@spooky-sync/core 0.0.1-canary.320 → 0.0.1-canary.322

package/dist/worker-edges.js

@@ -97,6 +97,71 @@ const surql = {
 	}
 };
 
+//#endregion
+//#region src/modules/ref-tables.ts
+/**
+* Sentinel user id for unauthenticated clients when anonymous live queries are
+* enabled. Mirrors `ssp_protocol::ANON_AUTH_ID`. It carries no `user:` prefix
+* so it can never collide with a real user id (those arrive as `user:<id>`);
+* both sides resolve it to the shared `_00_list_ref_anon` table.
+*/
+const ANON_USER_ID = "anon";
+/** The one `_00_list_ref` table every signed-out session shares. */
+const ANON_LIST_REF_TABLE = "_00_list_ref_anon";
+/**
+* Default ref-storage mode for this client build. Mirrors the SSP's
+* default (`RefMode::Dedicated`) so cross-session sync works out of the
+* box.
+*/
+const DEFAULT_REF_MODE = "dedicated";
+/**
+* Sanitize a user record id (e.g. `"user:abc"`) into the segment that
+* goes into a dedicated table name (e.g. `"abc"`). Returns `null` if
+* the id is missing the `user:` prefix or contains characters that
+* aren't valid in a SurrealDB table identifier — the server-side
+* `ssp_protocol::sanitize_user_id` uses the same predicate.
+*
+* Accepts both string ids (`"user:abc"`) and SurrealDB `RecordId`
+* objects (which only stringify cleanly via `.toString()`), since
+* `AuthService` passes the record-id object as-is to its subscribers.
+*/
+function sanitizeUserId(userId) {
+	if (userId === null || userId === void 0) return null;
+	const asString = typeof userId === "string" ? userId : typeof userId.toString === "function" ? userId.toString() : null;
+	if (!asString) return null;
+	const raw = asString.startsWith("user:") ? asString.slice(5) : asString;
+	if (raw.length === 0) return null;
+	if (!/^[A-Za-z0-9_]+$/.test(raw)) return null;
+	return raw;
+}
+/**
+* Resolve the LOCAL storage bucket id for a user. Every user gets their own
+* IndexedDB-backed local store (`indxdb://sp00ky-<bucketId>`) so cached rows,
+* query state, and the mutation outbox never leak across accounts on a shared
+* device. Signed-out sessions share the `anon` bucket.
+*
+* An id that fails sanitization still gets a DETERMINISTIC per-user bucket
+* (cyrb53 hex of the raw id) — falling back to `anon` here would put an
+* authenticated user in the shared bucket and recreate the cross-user leak.
+*/
+function bucketIdForUser(userId) {
+	if (userId === null || userId === void 0 || userId === ANON_USER_ID) return ANON_USER_ID;
+	const uid = sanitizeUserId(userId);
+	if (uid) return uid;
+	return `u${cyrb53(String(userId)).toString(16)}`;
+}
+/**
+* Returns the `_00_list_ref` table name for `(mode, userId)`. Falls
+* back to the global `_00_list_ref` when sanitization fails or in
+* single mode.
+*/
+function listRefTableFor(mode, userId) {
+	if (userId === ANON_USER_ID) return ANON_LIST_REF_TABLE;
+	if (mode === "single") return "_00_list_ref";
+	const uid = sanitizeUserId(userId);
+	return uid ? `_00_list_ref_user_${uid}` : "_00_list_ref";
+}
+
 //#endregion
 //#region src/query/sql.ts
 /** Every SurrealQL statement the query side sends, as pure builders. */
@@ -119,15 +184,44 @@ const readViewRows = () => `SELECT * FROM ${VIEW_TABLE}`;
 /** Copy every legacy `_00_window` row into `_00_view` once. */
 const readLegacyViewRows = () => `SELECT * FROM ${LEGACY_VIEW_TABLE}`;
 const countViewRows = () => `SELECT count() FROM ${VIEW_TABLE} GROUP ALL`;
-const listRefSelect = (table) => `SELECT out, version FROM ${table} WHERE in = $in AND parent IS NONE`;
-const subqueryListRefSelect = (table) => `SELECT out, version FROM ${table} WHERE in = $in AND parent IS NOT NONE`;
+const listRefSelect = (table) => `SELECT out, version FROM $in->${table} WHERE parent IS NONE`;
+const subqueryListRefSelect = (table) => `SELECT out, version FROM $in->${table} WHERE parent IS NOT NONE`;
 const queryRowCountSelect = () => "SELECT VALUE { rowCount: rowCount, state: state } FROM ONLY $in";
-const listRefBatchSelect = (table) => `SELECT in, out, version, parent FROM ${table} WHERE in IN $ins`;
+const listRefBatchSelect = (table) => `SELECT in, out, version, parent FROM $ins->${table}`;
 const queryRowCountBatchSelect = () => "SELECT VALUE { id: id, rowCount: rowCount, state: state } FROM $ins";
 /** The single-query read: edges, meta, subquery children in one request. */
 const singleSnapshotSelect = (table) => `${listRefSelect(table)};\n${queryRowCountSelect()};\n${subqueryListRefSelect(table)}`;
 /** The many-query read: all edges + all metas in one request. */
 const batchSnapshotSelect = (table) => `${listRefBatchSelect(table)};\n${queryRowCountBatchSelect()}`;
+/**
+* The session's one LIVE subscription on its `_00_list_ref` table.
+*
+* `inlineBodies` adds `FETCH out`, which resolves the edge's target into the
+* notification so the body arrives with the doorbell.
+*
+* On the anon table it is filtered to this client's own edges. Every
+* signed-out session shares that table, so unfiltered each one received (and
+* the server fetched a body for) every anonymous edge change of every other
+* session, and the client then dropped all but its own. An edge carries the
+* `session::id()` of whichever socket last registered its view, which is a
+* socket of this client but not necessarily the current one: a view stays
+* registered across a reconnect, and a reload keeps its salt and its views,
+* so their older edges still name an earlier socket. `sessionIds` are those
+* earlier sockets. The current one is matched by `session::id()` itself,
+* which SurrealDB evaluates in the subscriber's own session, so the filter
+* holds before the client has learned its new id.
+*
+* The cast is load-bearing: `session::id()` is a uuid, `clientId` a string,
+* and without it nothing matches. Per-user tables need no filter.
+*/
+function listRefLive(table, opts) {
+	const join = opts.inlineBodies ? " FETCH out" : "";
+	if (table !== ANON_LIST_REF_TABLE) return { sql: `LIVE SELECT * FROM ${table}${join}` };
+	return {
+		sql: `LIVE SELECT * FROM ${table} WHERE clientId = <string>session::id() OR clientId IN $sids${join}`,
+		vars: { sids: [...opts.sessionIds] }
+	};
+}
 /** Register + read back edges/meta/children in ONE request. */
 const registerSelect = (table) => `fn::query::register($config);\n${singleSnapshotSelect(table)}`;
 const registerVars = (payload) => ({
@@ -178,69 +272,6 @@ function upsertBodiesTx(records) {
 	};
 }
 
-//#endregion
-//#region src/modules/ref-tables.ts
-/**
-* Sentinel user id for unauthenticated clients when anonymous live queries are
-* enabled. Mirrors `ssp_protocol::ANON_AUTH_ID`. It carries no `user:` prefix
-* so it can never collide with a real user id (those arrive as `user:<id>`);
-* both sides resolve it to the shared `_00_list_ref_anon` table.
-*/
-const ANON_USER_ID = "anon";
-/**
-* Default ref-storage mode for this client build. Mirrors the SSP's
-* default (`RefMode::Dedicated`) so cross-session sync works out of the
-* box.
-*/
-const DEFAULT_REF_MODE = "dedicated";
-/**
-* Sanitize a user record id (e.g. `"user:abc"`) into the segment that
-* goes into a dedicated table name (e.g. `"abc"`). Returns `null` if
-* the id is missing the `user:` prefix or contains characters that
-* aren't valid in a SurrealDB table identifier — the server-side
-* `ssp_protocol::sanitize_user_id` uses the same predicate.
-*
-* Accepts both string ids (`"user:abc"`) and SurrealDB `RecordId`
-* objects (which only stringify cleanly via `.toString()`), since
-* `AuthService` passes the record-id object as-is to its subscribers.
-*/
-function sanitizeUserId(userId) {
-	if (userId === null || userId === void 0) return null;
-	const asString = typeof userId === "string" ? userId : typeof userId.toString === "function" ? userId.toString() : null;
-	if (!asString) return null;
-	const raw = asString.startsWith("user:") ? asString.slice(5) : asString;
-	if (raw.length === 0) return null;
-	if (!/^[A-Za-z0-9_]+$/.test(raw)) return null;
-	return raw;
-}
-/**
-* Resolve the LOCAL storage bucket id for a user. Every user gets their own
-* IndexedDB-backed local store (`indxdb://sp00ky-<bucketId>`) so cached rows,
-* query state, and the mutation outbox never leak across accounts on a shared
-* device. Signed-out sessions share the `anon` bucket.
-*
-* An id that fails sanitization still gets a DETERMINISTIC per-user bucket
-* (cyrb53 hex of the raw id) — falling back to `anon` here would put an
-* authenticated user in the shared bucket and recreate the cross-user leak.
-*/
-function bucketIdForUser(userId) {
-	if (userId === null || userId === void 0 || userId === ANON_USER_ID) return ANON_USER_ID;
-	const uid = sanitizeUserId(userId);
-	if (uid) return uid;
-	return `u${cyrb53(String(userId)).toString(16)}`;
-}
-/**
-* Returns the `_00_list_ref` table name for `(mode, userId)`. Falls
-* back to the global `_00_list_ref` when sanitization fails or in
-* single mode.
-*/
-function listRefTableFor(mode, userId) {
-	if (userId === ANON_USER_ID) return "_00_list_ref_anon";
-	if (mode === "single") return "_00_list_ref";
-	const uid = sanitizeUserId(userId);
-	return uid ? `_00_list_ref_user_${uid}` : "_00_list_ref";
-}
-
 //#endregion
 //#region src/utils/parser.ts
 /**
@@ -288,6 +319,16 @@ const parseRecordIdString = (id) => {
 	return new RecordId(table, idParts.join(":"));
 };
 /**
+* 32 random bytes, hex: the secret a page proves it owns its anonymous views
+* with (`$config.owner` on `fn::query::register`). `getRandomValues` rather
+* than `randomUUID`, which a page served over plain http does not have.
+*/
+function mintOwnerSecret() {
+	const bytes = new Uint8Array(32);
+	globalThis.crypto.getRandomValues(bytes);
+	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
 * Read the millisecond count off a surrealdb `Duration`. Different `surrealdb`
 * releases expose it under `milliseconds` (current) or the older private
 * `_milliseconds` field, so read whichever is set; returns 0 when neither is.
@@ -436,4 +477,4 @@ function rowOfEdge(value) {
 }
 
 //#endregion
-export { readViewRows as A, queryHashInput as B, heartbeatRowGone as C, queryRowCountBatchSelect as D, listRefSelect as E, upsertBodiesTx as F, viewRecordId as I, viewRow as L, registerVars as M, singleSnapshotSelect as N, queryRowCountSelect as O, subqueryListRefSelect as P, surql as R, heartbeatBatch as S, listRefBatchSelect as T, viewKeyInput as V, LEGACY_VIEW_TABLE as _, metaFromRow as a, bodySelect as b, parseDuration as c, parseQueryParams as d, ANON_USER_ID as f, sanitizeUserId as g, listRefTableFor as h, dedupeRecordVersions as i, registerSelect as j, readLegacyViewRows as k, parseRecordIdString as l, bucketIdForUser as m, rowOfEdge as n, snapshotFromSingle as o, DEFAULT_REF_MODE as p, FAILED as r, encodeRecordId as s, hashOfEdge as t, withTimeout as u, VIEW_TABLE as v, leaveViewsBeacon as w, countViewRows as x, batchSnapshotSelect as y, sha256Hex as z };
+export { singleSnapshotSelect as A, sanitizeUserId as B, listRefSelect as C, readViewRows as D, readLegacyViewRows as E, ANON_LIST_REF_TABLE as F, sha256Hex as H, ANON_USER_ID as I, DEFAULT_REF_MODE as L, upsertBodiesTx as M, viewRecordId as N, registerSelect as O, viewRow as P, bucketIdForUser as R, listRefLive as S, queryRowCountSelect as T, queryHashInput as U, surql as V, viewKeyInput as W, countViewRows as _, metaFromRow as a, leaveViewsBeacon as b, mintOwnerSecret as c, withTimeout as d, parseQueryParams as f, bodySelect as g, batchSnapshotSelect as h, dedupeRecordVersions as i, subqueryListRefSelect as j, registerVars as k, parseDuration as l, VIEW_TABLE as m, rowOfEdge as n, snapshotFromSingle as o, LEGACY_VIEW_TABLE as p, FAILED as r, encodeRecordId as s, hashOfEdge as t, parseRecordIdString as u, heartbeatBatch as v, queryRowCountBatchSelect as w, listRefBatchSelect as x, heartbeatRowGone as y, listRefTableFor as z };

package/dist/worker-ref-tables.d.ts

@@ -7,6 +7,8 @@ type RefMode = 'single' | 'dedicated';
  * both sides resolve it to the shared `_00_list_ref_anon` table.
  */
 declare const ANON_USER_ID = "anon";
+/** The one `_00_list_ref` table every signed-out session shares. */
+declare const ANON_LIST_REF_TABLE = "_00_list_ref_anon";
 /**
  * Default ref-storage mode for this client build. Mirrors the SSP's
  * default (`RefMode::Dedicated`) so cross-session sync works out of the
@@ -43,4 +45,4 @@ declare function bucketIdForUser(userId: unknown): string;
  */
 declare function listRefTableFor(mode: RefMode, userId: unknown): string;
 //#endregion
-export { listRefTableFor as a, bucketIdForUser as i, DEFAULT_REF_MODE as n, sanitizeUserId as o, RefMode as r, ANON_USER_ID as t };
+export { bucketIdForUser as a, RefMode as i, ANON_USER_ID as n, listRefTableFor as o, DEFAULT_REF_MODE as r, sanitizeUserId as s, ANON_LIST_REF_TABLE as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.320",
+  "version": "0.0.1-canary.322",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -75,8 +75,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.320",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.320",
+    "@spooky-sync/query-builder": "0.0.1-canary.322",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.322",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.0.3",
     "blurhash": "^2.0.5",

package/src/boot/boot.saga.test.ts

@@ -43,24 +43,42 @@ describe('boot', () => {
       'releases.init',
     ]);
     expect(svc.calls[1]).toEqual(['local.connect', ['u1']]);
-    expect(out.state).toMatchObject({ bucketId: 'u1', userId: 'user:u1', saltUserId: 'user:u1', sessionId: 'salt-1', localReady: true });
+    expect(out.state).toMatchObject({
+      bucketId: 'u1',
+      userId: 'user:u1',
+      saltUserId: 'user:u1',
+      sessionId: 'salt-1',
+      ownerSecret: 'owner-2',
+      localReady: true,
+    });
     expect(out.dispatched.map((d) => d.type)).toEqual(['WarmBlobs', 'PrimeCircuit', 'AdoptPendingWrites', 'LifecycleTick', 'StartRemote']);
     // The view index is loaded before anything can paint; the first GC waits out the boot.
     expect(out.state.views).toEqual(new Map([['k', ['t:1']]]));
     expect(out.timers.get('gc')).toEqual({ ms: 30_000, event: { type: 'GcTick' } });
     expect(svc.names()).not.toContain('remote.connect');
   });
-  it('a reload keeps the salt its tab left for the same principal', async () => {
+  it('a reload keeps the salt its tab left for the same principal, and the owner secret its views answer to', async () => {
     const svc = fakeServices({
       'hint.read': () => 'u1',
       'auth.restoreSession': async () => 'user:u1',
       'auth.sessionAuthId': () => 'user:u1',
-      'salt.take': () => 'kept-salt',
+      'salt.take': () => ({ salt: 'kept-salt', owner: 'kept-owner' }),
     });
     const out = await runPure(boot(env, { sharedTabs: false }), { handlers: { service: svc.handler, 'local.query': () => [] } });
     expect(svc.calls).toContainEqual(['salt.take', ['user:u1']]);
     expect(svc.calls).toContainEqual(['crdt.setSessionId', ['kept-salt']]);
-    expect(out.state).toMatchObject({ sessionId: 'kept-salt', saltUserId: 'user:u1' });
+    expect(out.state).toMatchObject({ sessionId: 'kept-salt', saltUserId: 'user:u1', ownerSecret: 'kept-owner' });
+    expect(out.log.filter((e) => e.kind === 'id')).toEqual([]);
+  });
+  it('a salt left by a page that kept no owner secret gets a fresh one', async () => {
+    const svc = fakeServices({
+      'hint.read': () => null,
+      'auth.restoreSession': async () => null,
+      'auth.sessionAuthId': () => null,
+      'salt.take': () => ({ salt: 'kept-salt', owner: null }),
+    });
+    const out = await runPure(boot(env, { sharedTabs: false }), { handlers: { service: svc.handler, 'local.query': () => [] } });
+    expect(out.state).toMatchObject({ sessionId: 'kept-salt', ownerSecret: 'owner-1' });
   });
   it('shared tabs: takes the role from the coordinator, or falls back to solo; schemaless engines skip provisioning; anonymous skips session auth', async () => {
     const leader = fakeServices({ 'hint.read': () => null, 'tabs.start': async () => 'leader', 'local.usesSurqlSchema': () => false, 'auth.restoreSession': async () => null, 'auth.sessionAuthId': () => null });
@@ -146,12 +164,17 @@ describe('startRemote / primeCircuit / versionsPrimed / pageHide / warmBlobs', (
     expect(f.state.primed).toBe(true);
     expect(f.emitted).toEqual([expect.objectContaining({ level: 'warn' })]);
   });
-  it('pageHide leaves the salt for a reload before releasing views', async () => {
+  it('pageHide leaves the salt and owner secret for a reload before releasing views', async () => {
     const svc = fakeServices();
-    const s = { ...buildState([buildEntry({ def: { hash: 'a' }, lifecycle: { remote: 'registered' } })]), sessionId: 'salt-1', saltUserId: 'user:u1' };
+    const s = {
+      ...buildState([buildEntry({ def: { hash: 'a' }, lifecycle: { remote: 'registered' } })]),
+      sessionId: 'salt-1',
+      saltUserId: 'user:u1',
+      ownerSecret: 'owner-1',
+    };
     await runPure(pageHide(), { state: s, handlers: { service: svc.handler } });
     expect(svc.calls).toEqual([
-      ['salt.leave', ['salt-1', 'user:u1']],
+      ['salt.leave', ['salt-1', 'user:u1', 'owner-1']],
       ['remote.releaseViews', [[new RecordId('_00_query', 'a')]]],
     ]);
   });

package/src/boot/boot.saga.ts

@@ -44,9 +44,12 @@ export function* boot(env: SagaEnv, opts: BootOptions): Saga<void> {
 
   const restoredUserId = (yield fx.service('auth.restoreSession')) as string | null;
   const authId = (yield fx.service('auth.sessionAuthId')) as string | null;
-  // A reload keeps the salt its tab had, so registrations land on warm views.
-  const salt = (((yield fx.service('salt.take', authId)) as string | null) ?? (yield fx.id('salt'))) as string;
-  yield fx.state.update(R.setIdentity({ sessionId: salt, userId: restoredUserId, saltUserId: authId }));
+  // A reload keeps the salt its tab had, so registrations land on warm views,
+  // and the owner secret those views answer to.
+  const left = (yield fx.service('salt.take', authId)) as { salt: string; owner: string | null } | null;
+  const salt = (left?.salt ?? (yield fx.id('salt'))) as string;
+  const ownerSecret = (left?.owner ?? (yield fx.id('owner'))) as string;
+  yield fx.state.update(R.setIdentity({ sessionId: salt, userId: restoredUserId, saltUserId: authId, ownerSecret }));
   yield fx.service('crdt.setSessionId', salt);
   if (restoredUserId) yield fx.service('ssp.setSessionAuth', authId, (yield fx.service('auth.access')) as string | null);
 
@@ -123,12 +126,13 @@ export function* versionsPrimed(entries: Array<readonly [string, number]>): Saga
  * grace finds its views still warm.
  */
 export function* pageHide(): Saga<void> {
-  const [salt, saltUserId, ids] = (yield fx.state.read((s) => [
+  const [salt, saltUserId, ownerSecret, ids] = (yield fx.state.read((s) => [
     s.sessionId,
     s.saltUserId,
+    s.ownerSecret,
     [...s.queries.values()].filter((e) => e.lifecycle.remote === 'registered').map((e) => e.def.id),
-  ])) as [string | null, string | null, unknown[]];
-  if (salt) yield fx.service('salt.leave', salt, saltUserId);
+  ])) as [string | null, string | null, string | null, unknown[]];
+  if (salt) yield fx.service('salt.leave', salt, saltUserId, ownerSecret);
   if (ids.length > 0) yield fx.service('remote.releaseViews', ids);
 }
 

package/src/client/services.test.ts

@@ -25,16 +25,39 @@ describe('reload salt', () => {
 
   it('a salt left on the way out is taken once, by the same principal', () => {
     leaveReloadSalt('s1', 'user:a');
-    expect(takeReloadSalt('user:a')).toBe('s1');
+    expect(takeReloadSalt('user:a')).toEqual({ salt: 's1', sessionIds: [], owner: null });
     // Taken, not read: a tab duplicated from this page finds nothing.
     expect(takeReloadSalt('user:a')).toBeNull();
   });
 
+  it("the page's socket session ids travel with the salt", () => {
+    // The reloaded page's views keep edges stamped by these sockets, and the
+    // anonymous LIVE only hears sessions it knows.
+    leaveReloadSalt('s1', null, ['sid-1', 'sid-2']);
+    expect(takeReloadSalt(null)).toEqual({ salt: 's1', sessionIds: ['sid-1', 'sid-2'], owner: null });
+    (g.sessionStorage as MemoryStorage).setItem('sp00ky:salt', JSON.stringify({ salt: 's2', authId: null, sessionIds: ['ok', 7, null] }));
+    expect(takeReloadSalt(null)).toEqual({ salt: 's2', sessionIds: ['ok'], owner: null });
+  });
+
+  it("the page's owner secret travels with the salt, so the reloaded page still owns its anonymous views", () => {
+    leaveReloadSalt('s1', null, [], 'secret-1');
+    expect(takeReloadSalt(null)).toEqual({ salt: 's1', sessionIds: [], owner: 'secret-1' });
+    // Gone with the salt: a duplicated tab mints its own.
+    expect(takeReloadSalt(null)).toBeNull();
+    // A different principal re-salts, and the secret is not handed over either.
+    leaveReloadSalt('s2', 'user:a', [], 'secret-2');
+    expect(takeReloadSalt(null)).toBeNull();
+    for (const owner of ['', 7, null]) {
+      (g.sessionStorage as MemoryStorage).setItem('sp00ky:salt', JSON.stringify({ salt: 's3', authId: null, owner }));
+      expect(takeReloadSalt(null)?.owner).toBeNull();
+    }
+  });
+
   it('another principal, or none, mints a fresh salt', () => {
     leaveReloadSalt('s1', 'user:a');
     expect(takeReloadSalt('user:b')).toBeNull();
     leaveReloadSalt('s2', null);
-    expect(takeReloadSalt(null)).toBe('s2');
+    expect(takeReloadSalt(null)?.salt).toBe('s2');
     leaveReloadSalt('s3', null);
     expect(takeReloadSalt('user:a')).toBeNull();
   });

package/src/client/services.ts

@@ -26,9 +26,9 @@ import { MemoryBlobStore, createBlobCache, resolveBlobBudget } from '../services
 import type { Adapters } from '../kernel/interpreter';
 import type { RuntimeEvent } from '../kernel/events';
 import type { ServiceCalls } from '../kernel/effects';
-import { encodeRecordId } from '../utils/index';
+import { encodeRecordId, mintOwnerSecret } from '../utils/index';
 import { sha256Hex } from '../utils/sha256';
-import { leaveViewsBeacon } from '../query/sql';
+import { leaveViewsBeacon, listRefLive } from '../query/sql';
 import { hashOfEdge, rowOfEdge } from '../utils/edges';
 import { mintMutationId } from '../mutation/mutation-id';
 import { BucketHandle, bucketContentToBlob } from './bucket-handle';
@@ -59,27 +59,50 @@ const RELOAD_SALT_KEY = 'sp00ky:salt';
  * query onto the `_00_query` row it already had, which the SSP answers from
  * the live view instead of building a new one.
  *
+ * The page's owner secret travels with it: an anonymous row answers only to
+ * the secret it was registered with, so the next page needs the same one to
+ * rejoin those views. `null` from a page that predates it; the next page then
+ * mints one, and the rows it left (which hold no secret) take the new one.
+ *
  * Taken, not read: the key is absent while a page lives, so a duplicated tab
  * (which copies sessionStorage) mints its own salt rather than sharing this
  * tab's remote views.
  */
-export function takeReloadSalt(authId: string | null): string | null {
+export function takeReloadSalt(
+  authId: string | null
+): { salt: string; sessionIds: string[]; owner: string | null } | null {
   try {
     if (typeof sessionStorage === 'undefined') return null;
     const raw = sessionStorage.getItem(RELOAD_SALT_KEY);
     if (raw === null) return null;
     sessionStorage.removeItem(RELOAD_SALT_KEY);
-    const left = JSON.parse(raw) as { salt?: unknown; authId?: unknown };
-    return typeof left.salt === 'string' && left.salt !== '' && (left.authId ?? null) === authId ? left.salt : null;
+    const left = JSON.parse(raw) as { salt?: unknown; authId?: unknown; sessionIds?: unknown; owner?: unknown };
+    if (typeof left.salt !== 'string' || left.salt === '' || (left.authId ?? null) !== authId) return null;
+    const sessionIds = Array.isArray(left.sessionIds) ? left.sessionIds.filter((sid): sid is string => typeof sid === 'string') : [];
+    const owner = typeof left.owner === 'string' && left.owner !== '' ? left.owner : null;
+    return { salt: left.salt, sessionIds, owner };
   } catch {
     return null;
   }
 }
 
-/** Leave this page's salt for the next page in this tab; see {@link takeReloadSalt}. */
-export function leaveReloadSalt(salt: string, authId: string | null): void {
+/**
+ * Leave this page's salt for the next page in this tab; see {@link takeReloadSalt}.
+ *
+ * The session ids of this page's sockets go with it. The views the next page
+ * re-registers keep the edges this page's sockets stamped, and the anonymous
+ * LIVE only hears edges stamped by a session it knows (see `listRefLive`).
+ * So does the page's owner secret, which those views answer to.
+ */
+export function leaveReloadSalt(
+  salt: string,
+  authId: string | null,
+  sessionIds: ReadonlyArray<string> = [],
+  owner: string | null = null
+): void {
   try {
-    if (typeof sessionStorage !== 'undefined') sessionStorage.setItem(RELOAD_SALT_KEY, JSON.stringify({ salt, authId }));
+    if (typeof sessionStorage !== 'undefined')
+      sessionStorage.setItem(RELOAD_SALT_KEY, JSON.stringify({ salt, authId, sessionIds, owner }));
   } catch {
     /* private-mode storage errors: the next page mints a fresh salt */
   }
@@ -255,8 +278,13 @@ export function createAdapters<S extends SchemaStructure>(config: Sp00kyConfig<S
   const services: ServiceCalls = {
     'hint.read': readBootBucketHint,
     'hint.write': writeBootBucketHint,
-    'salt.take': takeReloadSalt,
-    'salt.leave': leaveReloadSalt,
+    'salt.take': (authId) => {
+      const left = takeReloadSalt(authId);
+      if (!left) return null;
+      s.remote.adoptSessionIds(left.sessionIds);
+      return { salt: left.salt, owner: left.owner };
+    },
+    'salt.leave': (salt, authId, owner) => leaveReloadSalt(salt, authId, s.remote.sessionIds(), owner),
     'local.connect': (bucketId) => s.local.connect(bucketId),
     'local.switchStore': (bucketId) => s.local.switchStore(bucketId),
     'local.beginSwitch': () => s.local.beginSwitch(),
@@ -354,8 +382,8 @@ export function createAdapters<S extends SchemaStructure>(config: Sp00kyConfig<S
         // trip. The clause is only ever added, never relied on: a server that
         // ignores it, or a row the session cannot read, simply yields no
         // inline row and the fetch path takes over.
-        const join = config.liveInlineBodies ? ' FETCH out' : '';
-        const [uuid] = await s.remote.query<[Uuid]>(`LIVE SELECT * FROM ${table}${join}`);
+        const stmt = listRefLive(table, { inlineBodies: config.liveInlineBodies === true, sessionIds: s.remote.sessionIds() });
+        const [uuid] = await s.remote.query<[Uuid]>(stmt.sql, stmt.vars);
         const live = await s.remote.getClient().liveOf(uuid);
         live.subscribe((message) => {
           if (message.action === 'KILLED') return;
@@ -397,7 +425,7 @@ export function createAdapters<S extends SchemaStructure>(config: Sp00kyConfig<S
       },
     },
     clock: { now: () => Date.now() },
-    ids: { mutation: () => mintMutationId(s.tabId), salt: mintSalt },
+    ids: { mutation: () => mintMutationId(s.tabId), salt: mintSalt, owner: mintOwnerSecret },
     hash: sha256Hex,
     services,
   };

package/src/kernel/effects.ts

@@ -53,7 +53,7 @@ export type Effect =
   | { kind: 'state.update'; fn: (s: ClientState) => ClientState }
   | { kind: 'state.wait'; until: (s: ClientState) => boolean }
   | { kind: 'now' }
-  | { kind: 'id'; scope: 'mutation' | 'salt' }
+  | { kind: 'id'; scope: IdScope }
   | { kind: 'hash'; input: string }
   | { kind: 'emit'; event: OutEvent }
   | { kind: 'dispatch'; event: RuntimeEvent }
@@ -62,6 +62,9 @@ export type Effect =
 
 export type EffectKind = Effect['kind'];
 
+/** `mutation`: an outbox row id. `salt`: a query-key salt. `owner`: a page's anonymous-view owner secret. */
+export type IdScope = 'mutation' | 'salt' | 'owner';
+
 /**
  * Calls into the legacy services that are adapters, not state: auth, tabs,
  * blobs, migrator, crdt, persistence, the SSP lifecycle, the remote socket.
@@ -70,8 +73,9 @@ export type EffectKind = Effect['kind'];
 export interface ServiceCalls {
   'hint.read': () => string | null;
   'hint.write': (bucketId: string) => void;
-  'salt.take': (authId: string | null) => string | null;
-  'salt.leave': (salt: string, authId: string | null) => void;
+  /** The salt (and owner secret) this tab's previous page left, if minted for `authId`. */
+  'salt.take': (authId: string | null) => { salt: string; owner: string | null } | null;
+  'salt.leave': (salt: string, authId: string | null, owner: string | null) => void;
   'local.connect': (bucketId: string) => Promise<void>;
   'local.switchStore': (bucketId: string) => Promise<void>;
   'local.beginSwitch': () => () => void;
@@ -154,7 +158,7 @@ export const fx = {
     wait: (until: (s: ClientState) => boolean): Effect => ({ kind: 'state.wait', until }),
   },
   now: (): Effect => ({ kind: 'now' }),
-  id: (scope: 'mutation' | 'salt'): Effect => ({ kind: 'id', scope }),
+  id: (scope: IdScope): Effect => ({ kind: 'id', scope }),
   hash: (input: string): Effect => ({ kind: 'hash', input }),
   emit: (event: OutEvent): Effect => ({ kind: 'emit', event }),
   dispatch: (event: RuntimeEvent): Effect => ({ kind: 'dispatch', event }),

package/src/kernel/interpreter.ts

@@ -4,7 +4,7 @@ import type { IngestRecord, StreamUpdate } from '../services/stream-processor/in
 import type { ClientState } from '../state/client-state';
 import type { InlineRow } from '../types';
 import { withTimeout } from '../utils/index';
-import type { Effect, RegisterResult, ServiceCalls, Settled, StatementResult } from './effects';
+import type { Effect, IdScope, RegisterResult, ServiceCalls, Settled, StatementResult } from './effects';
 import type { OutEvent, RuntimeEvent } from './events';
 
 /** The five adapters plus the pure ports, as the interpreter sees them. */
@@ -36,7 +36,7 @@ export interface Adapters {
   };
   timers: { set(key: string, ms: number, fire: () => void): void; clear(key: string): void };
   clock: { now(): number };
-  ids: { mutation(): string; salt(): string };
+  ids: Record<IdScope, () => string>;
   hash(input: string): Promise<string>;
   services: ServiceCalls;
 }
@@ -127,7 +127,7 @@ export function createInterpreter(adapters: Adapters, host: InterpreterHost): In
       case 'now':
         return adapters.clock.now();
       case 'id':
-        return effect.scope === 'mutation' ? adapters.ids.mutation() : adapters.ids.salt();
+        return adapters.ids[effect.scope]();
       case 'hash':
         return adapters.hash(effect.input);
       case 'emit':

package/src/live/index.test.ts

@@ -187,7 +187,12 @@ describe('createLiveFeed', () => {
     const input = (client as any).registerInput('notification', q.innerQuery, '10m');
     const env = defaultEnv(schema);
     const local = await runPure(registerLocal(env, input), {
-      state: { ...emptyState({ tabId: 't' }), sessionId: 'sess', userId: 'user:alice' },
+      state: {
+        ...emptyState({ tabId: 't' }),
+        sessionId: 'sess',
+        userId: 'user:alice',
+        ownerSecret: 'owner-k',
+      },
       handlers: {
         'local.getById': () => null,
         'ssp.register': () => ({
@@ -208,14 +213,14 @@ describe('createLiveFeed', () => {
     });
 
     const fake = new FakeSurreal();
-    const feed = feedWith(fake);
+    const feed = feedWith(fake, { ownerSecret: 'owner-k' });
     const sub = feed.subscribe(q, { onSet: () => {} });
     await sub.ready;
     const reg = fake.calls.find((c) => c.sql.startsWith('fn::query::register'))!;
     expect(sent).not.toBeNull();
     expect(reg.sql).toBe(sent!.sql);
     expect(reg.vars).toEqual(sent!.vars);
-    expect(reg.sql).toContain('FROM _00_list_ref_user_alice');
+    expect(reg.sql).toContain('FROM $in->_00_list_ref_user_alice');
     expect((reg.vars!.config as any).params.user).toBeInstanceOf(RecordId);
     expect(sub.key).toBe(local.result);
     expect(await queryKey({ surql: input.surql, params: input.params }, 'sess')).toBe(local.result);
@@ -375,6 +380,29 @@ describe('createLiveFeed', () => {
     await feed.close();
   });
 
+  it("an anonymous feed's LIVE hears only its own sockets, earlier ones included after a reconnect", async () => {
+    const fake = new FakeSurreal();
+    let sid = 0;
+    const answer = fake.answer.bind(fake);
+    fake.answer = (sql, vars) =>
+      sql === 'RETURN <string>session::id()' ? [`sid-${++sid}`] : answer(sql, vars);
+    const feed = feedWith(fake, { token: undefined });
+    const sub = feed.subscribe({ surql: 'SELECT * FROM notification;' }, { onSet: () => {} });
+    await sub.ready;
+    fake.fire('disconnected');
+    fake.fire('connected');
+    await tick(60);
+    const lives = fake.calls.filter((c) => c.sql.startsWith('LIVE SELECT'));
+    expect(lives.map((c) => c.sql)).toEqual([
+      'LIVE SELECT * FROM _00_list_ref_anon WHERE clientId = <string>session::id() OR clientId IN $sids FETCH out',
+      'LIVE SELECT * FROM _00_list_ref_anon WHERE clientId = <string>session::id() OR clientId IN $sids FETCH out',
+    ]);
+    // The view was registered on the first socket and is not re-registered,
+    // so its edges keep naming `sid-1`: the second LIVE must still hear them.
+    expect(lives[1].vars).toEqual({ sids: ['sid-1'] });
+    await feed.close();
+  });
+
   it('heartbeats and re-registers a view the server reclaimed', async () => {
     vi.useFakeTimers({ shouldAdvanceTime: true });
     try {
@@ -386,7 +414,13 @@ describe('createLiveFeed', () => {
       fake.heartbeatGone = true;
       await vi.advanceTimersByTimeAsync(10_000);
       expect(fake.calls.some((c) => c.sql.startsWith('fn::query::heartbeat($id0)'))).toBe(true);
-      expect(fake.calls.filter((c) => c.sql.startsWith('fn::query::register'))).toHaveLength(2);
+      const registers = fake.calls.filter((c) => c.sql.startsWith('fn::query::register'));
+      expect(registers).toHaveLength(2);
+      // The re-registration proves it owns the view with the secret it was
+      // registered with (a fresh one per feed, at least 256 bits).
+      const owners = registers.map((c) => (c.vars!.config as { owner?: string }).owner);
+      expect(owners[0]).toMatch(/^[0-9a-f]{64}$/);
+      expect(owners[1]).toBe(owners[0]);
       await feed.close();
     } finally {
       vi.useRealTimers();