+			if (!left) return null;
+			s.remote.adoptSessionIds(left.sessionIds);
+			return {
+				salt: left.salt,
+				owner: left.owner
+			};
+		},
+		"salt.leave": (salt, authId, owner) => leaveReloadSalt(salt, authId, s.remote.sessionIds(), owner),
 		"local.connect": (bucketId) => s.local.connect(bucketId),
 		"local.switchStore": (bucketId) => s.local.switchStore(bucketId),
 		"local.beginSwitch": () => s.local.beginSwitch(),
@@ -14983,8 +15074,11 @@ function createAdapters(config, s, host, lateModules) {
 		remote: {
 			queryResponses: (sql, vars) => s.remote.queryResponses(sql, vars),
 			live: async (table, onChange) => {
-				const join = config.liveInlineBodies ? " FETCH out" : "";
-				const [uuid] = await s.remote.query(`LIVE SELECT * FROM ${table}${join}`);
+				const stmt = listRefLive(table, {
+					inlineBodies: config.liveInlineBodies === true,
+					sessionIds: s.remote.sessionIds()
+				});
+				const [uuid] = await s.remote.query(stmt.sql, stmt.vars);
 				(await s.remote.getClient().liveOf(uuid)).subscribe((message) => {
 					if (message.action === "KILLED") return;
 					const hash = hashOfEdge(message.value);
@@ -15021,7 +15115,8 @@ function createAdapters(config, s, host, lateModules) {
 		clock: { now: () => Date.now() },
 		ids: {
 			mutation: () => mintMutationId(s.tabId),
-			salt: mintSalt
+			salt: mintSalt,
+			owner: mintOwnerSecret
 		},
 		hash: sha256Hex,
 		services

package/dist/live.d.ts

@@ -1,4 +1,4 @@
-import { r as RefMode } from "./worker-ref-tables.js";
+import { i as RefMode } from "./worker-ref-tables.js";
 import { SchemaStructure } from "@spooky-sync/query-builder";
 
 //#region src/live/index.d.ts
@@ -43,6 +43,14 @@ interface LiveFeedOptions {
   ttl?: string;
   /** Salt of the `_00_query` keys. Default: a fresh random id per feed. */
   sessionId?: string;
+  /**
+   * The secret the feed's registrations prove they own their views with
+   * (`$config.owner`): a signed-out feed's view answers only to the secret it
+   * was registered with. Default: a fresh one per feed. Pass the same one
+   * wherever you pass the same `sessionId`, or the second registrant of a
+   * shared anonymous view is refused.
+   */
+  ownerSecret?: string;
   /**
    * The generated schema. Used to type query params (record ids, datetimes)
    * exactly like the full client does before registering. Taken from a query

package/dist/live.js

@@ -1,4 +1,4 @@
-import { B as queryHashInput, C as heartbeatRowGone, M as registerVars, N as singleSnapshotSelect, S as heartbeatBatch, a as metaFromRow, b as bodySelect, c as parseDuration, d as parseQueryParams, f as ANON_USER_ID, h as listRefTableFor, j as registerSelect, l as parseRecordIdString, n as rowOfEdge, p as DEFAULT_REF_MODE, s as encodeRecordId, t as hashOfEdge, u as withTimeout, z as sha256Hex } from "./worker-edges.js";
+import { A as singleSnapshotSelect, H as sha256Hex, I as ANON_USER_ID, L as DEFAULT_REF_MODE, O as registerSelect, S as listRefLive, U as queryHashInput, a as metaFromRow, c as mintOwnerSecret, d as withTimeout, f as parseQueryParams, g as bodySelect, k as registerVars, l as parseDuration, n as rowOfEdge, s as encodeRecordId, t as hashOfEdge, u as parseRecordIdString, v as heartbeatBatch, y as heartbeatRowGone, z as listRefTableFor } from "./worker-edges.js";
 import { n as decodeTokenClaims } from "./worker-impersonation.js";
 import { RecordId, Surreal } from "surrealdb";
 
@@ -15,10 +15,12 @@ import { RecordId, Surreal } from "surrealdb";
 * - `fn::query::register($config)` plus the membership read-back in one
 *   request (`registerSelect` / `registerVars`, the same builders the full
 *   client's `registerRemote` uses; `$config = { id: _00_query:<key>, surql,
-*   params, ttl }`, key = sha256(JSON.stringify({ surql, params, sessionId })));
+*   params, ttl, owner }`, key = sha256(JSON.stringify({ surql, params,
+*   sessionId })), owner = the feed's `ownerSecret`);
 * - bodies with `SELECT * FROM $ids`;
 * - one `LIVE SELECT * FROM <the user's _00_list_ref table> FETCH out` per
-*   feed, so a changed row usually arrives inline with its edge; an edge whose
+*   feed (on the shared anon table, filtered to the feed's own edges; see
+*   `listRefLive`), so a changed row usually arrives inline with its edge; an edge whose
 *   `out` is a bare id (a server that ignores FETCH) costs a body read, one
 *   whose `out` is null (unreadable or deleted row) a membership re-read;
 * - `fn::query::heartbeat` at half the ttl, re-registering a reclaimed view;
@@ -45,6 +47,7 @@ const FLUSH_MS = 10;
 const FETCH_BATCH_MS = 15;
 const REREAD_MS = 50;
 const RELEASE_TIMEOUT_MS = 2e3;
+const MAX_SOCKETS = 16;
 function deferred() {
 	let resolve;
 	let reject;
@@ -184,6 +187,9 @@ var Feed = class {
 	liveStarting = null;
 	subs = /* @__PURE__ */ new Map();
 	sessionId;
+	ownerSecret;
+	/** `session::id()` of every socket this feed has had, oldest first. */
+	sockets = [];
 	ttl;
 	timeoutMs;
 	isClosed = false;
@@ -198,6 +204,7 @@ var Feed = class {
 	constructor(options) {
 		this.options = options;
 		this.sessionId = options.sessionId ?? randomId();
+		this.ownerSecret = options.ownerSecret ?? mintOwnerSecret();
 		this.ttl = options.ttl ?? "10m";
 		this.timeoutMs = options.timeoutMs ?? 15e3;
 	}
@@ -273,9 +280,23 @@ var Feed = class {
 			}));
 		}
 		this.db = db;
+		this.noteSession();
+	}
+	/**
+	* Remember the `session::id()` of the socket now open. Views are registered
+	* once and not again after a reconnect, so their edges keep naming the socket
+	* that registered them; the anonymous LIVE has to keep hearing those.
+	*/
+	async noteSession() {
+		try {
+			const [sid] = await this.q("RETURN <string>session::id()");
+			if (typeof sid !== "string" || this.sockets.includes(sid)) return;
+			this.sockets = [...this.sockets, sid].slice(-MAX_SOCKETS);
+		} catch {}
 	}
 	/** After a reconnect: LIVE again, then re-read every view (events in the gap are lost). */
 	async recover() {
+		this.noteSession();
 		try {
 			await this.ensureLive();
 			for (const sub of this.subs.values()) if (sub.loaded) this.scheduleReread(sub);
@@ -310,12 +331,18 @@ var Feed = class {
 		if (this.live || this.isClosed) return false;
 		if (!this.liveStarting) this.liveStarting = (async () => {
 			try {
+				const live = (inlineBodies) => listRefLive(this.table, {
+					inlineBodies,
+					sessionIds: this.sockets
+				});
 				let id;
 				try {
-					[id] = await this.q(`LIVE SELECT * FROM ${this.table} FETCH out`);
+					const { sql, vars } = live(true);
+					[id] = await this.q(sql, vars);
 				} catch (error) {
 					this.report(error);
-					[id] = await this.q(`LIVE SELECT * FROM ${this.table}`);
+					const { sql, vars } = live(false);
+					[id] = await this.q(sql, vars);
 				}
 				const stream = await this.db.liveOf(id);
 				const off = stream.subscribe((message) => this.onLive(message));
@@ -515,7 +542,10 @@ var Feed = class {
 	}
 	/** Register (or re-register) a view and read its membership back, in one request. */
 	async register(sub) {
-		let snap = snapshotAt(await this.q(registerSelect(this.table), registerVars(sub.payload)), 1);
+		let snap = snapshotAt(await this.q(registerSelect(this.table), registerVars({
+			...sub.payload,
+			owner: this.ownerSecret
+		})), 1);
 		for (let i = 0; snap && snap.state === "materializing" && i < MATERIALIZE_RETRIES; i++) {
 			await sleep(MATERIALIZE_RETRY_MS);
 			snap = await this.readSnapshot(sub);

package/dist/pure.d.ts

@@ -1,4 +1,4 @@
-import { a as listRefTableFor, i as bucketIdForUser, n as DEFAULT_REF_MODE, o as sanitizeUserId, r as RefMode, t as ANON_USER_ID } from "./worker-ref-tables.js";
+import { a as bucketIdForUser, i as RefMode, n as ANON_USER_ID, o as listRefTableFor, r as DEFAULT_REF_MODE, s as sanitizeUserId, t as ANON_LIST_REF_TABLE } from "./worker-ref-tables.js";
 import { a as PushNotificationAction, c as PushPayloadKind, d as base64UrlToBytes, f as bytesToBase64Url, i as PushNotification, l as PushUrgency, m as sameBytes, n as BridgeTokenMessage, o as PushOp, p as isPushPayload, r as PUSH_PAYLOAD_VERSION, s as PushPayload, t as BridgeSignOutMessage, u as WebPushClientMessage } from "./worker-types.js";
 import { Duration, RecordId } from "surrealdb";
 import { ColumnSchema, RecordId as RecordId$1, SchemaStructure } from "@spooky-sync/query-builder";
@@ -201,11 +201,47 @@ declare const queryRowCountBatchSelect: () => string;
 declare const singleSnapshotSelect: (table: string) => string;
 /** The many-query read: all edges + all metas in one request. */
 declare const batchSnapshotSelect: (table: string) => string;
+/**
+ * The session's one LIVE subscription on its `_00_list_ref` table.
+ *
+ * `inlineBodies` adds `FETCH out`, which resolves the edge's target into the
+ * notification so the body arrives with the doorbell.
+ *
+ * On the anon table it is filtered to this client's own edges. Every
+ * signed-out session shares that table, so unfiltered each one received (and
+ * the server fetched a body for) every anonymous edge change of every other
+ * session, and the client then dropped all but its own. An edge carries the
+ * `session::id()` of whichever socket last registered its view, which is a
+ * socket of this client but not necessarily the current one: a view stays
+ * registered across a reconnect, and a reload keeps its salt and its views,
+ * so their older edges still name an earlier socket. `sessionIds` are those
+ * earlier sockets. The current one is matched by `session::id()` itself,
+ * which SurrealDB evaluates in the subscriber's own session, so the filter
+ * holds before the client has learned its new id.
+ *
+ * The cast is load-bearing: `session::id()` is a uuid, `clientId` a string,
+ * and without it nothing matches. Per-user tables need no filter.
+ */
+declare function listRefLive(table: string, opts: {
+  inlineBodies: boolean;
+  sessionIds: ReadonlyArray<string>;
+}): {
+  sql: string;
+  vars?: Vars;
+};
 interface RegisterPayload {
   id: RecordId<string>;
   surql: string;
   params: Record<string, unknown>;
   ttl: string;
+  /**
+   * The registering page's secret. `fn::query::register` forwards only its
+   * hash, and the SSP lets a registration onto an existing anonymous view
+   * only with the hash that view was registered with: every signed-out
+   * visitor is `anon`, and anyone can read an anonymous view's id. Kept out
+   * of `params`, which name the computation the SSP shares between views.
+   */
+  owner?: string;
 }
 /** Register + read back edges/meta/children in ONE request. */
 declare const registerSelect: (table: string) => string;
@@ -334,4 +370,4 @@ declare function sha256Hex(input: string): Promise<string>;
  */
 declare function queryKey(input: QueryKeyInput, sessionId: string | null): Promise<string>;
 //#endregion
-export { ANON_USER_ID, type Answer, BridgeSignOutMessage, BridgeTokenMessage, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, type ListRefSnapshot, PUSH_PAYLOAD_VERSION, PushNotification, PushNotificationAction, PushOp, PushPayload, PushPayloadKind, PushUrgency, type QueryKeyInput, type QueryMetaRow, type RefMode, RegisterPayload, type SealOptions, type SealedQuery, type SurqlHelper, type TokenClaims, type TxQuery, VIEW_TABLE, WebPushClientMessage, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, leaveViewsBeacon, listRefBatchSelect, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, readViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };
+export { ANON_LIST_REF_TABLE, ANON_USER_ID, type Answer, BridgeSignOutMessage, BridgeTokenMessage, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, type ListRefSnapshot, PUSH_PAYLOAD_VERSION, PushNotification, PushNotificationAction, PushOp, PushPayload, PushPayloadKind, PushUrgency, type QueryKeyInput, type QueryMetaRow, type RefMode, RegisterPayload, type SealOptions, type SealedQuery, type SurqlHelper, type TokenClaims, type TxQuery, VIEW_TABLE, WebPushClientMessage, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, leaveViewsBeacon, listRefBatchSelect, listRefLive, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, readViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };

package/dist/pure.js

@@ -1,4 +1,4 @@
-import { A as readViewRows, B as queryHashInput, C as heartbeatRowGone, D as queryRowCountBatchSelect, E as listRefSelect, F as upsertBodiesTx, I as viewRecordId, L as viewRow, M as registerVars, N as singleSnapshotSelect, O as queryRowCountSelect, P as subqueryListRefSelect, R as surql, S as heartbeatBatch, T as listRefBatchSelect, V as viewKeyInput, _ as LEGACY_VIEW_TABLE, a as metaFromRow, b as bodySelect, c as parseDuration, d as parseQueryParams, f as ANON_USER_ID, g as sanitizeUserId, h as listRefTableFor, i as dedupeRecordVersions, j as registerSelect, k as readLegacyViewRows, l as parseRecordIdString, m as bucketIdForUser, n as rowOfEdge, o as snapshotFromSingle, p as DEFAULT_REF_MODE, r as FAILED, s as encodeRecordId, t as hashOfEdge, v as VIEW_TABLE, w as leaveViewsBeacon, x as countViewRows, y as batchSnapshotSelect, z as sha256Hex } from "./worker-edges.js";
+import { A as singleSnapshotSelect, B as sanitizeUserId, C as listRefSelect, D as readViewRows, E as readLegacyViewRows, F as ANON_LIST_REF_TABLE, H as sha256Hex, I as ANON_USER_ID, L as DEFAULT_REF_MODE, M as upsertBodiesTx, N as viewRecordId, O as registerSelect, P as viewRow, R as bucketIdForUser, S as listRefLive, T as queryRowCountSelect, U as queryHashInput, V as surql, W as viewKeyInput, _ as countViewRows, a as metaFromRow, b as leaveViewsBeacon, f as parseQueryParams, g as bodySelect, h as batchSnapshotSelect, i as dedupeRecordVersions, j as subqueryListRefSelect, k as registerVars, l as parseDuration, m as VIEW_TABLE, n as rowOfEdge, o as snapshotFromSingle, p as LEGACY_VIEW_TABLE, r as FAILED, s as encodeRecordId, t as hashOfEdge, u as parseRecordIdString, v as heartbeatBatch, w as queryRowCountBatchSelect, x as listRefBatchSelect, y as heartbeatRowGone, z as listRefTableFor } from "./worker-edges.js";
 import { n as decodeTokenClaims, t as IMPERSONATION_ACCESS } from "./worker-impersonation.js";
 import { a as sameBytes, i as isPushPayload, n as base64UrlToBytes, r as bytesToBase64Url, t as PUSH_PAYLOAD_VERSION } from "./worker-types.js";
 
@@ -21,4 +21,4 @@ function queryKey(input, sessionId) {
 }
 
 //#endregion
-export { ANON_USER_ID, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, PUSH_PAYLOAD_VERSION, VIEW_TABLE, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, leaveViewsBeacon, listRefBatchSelect, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, readViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };
+export { ANON_LIST_REF_TABLE, ANON_USER_ID, DEFAULT_REF_MODE, FAILED, IMPERSONATION_ACCESS, LEGACY_VIEW_TABLE, PUSH_PAYLOAD_VERSION, VIEW_TABLE, base64UrlToBytes, batchSnapshotSelect, bodySelect, bucketIdForUser, bytesToBase64Url, countViewRows, decodeTokenClaims, dedupeRecordVersions, encodeRecordId, hashOfEdge, heartbeatBatch, heartbeatRowGone, isPushPayload, leaveViewsBeacon, listRefBatchSelect, listRefLive, listRefSelect, listRefTableFor, metaFromRow, parseDuration, parseQueryParams, parseRecordIdString, queryHashInput, queryKey, queryRowCountBatchSelect, queryRowCountSelect, readLegacyViewRows, readViewRows, registerSelect, registerVars, rowOfEdge, sameBytes, sanitizeUserId, sha256Hex, singleSnapshotSelect, snapshotFromSingle, subqueryListRefSelect, surql, upsertBodiesTx, viewKeyInput, viewRecordId, viewRow };

package/dist/types.d.ts

@@ -668,11 +668,21 @@ declare class RemoteDatabaseService extends AbstractDatabaseService {
    * whose own session id matches none of them, so it names these instead. Kept
    * for the page, not the socket: a view registered before a reconnect still
    * carries the old id until its next heartbeat.
+   *
+   * The anonymous LIVE filters on the same ids (see `listRefLive`): its edges
+   * name the socket that registered their view, which may be an earlier one.
+   * A reload hands its ids to the next page with the salt.
    */
   private sessionIdsSeen;
   constructor(config: Sp00kyConfig<any>['database'], logger: Logger$1);
   /** See {@link sessionIdsSeen}. */
   sessionIds(): readonly string[];
+  /**
+   * Take on the session ids of the page this one reloaded from. It kept that
+   * page's salt, so the views it re-registers still carry edges stamped by
+   * those sockets. Older than anything this page has seen, so they go first.
+   */
+  adoptSessionIds(ids: ReadonlyArray<string>): void;
   /**
    * Ask the socket that just connected for its session id. Straight to the
    * SDK: it needs no namespace or identity, so it need not wait behind an