@spooky-sync/core 0.0.1-canary.321 → 0.0.1-canary.322

package/AGENTS.md

@@ -42,7 +42,7 @@ re-materialized from state, never patched in place.
 - Types: `Sp00kyConfig` (client-solid wraps it as `SyncedDbConfig`), `QueryTimeToLive`, `PersistenceClient`, `StoreType`, `UpdateOptions`, `RunOptions`, `PreloadOptions`.
 - Subpath: `@spooky-sync/core/otel` — `createOtelTransmit(endpoint)` for piping pino logs to OpenTelemetry.
 - `client.webPush` (`WebPushModule`, `db.webPush` in the Solid bindings) - Web Push on the page: `support()`, `info()`, `subscribe(opts)` (call from a click), `unsubscribe(opts)`, `sync()`, `isSubscribed()`, `update(opts)`, `devices()`, `notify(msg)`, `cancel(id)`, `test()`, `bridge()`, `onMessage(cb)`. Server calls are `fn::push::*`; typed `WebPushError`; config `webPush` in `types.ts`. Sign-out runs through `AuthService.onBeforeSignOut`.
-- Subpaths for service workers, workers and Node (no wasm, no pino, no DOM; `scripts/check-worker-entries.mjs` enforces it in `build`): `@spooky-sync/core/pure` (protocol builders), `@spooky-sync/core/live` (`createLiveFeed`, the live subscriber over the pure-JS SDK), `@spooky-sync/core/sw` (`installPushHandlers`, `getBridgedToken`). Built by the second tsdown config; chunks are prefixed `worker-`. See `docs/web-push-design.md` at the repo root.
+- Subpaths for service workers, workers and Node (no wasm, no pino, no DOM; `scripts/check-worker-entries.mjs` enforces it in `build`): `@spooky-sync/core/pure` (protocol builders), `@spooky-sync/core/live` (`createLiveFeed`, the live subscriber over the pure-JS SDK; a feed that shares views with another through the same `sessionId` must also pass the same `ownerSecret`, or a signed-out feed's second registration is refused 409 `owner_mismatch`), `@spooky-sync/core/sw` (`installPushHandlers`, `getBridgedToken`). Built by the second tsdown config; chunks are prefixed `worker-`. See `docs/web-push-design.md` at the repo root.
 
 ## Common gotchas
 

package/dist/index.d.ts

@@ -1123,7 +1123,7 @@ type Effect = {
   kind: 'now';
 } | {
   kind: 'id';
-  scope: 'mutation' | 'salt';
+  scope: IdScope;
 } | {
   kind: 'hash';
   input: string;
@@ -1141,6 +1141,8 @@ type Effect = {
   name: ServiceName;
   args: unknown[];
 };
+/** `mutation`: an outbox row id. `salt`: a query-key salt. `owner`: a page's anonymous-view owner secret. */
+type IdScope = 'mutation' | 'salt' | 'owner';
 /**
  * Calls into the legacy services that are adapters, not state: auth, tabs,
  * blobs, migrator, crdt, persistence, the SSP lifecycle, the remote socket.
@@ -1149,8 +1151,12 @@ type Effect = {
 interface ServiceCalls {
   'hint.read': () => string | null;
   'hint.write': (bucketId: string) => void;
-  'salt.take': (authId: string | null) => string | null;
-  'salt.leave': (salt: string, authId: string | null) => void;
+  /** The salt (and owner secret) this tab's previous page left, if minted for `authId`. */
+  'salt.take': (authId: string | null) => {
+    salt: string;
+    owner: string | null;
+  } | null;
+  'salt.leave': (salt: string, authId: string | null, owner: string | null) => void;
   'local.connect': (bucketId: string) => Promise<void>;
   'local.switchStore': (bucketId: string) => Promise<void>;
   'local.beginSwitch': () => () => void;
@@ -1309,6 +1315,13 @@ interface ClientState {
   readonly userId: string | null;
   /** The principal the current session salt was minted for. */
   readonly saltUserId: string | null;
+  /**
+   * This page's secret, sent with every registration (`$config.owner`). An
+   * anonymous view answers only to the secret it was registered with, so it
+   * lives as long as the page's views: a reconnect keeps it, and a reload
+   * that keeps the salt keeps it too.
+   */
+  readonly ownerSecret: string | null;
   /** Latest bucket-switch target; an older switch that wakes up to a newer target skips. */
   readonly pendingBucket: string | null;
   readonly tabId: string;
@@ -1428,10 +1441,7 @@ interface Adapters {
   clock: {
     now(): number;
   };
-  ids: {
-    mutation(): string;
-    salt(): string;
-  };
+  ids: Record<IdScope, () => string>;
   hash(input: string): Promise<string>;
   services: ServiceCalls;
 }

package/dist/index.js

@@ -569,6 +569,16 @@ function generateId() {
 	return Uuid.v4().toString().replace(/-/g, "");
 }
 /**
+* 32 random bytes, hex: the secret a page proves it owns its anonymous views
+* with (`$config.owner` on `fn::query::register`). `getRandomValues` rather
+* than `randomUUID`, which a page served over plain http does not have.
+*/
+function mintOwnerSecret() {
+	const bytes = new Uint8Array(32);
+	globalThis.crypto.getRandomValues(bytes);
+	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
 * Read the millisecond count off a surrealdb `Duration`. Different `surrealdb`
 * releases expose it under `milliseconds` (current) or the older private
 * `_milliseconds` field, so read whichever is set; returns 0 when neither is.
@@ -2178,8 +2188,8 @@ function trimHistory(history, cap) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.321";
-const WASM_VERSION = "0.0.1-canary.321";
+const CORE_VERSION = "0.0.1-canary.322";
+const WASM_VERSION = "0.0.1-canary.322";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class DevToolsService {
 	version = CORE_VERSION;
@@ -3989,6 +3999,7 @@ function emptyState(init) {
 		sessionId: null,
 		userId: null,
 		saltUserId: null,
+		ownerSecret: null,
 		pendingBucket: null,
 		tabId: init.tabId,
 		tabRole: "solo",
@@ -4825,7 +4836,8 @@ function* registerRemote(env, hash, retry = false) {
 			id: entry.def.id,
 			surql: entry.def.surql,
 			params: { ...entry.def.params },
-			ttl: entry.def.ttl
+			ttl: entry.def.ttl,
+			...state.ownerSecret ? { owner: state.ownerSecret } : {}
 		}), env.remoteTimeoutMs);
 		if (!(yield fx.state.read((s) => s.queries.has(hash)))) return;
 		const register = stmt(results, 0);
@@ -5873,11 +5885,14 @@ function* boot(env, opts) {
 	yield fx.dispatch({ type: "PrimeCircuit" });
 	const restoredUserId = yield fx.service("auth.restoreSession");
 	const authId = yield fx.service("auth.sessionAuthId");
-	const salt = (yield fx.service("salt.take", authId)) ?? (yield fx.id("salt"));
+	const left = yield fx.service("salt.take", authId);
+	const salt = left?.salt ?? (yield fx.id("salt"));
+	const ownerSecret = left?.owner ?? (yield fx.id("owner"));
 	yield fx.state.update(setIdentity({
 		sessionId: salt,
 		userId: restoredUserId,
-		saltUserId: authId
+		saltUserId: authId,
+		ownerSecret
 	}));
 	yield fx.service("crdt.setSessionId", salt);
 	if (restoredUserId) yield fx.service("ssp.setSessionAuth", authId, yield fx.service("auth.access"));
@@ -5972,12 +5987,13 @@ function* versionsPrimed(entries) {
 * grace finds its views still warm.
 */
 function* pageHide() {
-	const [salt, saltUserId, ids] = yield fx.state.read((s) => [
+	const [salt, saltUserId, ownerSecret, ids] = yield fx.state.read((s) => [
 		s.sessionId,
 		s.saltUserId,
+		s.ownerSecret,
 		[...s.queries.values()].filter((e) => e.lifecycle.remote === "registered").map((e) => e.def.id)
 	]);
-	if (salt) yield fx.service("salt.leave", salt, saltUserId);
+	if (salt) yield fx.service("salt.leave", salt, saltUserId, ownerSecret);
 	if (ids.length > 0) yield fx.service("remote.releaseViews", ids);
 }
 function* warmBlobs() {
@@ -6084,7 +6100,7 @@ function createInterpreter(adapters, host) {
 			}
 			case "state.wait": return host.waitFor(effect.until, ctx?.signal);
 			case "now": return adapters.clock.now();
-			case "id": return effect.scope === "mutation" ? adapters.ids.mutation() : adapters.ids.salt();
+			case "id": return adapters.ids[effect.scope]();
 			case "hash": return adapters.hash(effect.input);
 			case "emit": return host.emit(effect.event);
 			case "dispatch": return host.dispatch(effect.event);
@@ -14742,6 +14758,11 @@ const RELOAD_SALT_KEY = "sp00ky:salt";
 * query onto the `_00_query` row it already had, which the SSP answers from
 * the live view instead of building a new one.
 *
+* The page's owner secret travels with it: an anonymous row answers only to
+* the secret it was registered with, so the next page needs the same one to
+* rejoin those views. `null` from a page that predates it; the next page then
+* mints one, and the rows it left (which hold no secret) take the new one.
+*
 * Taken, not read: the key is absent while a page lives, so a duplicated tab
 * (which copies sessionStorage) mints its own salt rather than sharing this
 * tab's remote views.
@@ -14755,9 +14776,11 @@ function takeReloadSalt(authId) {
 		const left = JSON.parse(raw);
 		if (typeof left.salt !== "string" || left.salt === "" || (left.authId ?? null) !== authId) return null;
 		const sessionIds = Array.isArray(left.sessionIds) ? left.sessionIds.filter((sid) => typeof sid === "string") : [];
+		const owner = typeof left.owner === "string" && left.owner !== "" ? left.owner : null;
 		return {
 			salt: left.salt,
-			sessionIds
+			sessionIds,
+			owner
 		};
 	} catch {
 		return null;
@@ -14769,13 +14792,15 @@ function takeReloadSalt(authId) {
 * The session ids of this page's sockets go with it. The views the next page
 * re-registers keep the edges this page's sockets stamped, and the anonymous
 * LIVE only hears edges stamped by a session it knows (see `listRefLive`).
+* So does the page's owner secret, which those views answer to.
 */
-function leaveReloadSalt(salt, authId, sessionIds = []) {
+function leaveReloadSalt(salt, authId, sessionIds = [], owner = null) {
 	try {
 		if (typeof sessionStorage !== "undefined") sessionStorage.setItem(RELOAD_SALT_KEY, JSON.stringify({
 			salt,
 			authId,
-			sessionIds
+			sessionIds,
+			owner
 		}));
 	} catch {}
 }
@@ -14840,7 +14865,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.321",
+			coreVersion: "0.0.1-canary.322",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,
@@ -14948,9 +14973,12 @@ function createAdapters(config, s, host, lateModules) {
 			const left = takeReloadSalt(authId);
 			if (!left) return null;
 			s.remote.adoptSessionIds(left.sessionIds);
-			return left.salt;
+			return {
+				salt: left.salt,
+				owner: left.owner
+			};
 		},
-		"salt.leave": (salt, authId) => leaveReloadSalt(salt, authId, s.remote.sessionIds()),
+		"salt.leave": (salt, authId, owner) => leaveReloadSalt(salt, authId, s.remote.sessionIds(), owner),
 		"local.connect": (bucketId) => s.local.connect(bucketId),
 		"local.switchStore": (bucketId) => s.local.switchStore(bucketId),
 		"local.beginSwitch": () => s.local.beginSwitch(),
@@ -15087,7 +15115,8 @@ function createAdapters(config, s, host, lateModules) {
 		clock: { now: () => Date.now() },
 		ids: {
 			mutation: () => mintMutationId(s.tabId),
-			salt: mintSalt
+			salt: mintSalt,
+			owner: mintOwnerSecret
 		},
 		hash: sha256Hex,
 		services

package/dist/live.d.ts

@@ -43,6 +43,14 @@ interface LiveFeedOptions {
   ttl?: string;
   /** Salt of the `_00_query` keys. Default: a fresh random id per feed. */
   sessionId?: string;
+  /**
+   * The secret the feed's registrations prove they own their views with
+   * (`$config.owner`): a signed-out feed's view answers only to the secret it
+   * was registered with. Default: a fresh one per feed. Pass the same one
+   * wherever you pass the same `sessionId`, or the second registrant of a
+   * shared anonymous view is refused.
+   */
+  ownerSecret?: string;
   /**
    * The generated schema. Used to type query params (record ids, datetimes)
    * exactly like the full client does before registering. Taken from a query

package/dist/live.js

@@ -1,4 +1,4 @@
-import { D as registerSelect, F as ANON_USER_ID, H as queryHashInput, I as DEFAULT_REF_MODE, O as registerVars, R as listRefTableFor, V as sha256Hex, _ as heartbeatBatch, a as metaFromRow, c as parseDuration, d as parseQueryParams, h as bodySelect, k as singleSnapshotSelect, l as parseRecordIdString, n as rowOfEdge, s as encodeRecordId, t as hashOfEdge, u as withTimeout, v as heartbeatRowGone, x as listRefLive } from "./worker-edges.js";
+import { A as singleSnapshotSelect, H as sha256Hex, I as ANON_USER_ID, L as DEFAULT_REF_MODE, O as registerSelect, S as listRefLive, U as queryHashInput, a as metaFromRow, c as mintOwnerSecret, d as withTimeout, f as parseQueryParams, g as bodySelect, k as registerVars, l as parseDuration, n as rowOfEdge, s as encodeRecordId, t as hashOfEdge, u as parseRecordIdString, v as heartbeatBatch, y as heartbeatRowGone, z as listRefTableFor } from "./worker-edges.js";
 import { n as decodeTokenClaims } from "./worker-impersonation.js";
 import { RecordId, Surreal } from "surrealdb";
 
@@ -15,7 +15,8 @@ import { RecordId, Surreal } from "surrealdb";
 * - `fn::query::register($config)` plus the membership read-back in one
 *   request (`registerSelect` / `registerVars`, the same builders the full
 *   client's `registerRemote` uses; `$config = { id: _00_query:<key>, surql,
-*   params, ttl }`, key = sha256(JSON.stringify({ surql, params, sessionId })));
+*   params, ttl, owner }`, key = sha256(JSON.stringify({ surql, params,
+*   sessionId })), owner = the feed's `ownerSecret`);
 * - bodies with `SELECT * FROM $ids`;
 * - one `LIVE SELECT * FROM <the user's _00_list_ref table> FETCH out` per
 *   feed (on the shared anon table, filtered to the feed's own edges; see
@@ -186,6 +187,7 @@ var Feed = class {
 	liveStarting = null;
 	subs = /* @__PURE__ */ new Map();
 	sessionId;
+	ownerSecret;
 	/** `session::id()` of every socket this feed has had, oldest first. */
 	sockets = [];
 	ttl;
@@ -202,6 +204,7 @@ var Feed = class {
 	constructor(options) {
 		this.options = options;
 		this.sessionId = options.sessionId ?? randomId();
+		this.ownerSecret = options.ownerSecret ?? mintOwnerSecret();
 		this.ttl = options.ttl ?? "10m";
 		this.timeoutMs = options.timeoutMs ?? 15e3;
 	}
@@ -539,7 +542,10 @@ var Feed = class {
 	}
 	/** Register (or re-register) a view and read its membership back, in one request. */
 	async register(sub) {
-		let snap = snapshotAt(await this.q(registerSelect(this.table), registerVars(sub.payload)), 1);
+		let snap = snapshotAt(await this.q(registerSelect(this.table), registerVars({
+			...sub.payload,
+			owner: this.ownerSecret
+		})), 1);
 		for (let i = 0; snap && snap.state === "materializing" && i < MATERIALIZE_RETRIES; i++) {
 			await sleep(MATERIALIZE_RETRY_MS);
 			snap = await this.readSnapshot(sub);

package/dist/pure.d.ts

@@ -234,6 +234,14 @@ interface RegisterPayload {
   surql: string;
   params: Record<string, unknown>;
   ttl: string;
+  /**
+   * The registering page's secret. `fn::query::register` forwards only its
+   * hash, and the SSP lets a registration onto an existing anonymous view
+   * only with the hash that view was registered with: every signed-out
+   * visitor is `anon`, and anyone can read an anonymous view's id. Kept out
+   * of `params`, which name the computation the SSP shares between views.
+   */
+  owner?: string;
 }
 /** Register + read back edges/meta/children in ONE request. */
 declare const registerSelect: (table: string) => string;

package/dist/pure.js

@@ -1,4 +1,4 @@
-import { A as subqueryListRefSelect, B as surql, C as queryRowCountBatchSelect, D as registerSelect, E as readViewRows, F as ANON_USER_ID, H as queryHashInput, I as DEFAULT_REF_MODE, L as bucketIdForUser, M as viewRecordId, N as viewRow, O as registerVars, P as ANON_LIST_REF_TABLE, R as listRefTableFor, S as listRefSelect, T as readLegacyViewRows, U as viewKeyInput, V as sha256Hex, _ as heartbeatBatch, a as metaFromRow, b as listRefBatchSelect, c as parseDuration, d as parseQueryParams, f as LEGACY_VIEW_TABLE, g as countViewRows, h as bodySelect, i as dedupeRecordVersions, j as upsertBodiesTx, k as singleSnapshotSelect, l as parseRecordIdString, m as batchSnapshotSelect, n as rowOfEdge, o as snapshotFromSingle, p as VIEW_TABLE, r as FAILED, s as encodeRecordId, t as hashOfEdge, v as heartbeatRowGone, w as queryRowCountSelect, x as listRefLive, y as leaveViewsBeacon, z as sanitizeUserId } from "./worker-edges.js";
+import { A as singleSnapshotSelect, B as sanitizeUserId, C as listRefSelect, D as readViewRows, E as readLegacyViewRows, F as ANON_LIST_REF_TABLE, H as sha256Hex, I as ANON_USER_ID, L as DEFAULT_REF_MODE, M as upsertBodiesTx, N as viewRecordId, O as registerSelect, P as viewRow, R as bucketIdForUser, S as listRefLive, T as queryRowCountSelect, U as queryHashInput, V as surql, W as viewKeyInput, _ as countViewRows, a as metaFromRow, b as leaveViewsBeacon, f as parseQueryParams, g as bodySelect, h as batchSnapshotSelect, i as dedupeRecordVersions, j as subqueryListRefSelect, k as registerVars, l as parseDuration, m as VIEW_TABLE, n as rowOfEdge, o as snapshotFromSingle, p as LEGACY_VIEW_TABLE, r as FAILED, s as encodeRecordId, t as hashOfEdge, u as parseRecordIdString, v as heartbeatBatch, w as queryRowCountBatchSelect, x as listRefBatchSelect, y as heartbeatRowGone, z as listRefTableFor } from "./worker-edges.js";
 import { n as decodeTokenClaims, t as IMPERSONATION_ACCESS } from "./worker-impersonation.js";
 import { a as sameBytes, i as isPushPayload, n as base64UrlToBytes, r as bytesToBase64Url, t as PUSH_PAYLOAD_VERSION } from "./worker-types.js";
 

package/dist/worker-edges.js

@@ -319,6 +319,16 @@ const parseRecordIdString = (id) => {
 	return new RecordId(table, idParts.join(":"));
 };
 /**
+* 32 random bytes, hex: the secret a page proves it owns its anonymous views
+* with (`$config.owner` on `fn::query::register`). `getRandomValues` rather
+* than `randomUUID`, which a page served over plain http does not have.
+*/
+function mintOwnerSecret() {
+	const bytes = new Uint8Array(32);
+	globalThis.crypto.getRandomValues(bytes);
+	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
 * Read the millisecond count off a surrealdb `Duration`. Different `surrealdb`
 * releases expose it under `milliseconds` (current) or the older private
 * `_milliseconds` field, so read whichever is set; returns 0 when neither is.
@@ -467,4 +477,4 @@ function rowOfEdge(value) {
 }
 
 //#endregion
-export { subqueryListRefSelect as A, surql as B, queryRowCountBatchSelect as C, registerSelect as D, readViewRows as E, ANON_USER_ID as F, queryHashInput as H, DEFAULT_REF_MODE as I, bucketIdForUser as L, viewRecordId as M, viewRow as N, registerVars as O, ANON_LIST_REF_TABLE as P, listRefTableFor as R, listRefSelect as S, readLegacyViewRows as T, viewKeyInput as U, sha256Hex as V, heartbeatBatch as _, metaFromRow as a, listRefBatchSelect as b, parseDuration as c, parseQueryParams as d, LEGACY_VIEW_TABLE as f, countViewRows as g, bodySelect as h, dedupeRecordVersions as i, upsertBodiesTx as j, singleSnapshotSelect as k, parseRecordIdString as l, batchSnapshotSelect as m, rowOfEdge as n, snapshotFromSingle as o, VIEW_TABLE as p, FAILED as r, encodeRecordId as s, hashOfEdge as t, withTimeout as u, heartbeatRowGone as v, queryRowCountSelect as w, listRefLive as x, leaveViewsBeacon as y, sanitizeUserId as z };
+export { singleSnapshotSelect as A, sanitizeUserId as B, listRefSelect as C, readViewRows as D, readLegacyViewRows as E, ANON_LIST_REF_TABLE as F, sha256Hex as H, ANON_USER_ID as I, DEFAULT_REF_MODE as L, upsertBodiesTx as M, viewRecordId as N, registerSelect as O, viewRow as P, bucketIdForUser as R, listRefLive as S, queryRowCountSelect as T, queryHashInput as U, surql as V, viewKeyInput as W, countViewRows as _, metaFromRow as a, leaveViewsBeacon as b, mintOwnerSecret as c, withTimeout as d, parseQueryParams as f, bodySelect as g, batchSnapshotSelect as h, dedupeRecordVersions as i, subqueryListRefSelect as j, registerVars as k, parseDuration as l, VIEW_TABLE as m, rowOfEdge as n, snapshotFromSingle as o, LEGACY_VIEW_TABLE as p, FAILED as r, encodeRecordId as s, hashOfEdge as t, parseRecordIdString as u, heartbeatBatch as v, queryRowCountBatchSelect as w, listRefBatchSelect as x, heartbeatRowGone as y, listRefTableFor as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.321",
+  "version": "0.0.1-canary.322",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -75,8 +75,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.321",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.321",
+    "@spooky-sync/query-builder": "0.0.1-canary.322",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.322",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.0.3",
     "blurhash": "^2.0.5",

package/src/boot/boot.saga.test.ts

@@ -43,24 +43,42 @@ describe('boot', () => {
       'releases.init',
     ]);
     expect(svc.calls[1]).toEqual(['local.connect', ['u1']]);
-    expect(out.state).toMatchObject({ bucketId: 'u1', userId: 'user:u1', saltUserId: 'user:u1', sessionId: 'salt-1', localReady: true });
+    expect(out.state).toMatchObject({
+      bucketId: 'u1',
+      userId: 'user:u1',
+      saltUserId: 'user:u1',
+      sessionId: 'salt-1',
+      ownerSecret: 'owner-2',
+      localReady: true,
+    });
     expect(out.dispatched.map((d) => d.type)).toEqual(['WarmBlobs', 'PrimeCircuit', 'AdoptPendingWrites', 'LifecycleTick', 'StartRemote']);
     // The view index is loaded before anything can paint; the first GC waits out the boot.
     expect(out.state.views).toEqual(new Map([['k', ['t:1']]]));
     expect(out.timers.get('gc')).toEqual({ ms: 30_000, event: { type: 'GcTick' } });
     expect(svc.names()).not.toContain('remote.connect');
   });
-  it('a reload keeps the salt its tab left for the same principal', async () => {
+  it('a reload keeps the salt its tab left for the same principal, and the owner secret its views answer to', async () => {
     const svc = fakeServices({
       'hint.read': () => 'u1',
       'auth.restoreSession': async () => 'user:u1',
       'auth.sessionAuthId': () => 'user:u1',
-      'salt.take': () => 'kept-salt',
+      'salt.take': () => ({ salt: 'kept-salt', owner: 'kept-owner' }),
     });
     const out = await runPure(boot(env, { sharedTabs: false }), { handlers: { service: svc.handler, 'local.query': () => [] } });
     expect(svc.calls).toContainEqual(['salt.take', ['user:u1']]);
     expect(svc.calls).toContainEqual(['crdt.setSessionId', ['kept-salt']]);
-    expect(out.state).toMatchObject({ sessionId: 'kept-salt', saltUserId: 'user:u1' });
+    expect(out.state).toMatchObject({ sessionId: 'kept-salt', saltUserId: 'user:u1', ownerSecret: 'kept-owner' });
+    expect(out.log.filter((e) => e.kind === 'id')).toEqual([]);
+  });
+  it('a salt left by a page that kept no owner secret gets a fresh one', async () => {
+    const svc = fakeServices({
+      'hint.read': () => null,
+      'auth.restoreSession': async () => null,
+      'auth.sessionAuthId': () => null,
+      'salt.take': () => ({ salt: 'kept-salt', owner: null }),
+    });
+    const out = await runPure(boot(env, { sharedTabs: false }), { handlers: { service: svc.handler, 'local.query': () => [] } });
+    expect(out.state).toMatchObject({ sessionId: 'kept-salt', ownerSecret: 'owner-1' });
   });
   it('shared tabs: takes the role from the coordinator, or falls back to solo; schemaless engines skip provisioning; anonymous skips session auth', async () => {
     const leader = fakeServices({ 'hint.read': () => null, 'tabs.start': async () => 'leader', 'local.usesSurqlSchema': () => false, 'auth.restoreSession': async () => null, 'auth.sessionAuthId': () => null });
@@ -146,12 +164,17 @@ describe('startRemote / primeCircuit / versionsPrimed / pageHide / warmBlobs', (
     expect(f.state.primed).toBe(true);
     expect(f.emitted).toEqual([expect.objectContaining({ level: 'warn' })]);
   });
-  it('pageHide leaves the salt for a reload before releasing views', async () => {
+  it('pageHide leaves the salt and owner secret for a reload before releasing views', async () => {
     const svc = fakeServices();
-    const s = { ...buildState([buildEntry({ def: { hash: 'a' }, lifecycle: { remote: 'registered' } })]), sessionId: 'salt-1', saltUserId: 'user:u1' };
+    const s = {
+      ...buildState([buildEntry({ def: { hash: 'a' }, lifecycle: { remote: 'registered' } })]),
+      sessionId: 'salt-1',
+      saltUserId: 'user:u1',
+      ownerSecret: 'owner-1',
+    };
     await runPure(pageHide(), { state: s, handlers: { service: svc.handler } });
     expect(svc.calls).toEqual([
-      ['salt.leave', ['salt-1', 'user:u1']],
+      ['salt.leave', ['salt-1', 'user:u1', 'owner-1']],
       ['remote.releaseViews', [[new RecordId('_00_query', 'a')]]],
     ]);
   });

package/src/boot/boot.saga.ts

@@ -44,9 +44,12 @@ export function* boot(env: SagaEnv, opts: BootOptions): Saga<void> {
 
   const restoredUserId = (yield fx.service('auth.restoreSession')) as string | null;
   const authId = (yield fx.service('auth.sessionAuthId')) as string | null;
-  // A reload keeps the salt its tab had, so registrations land on warm views.
-  const salt = (((yield fx.service('salt.take', authId)) as string | null) ?? (yield fx.id('salt'))) as string;
-  yield fx.state.update(R.setIdentity({ sessionId: salt, userId: restoredUserId, saltUserId: authId }));
+  // A reload keeps the salt its tab had, so registrations land on warm views,
+  // and the owner secret those views answer to.
+  const left = (yield fx.service('salt.take', authId)) as { salt: string; owner: string | null } | null;
+  const salt = (left?.salt ?? (yield fx.id('salt'))) as string;
+  const ownerSecret = (left?.owner ?? (yield fx.id('owner'))) as string;
+  yield fx.state.update(R.setIdentity({ sessionId: salt, userId: restoredUserId, saltUserId: authId, ownerSecret }));
   yield fx.service('crdt.setSessionId', salt);
   if (restoredUserId) yield fx.service('ssp.setSessionAuth', authId, (yield fx.service('auth.access')) as string | null);
 
@@ -123,12 +126,13 @@ export function* versionsPrimed(entries: Array<readonly [string, number]>): Saga
  * grace finds its views still warm.
  */
 export function* pageHide(): Saga<void> {
-  const [salt, saltUserId, ids] = (yield fx.state.read((s) => [
+  const [salt, saltUserId, ownerSecret, ids] = (yield fx.state.read((s) => [
     s.sessionId,
     s.saltUserId,
+    s.ownerSecret,
     [...s.queries.values()].filter((e) => e.lifecycle.remote === 'registered').map((e) => e.def.id),
-  ])) as [string | null, string | null, unknown[]];
-  if (salt) yield fx.service('salt.leave', salt, saltUserId);
+  ])) as [string | null, string | null, string | null, unknown[]];
+  if (salt) yield fx.service('salt.leave', salt, saltUserId, ownerSecret);
   if (ids.length > 0) yield fx.service('remote.releaseViews', ids);
 }
 

package/src/client/services.test.ts

@@ -25,7 +25,7 @@ describe('reload salt', () => {
 
   it('a salt left on the way out is taken once, by the same principal', () => {
     leaveReloadSalt('s1', 'user:a');
-    expect(takeReloadSalt('user:a')).toEqual({ salt: 's1', sessionIds: [] });
+    expect(takeReloadSalt('user:a')).toEqual({ salt: 's1', sessionIds: [], owner: null });
     // Taken, not read: a tab duplicated from this page finds nothing.
     expect(takeReloadSalt('user:a')).toBeNull();
   });
@@ -34,9 +34,23 @@ describe('reload salt', () => {
     // The reloaded page's views keep edges stamped by these sockets, and the
     // anonymous LIVE only hears sessions it knows.
     leaveReloadSalt('s1', null, ['sid-1', 'sid-2']);
-    expect(takeReloadSalt(null)).toEqual({ salt: 's1', sessionIds: ['sid-1', 'sid-2'] });
+    expect(takeReloadSalt(null)).toEqual({ salt: 's1', sessionIds: ['sid-1', 'sid-2'], owner: null });
     (g.sessionStorage as MemoryStorage).setItem('sp00ky:salt', JSON.stringify({ salt: 's2', authId: null, sessionIds: ['ok', 7, null] }));
-    expect(takeReloadSalt(null)).toEqual({ salt: 's2', sessionIds: ['ok'] });
+    expect(takeReloadSalt(null)).toEqual({ salt: 's2', sessionIds: ['ok'], owner: null });
+  });
+
+  it("the page's owner secret travels with the salt, so the reloaded page still owns its anonymous views", () => {
+    leaveReloadSalt('s1', null, [], 'secret-1');
+    expect(takeReloadSalt(null)).toEqual({ salt: 's1', sessionIds: [], owner: 'secret-1' });
+    // Gone with the salt: a duplicated tab mints its own.
+    expect(takeReloadSalt(null)).toBeNull();
+    // A different principal re-salts, and the secret is not handed over either.
+    leaveReloadSalt('s2', 'user:a', [], 'secret-2');
+    expect(takeReloadSalt(null)).toBeNull();
+    for (const owner of ['', 7, null]) {
+      (g.sessionStorage as MemoryStorage).setItem('sp00ky:salt', JSON.stringify({ salt: 's3', authId: null, owner }));
+      expect(takeReloadSalt(null)?.owner).toBeNull();
+    }
   });
 
   it('another principal, or none, mints a fresh salt', () => {

package/src/client/services.ts

@@ -26,7 +26,7 @@ import { MemoryBlobStore, createBlobCache, resolveBlobBudget } from '../services
 import type { Adapters } from '../kernel/interpreter';
 import type { RuntimeEvent } from '../kernel/events';
 import type { ServiceCalls } from '../kernel/effects';
-import { encodeRecordId } from '../utils/index';
+import { encodeRecordId, mintOwnerSecret } from '../utils/index';
 import { sha256Hex } from '../utils/sha256';
 import { leaveViewsBeacon, listRefLive } from '../query/sql';
 import { hashOfEdge, rowOfEdge } from '../utils/edges';
@@ -59,20 +59,28 @@ const RELOAD_SALT_KEY = 'sp00ky:salt';
  * query onto the `_00_query` row it already had, which the SSP answers from
  * the live view instead of building a new one.
  *
+ * The page's owner secret travels with it: an anonymous row answers only to
+ * the secret it was registered with, so the next page needs the same one to
+ * rejoin those views. `null` from a page that predates it; the next page then
+ * mints one, and the rows it left (which hold no secret) take the new one.
+ *
  * Taken, not read: the key is absent while a page lives, so a duplicated tab
  * (which copies sessionStorage) mints its own salt rather than sharing this
  * tab's remote views.
  */
-export function takeReloadSalt(authId: string | null): { salt: string; sessionIds: string[] } | null {
+export function takeReloadSalt(
+  authId: string | null
+): { salt: string; sessionIds: string[]; owner: string | null } | null {
   try {
     if (typeof sessionStorage === 'undefined') return null;
     const raw = sessionStorage.getItem(RELOAD_SALT_KEY);
     if (raw === null) return null;
     sessionStorage.removeItem(RELOAD_SALT_KEY);
-    const left = JSON.parse(raw) as { salt?: unknown; authId?: unknown; sessionIds?: unknown };
+    const left = JSON.parse(raw) as { salt?: unknown; authId?: unknown; sessionIds?: unknown; owner?: unknown };
     if (typeof left.salt !== 'string' || left.salt === '' || (left.authId ?? null) !== authId) return null;
     const sessionIds = Array.isArray(left.sessionIds) ? left.sessionIds.filter((sid): sid is string => typeof sid === 'string') : [];
-    return { salt: left.salt, sessionIds };
+    const owner = typeof left.owner === 'string' && left.owner !== '' ? left.owner : null;
+    return { salt: left.salt, sessionIds, owner };
   } catch {
     return null;
   }
@@ -84,11 +92,17 @@ export function takeReloadSalt(authId: string | null): { salt: string; sessionId
  * The session ids of this page's sockets go with it. The views the next page
  * re-registers keep the edges this page's sockets stamped, and the anonymous
  * LIVE only hears edges stamped by a session it knows (see `listRefLive`).
+ * So does the page's owner secret, which those views answer to.
  */
-export function leaveReloadSalt(salt: string, authId: string | null, sessionIds: ReadonlyArray<string> = []): void {
+export function leaveReloadSalt(
+  salt: string,
+  authId: string | null,
+  sessionIds: ReadonlyArray<string> = [],
+  owner: string | null = null
+): void {
   try {
     if (typeof sessionStorage !== 'undefined')
-      sessionStorage.setItem(RELOAD_SALT_KEY, JSON.stringify({ salt, authId, sessionIds }));
+      sessionStorage.setItem(RELOAD_SALT_KEY, JSON.stringify({ salt, authId, sessionIds, owner }));
   } catch {
     /* private-mode storage errors: the next page mints a fresh salt */
   }
@@ -268,9 +282,9 @@ export function createAdapters<S extends SchemaStructure>(config: Sp00kyConfig<S
       const left = takeReloadSalt(authId);
       if (!left) return null;
       s.remote.adoptSessionIds(left.sessionIds);
-      return left.salt;
+      return { salt: left.salt, owner: left.owner };
     },
-    'salt.leave': (salt, authId) => leaveReloadSalt(salt, authId, s.remote.sessionIds()),
+    'salt.leave': (salt, authId, owner) => leaveReloadSalt(salt, authId, s.remote.sessionIds(), owner),
     'local.connect': (bucketId) => s.local.connect(bucketId),
     'local.switchStore': (bucketId) => s.local.switchStore(bucketId),
     'local.beginSwitch': () => s.local.beginSwitch(),
@@ -411,7 +425,7 @@ export function createAdapters<S extends SchemaStructure>(config: Sp00kyConfig<S
       },
     },
     clock: { now: () => Date.now() },
-    ids: { mutation: () => mintMutationId(s.tabId), salt: mintSalt },
+    ids: { mutation: () => mintMutationId(s.tabId), salt: mintSalt, owner: mintOwnerSecret },
     hash: sha256Hex,
     services,
   };

package/src/kernel/effects.ts

@@ -53,7 +53,7 @@ export type Effect =
   | { kind: 'state.update'; fn: (s: ClientState) => ClientState }
   | { kind: 'state.wait'; until: (s: ClientState) => boolean }
   | { kind: 'now' }
-  | { kind: 'id'; scope: 'mutation' | 'salt' }
+  | { kind: 'id'; scope: IdScope }
   | { kind: 'hash'; input: string }
   | { kind: 'emit'; event: OutEvent }
   | { kind: 'dispatch'; event: RuntimeEvent }
@@ -62,6 +62,9 @@ export type Effect =
 
 export type EffectKind = Effect['kind'];
 
+/** `mutation`: an outbox row id. `salt`: a query-key salt. `owner`: a page's anonymous-view owner secret. */
+export type IdScope = 'mutation' | 'salt' | 'owner';
+
 /**
  * Calls into the legacy services that are adapters, not state: auth, tabs,
  * blobs, migrator, crdt, persistence, the SSP lifecycle, the remote socket.
@@ -70,8 +73,9 @@ export type EffectKind = Effect['kind'];
 export interface ServiceCalls {
   'hint.read': () => string | null;
   'hint.write': (bucketId: string) => void;
-  'salt.take': (authId: string | null) => string | null;
-  'salt.leave': (salt: string, authId: string | null) => void;
+  /** The salt (and owner secret) this tab's previous page left, if minted for `authId`. */
+  'salt.take': (authId: string | null) => { salt: string; owner: string | null } | null;
+  'salt.leave': (salt: string, authId: string | null, owner: string | null) => void;
   'local.connect': (bucketId: string) => Promise<void>;
   'local.switchStore': (bucketId: string) => Promise<void>;
   'local.beginSwitch': () => () => void;
@@ -154,7 +158,7 @@ export const fx = {
     wait: (until: (s: ClientState) => boolean): Effect => ({ kind: 'state.wait', until }),
   },
   now: (): Effect => ({ kind: 'now' }),
-  id: (scope: 'mutation' | 'salt'): Effect => ({ kind: 'id', scope }),
+  id: (scope: IdScope): Effect => ({ kind: 'id', scope }),
   hash: (input: string): Effect => ({ kind: 'hash', input }),
   emit: (event: OutEvent): Effect => ({ kind: 'emit', event }),
   dispatch: (event: RuntimeEvent): Effect => ({ kind: 'dispatch', event }),

package/src/kernel/interpreter.ts

@@ -4,7 +4,7 @@ import type { IngestRecord, StreamUpdate } from '../services/stream-processor/in
 import type { ClientState } from '../state/client-state';
 import type { InlineRow } from '../types';
 import { withTimeout } from '../utils/index';
-import type { Effect, RegisterResult, ServiceCalls, Settled, StatementResult } from './effects';
+import type { Effect, IdScope, RegisterResult, ServiceCalls, Settled, StatementResult } from './effects';
 import type { OutEvent, RuntimeEvent } from './events';
 
 /** The five adapters plus the pure ports, as the interpreter sees them. */
@@ -36,7 +36,7 @@ export interface Adapters {
   };
   timers: { set(key: string, ms: number, fire: () => void): void; clear(key: string): void };
   clock: { now(): number };
-  ids: { mutation(): string; salt(): string };
+  ids: Record<IdScope, () => string>;
   hash(input: string): Promise<string>;
   services: ServiceCalls;
 }
@@ -127,7 +127,7 @@ export function createInterpreter(adapters: Adapters, host: InterpreterHost): In
       case 'now':
         return adapters.clock.now();
       case 'id':
-        return effect.scope === 'mutation' ? adapters.ids.mutation() : adapters.ids.salt();
+        return adapters.ids[effect.scope]();
       case 'hash':
         return adapters.hash(effect.input);
       case 'emit':

package/src/live/index.test.ts

@@ -187,7 +187,12 @@ describe('createLiveFeed', () => {
     const input = (client as any).registerInput('notification', q.innerQuery, '10m');
     const env = defaultEnv(schema);
     const local = await runPure(registerLocal(env, input), {
-      state: { ...emptyState({ tabId: 't' }), sessionId: 'sess', userId: 'user:alice' },
+      state: {
+        ...emptyState({ tabId: 't' }),
+        sessionId: 'sess',
+        userId: 'user:alice',
+        ownerSecret: 'owner-k',
+      },
       handlers: {
         'local.getById': () => null,
         'ssp.register': () => ({
@@ -208,7 +213,7 @@ describe('createLiveFeed', () => {
     });
 
     const fake = new FakeSurreal();
-    const feed = feedWith(fake);
+    const feed = feedWith(fake, { ownerSecret: 'owner-k' });
     const sub = feed.subscribe(q, { onSet: () => {} });
     await sub.ready;
     const reg = fake.calls.find((c) => c.sql.startsWith('fn::query::register'))!;
@@ -409,7 +414,13 @@ describe('createLiveFeed', () => {
       fake.heartbeatGone = true;
       await vi.advanceTimersByTimeAsync(10_000);
       expect(fake.calls.some((c) => c.sql.startsWith('fn::query::heartbeat($id0)'))).toBe(true);
-      expect(fake.calls.filter((c) => c.sql.startsWith('fn::query::register'))).toHaveLength(2);
+      const registers = fake.calls.filter((c) => c.sql.startsWith('fn::query::register'));
+      expect(registers).toHaveLength(2);
+      // The re-registration proves it owns the view with the secret it was
+      // registered with (a fresh one per feed, at least 256 bits).
+      const owners = registers.map((c) => (c.vars!.config as { owner?: string }).owner);
+      expect(owners[0]).toMatch(/^[0-9a-f]{64}$/);
+      expect(owners[1]).toBe(owners[0]);
       await feed.close();
     } finally {
       vi.useRealTimers();

package/src/live/index.ts

@@ -10,7 +10,8 @@
  * - `fn::query::register($config)` plus the membership read-back in one
  *   request (`registerSelect` / `registerVars`, the same builders the full
  *   client's `registerRemote` uses; `$config = { id: _00_query:<key>, surql,
- *   params, ttl }`, key = sha256(JSON.stringify({ surql, params, sessionId })));
+ *   params, ttl, owner }`, key = sha256(JSON.stringify({ surql, params,
+ *   sessionId })), owner = the feed's `ownerSecret`);
  * - bodies with `SELECT * FROM $ids`;
  * - one `LIVE SELECT * FROM <the user's _00_list_ref table> FETCH out` per
  *   feed (on the shared anon table, filtered to the feed's own edges; see
@@ -48,7 +49,13 @@ import { decodeTokenClaims } from '../modules/auth/impersonation';
 import { hashOfEdge, rowOfEdge } from '../utils/edges';
 import { sha256Hex } from '../utils/sha256';
 import { parseQueryParams } from '../utils/parser';
-import { encodeRecordId, parseDuration, parseRecordIdString, withTimeout } from '../utils/index';
+import {
+  encodeRecordId,
+  mintOwnerSecret,
+  parseDuration,
+  parseRecordIdString,
+  withTimeout,
+} from '../utils/index';
 
 export type LiveToken = string | null | undefined;
 /** A token, or a function returning one (called on every connect). */
@@ -92,6 +99,14 @@ export interface LiveFeedOptions {
   ttl?: string;
   /** Salt of the `_00_query` keys. Default: a fresh random id per feed. */
   sessionId?: string;
+  /**
+   * The secret the feed's registrations prove they own their views with
+   * (`$config.owner`): a signed-out feed's view answers only to the secret it
+   * was registered with. Default: a fresh one per feed. Pass the same one
+   * wherever you pass the same `sessionId`, or the second registrant of a
+   * shared anonymous view is refused.
+   */
+  ownerSecret?: string;
   /**
    * The generated schema. Used to type query params (record ids, datetimes)
    * exactly like the full client does before registering. Taken from a query
@@ -384,6 +399,7 @@ class Feed implements LiveFeed {
   private liveStarting: Promise<boolean> | null = null;
   private readonly subs = new Map<string, SubState>();
   private readonly sessionId: string;
+  private readonly ownerSecret: string;
   /** `session::id()` of every socket this feed has had, oldest first. */
   private sockets: string[] = [];
   private readonly ttl: string;
@@ -403,6 +419,7 @@ class Feed implements LiveFeed {
 
   constructor(private readonly options: LiveFeedOptions) {
     this.sessionId = options.sessionId ?? randomId();
+    this.ownerSecret = options.ownerSecret ?? mintOwnerSecret();
     this.ttl = options.ttl ?? '10m';
     this.timeoutMs = options.timeoutMs ?? 15_000;
   }
@@ -804,7 +821,10 @@ class Feed implements LiveFeed {
 
   /** Register (or re-register) a view and read its membership back, in one request. */
   private async register(sub: SubState): Promise<Snapshot> {
-    const results = await this.q(registerSelect(this.table!), registerVars(sub.payload));
+    const results = await this.q(
+      registerSelect(this.table!),
+      registerVars({ ...sub.payload, owner: this.ownerSecret })
+    );
     let snap = snapshotAt(results, 1);
     for (let i = 0; snap && snap.state === 'materializing' && i < MATERIALIZE_RETRIES; i++) {
       await sleep(MATERIALIZE_RETRY_MS);

package/src/query/anon-query-isolation.integration.test.ts

@@ -1,8 +1,9 @@
-import { Socket } from 'node:net';
+import { createServer, type Server } from 'node:http';
+import { Socket, type AddressInfo } from 'node:net';
 import { createHash, randomUUID } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
-import { afterEach, beforeAll, beforeEach, describe, expect, it } from 'vitest';
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from 'vitest';
 import { RecordId, Surreal } from 'surrealdb';
 import { liveEndpoint } from '../live/index';
 import {
@@ -27,13 +28,36 @@ import {
  *     surrealdb/surrealdb:v3.1.5 start --user root --pass root --allow-all memory
  *
  * Override the endpoint with SURREAL_IT_ENDPOINT. Skips if unreachable.
+ *
+ * The registration tests also run the shipped `fn::query::register`, whose
+ * `http::post` must reach a stand-in SSP this test serves. SurrealDB reaches it
+ * at SURREAL_IT_CALLBACK_HOST (default `host.docker.internal`, the host as seen
+ * from Docker Desktop); those tests skip when it cannot.
  */
 const endpoint = liveEndpoint(process.env.SURREAL_IT_ENDPOINT ?? 'ws://127.0.0.1:18011');
+const callbackHost = process.env.SURREAL_IT_CALLBACK_HOST ?? 'host.docker.internal';
 const NS = 'it';
 
 const cliSource = (file: string) =>
   readFileSync(fileURLToPath(new URL(`../../../../apps/cli/src/${file}`, import.meta.url)), 'utf8');
 
+/**
+ * The SET clause ssp-node puts first in every registration write, read out of
+ * `packages/ssp-node/src/node.rs` so this test runs the shipped text.
+ */
+function ownerGuard(): string {
+  const src = readFileSync(
+    fileURLToPath(new URL('../../../ssp-node/src/node.rs', import.meta.url)),
+    'utf8'
+  );
+  const m = /pub const OWNER_GUARD: &str = "((?:[^"\\]|\\.)*)";/s.exec(src);
+  if (!m) throw new Error('OWNER_GUARD not found in ssp-node/src/node.rs');
+  // A Rust `\` at a line end drops the newline and the next line's indent.
+  return m[1].replace(/\\\n\s*/g, '');
+}
+
+const sha256 = (text: string) => createHash('sha256').update(text).digest('hex');
+
 /** Just the `_00_query` block: the rest of the file needs tables and modules this test does not. */
 function queryTableSchema(): string {
   const meta = cliSource('meta_tables_remote.surql');
@@ -61,6 +85,18 @@ UPSERT $id SET clientId = $sid, auth_id = $owner, surql = 'SELECT * FROM item',
     array::filter(subscribers ?? [], |$s| <string>$s.id != $sid AND <datetime>$s.seenAt + 1h > time::now()),
     { id: $sid, seenAt: time::now() })`;
 
+/**
+ * What the SSP writes, as root, when a session joins an anonymous view that
+ * already exists (`join_registered_view`), with the shipped ownership guard.
+ */
+const SSP_JOIN = () => `
+UPSERT type::record($id) SET ${ownerGuard()}, clientId = $sid, auth_id = auth_id ?? 'anon',
+  surql = surql ?? 'SELECT * FROM item', params = params ?? { auth: { id: '' }, access: '' },
+  ttl = ttl ?? 1h, lastActiveAt = time::now(), rowCount = rowCount ?? 3, state = state ?? 'ready',
+  subscribers = array::append(
+    array::filter(subscribers ?? [], |$s| <string>$s.id != $sid AND <datetime>$s.seenAt + 1h > time::now()),
+    { id: $sid, seenAt: time::now() })`;
+
 /** A `_00_query:<sha256>` id, the shape the client mints (and the pagehide beacon accepts). */
 const viewId = () =>
   new RecordId('_00_query', createHash('sha256').update(randomUUID()).digest('hex'));
@@ -71,6 +107,13 @@ describe('anonymous _00_query isolation (real SurrealDB)', () => {
   let reachable = false;
   const open: Surreal[] = [];
 
+  // The stand-in SSP: records what `fn::query::register` posts and answers it
+  // as ssp-node's warm join does (409 `owner_mismatch` when the guard throws).
+  const posted: Array<Record<string, unknown>> = [];
+  let ssp: Server | null = null;
+  let sspUrl = '';
+  let sspReachable: boolean | null = null;
+
   // A plain TCP probe: the SDK never rejects a connect to a refused port.
   beforeAll(async () => {
     const url = new URL(endpoint);
@@ -84,8 +127,58 @@ describe('anonymous _00_query isolation (real SurrealDB)', () => {
       socket.once('error', () => done(false));
       socket.connect(Number(url.port || 80), url.hostname, () => done(true));
     });
+    ssp = createServer(async (req, res) => {
+      let text = '';
+      for await (const chunk of req) text += chunk;
+      const body = JSON.parse(text) as Record<string, unknown>;
+      posted.push(body);
+      if (body.probe) return void res.writeHead(200).end('null');
+      try {
+        await root.query(SSP_JOIN(), {
+          id: body.id,
+          sid: body.clientId,
+          ownerHash: body.ownerHash ?? '',
+        });
+        res.writeHead(200, { 'content-type': 'application/json' }).end('null');
+      } catch (error) {
+        const refused = String(error).includes('owner_mismatch');
+        res
+          .writeHead(refused ? 409 : 500, { 'content-type': 'application/json' })
+          .end(
+            JSON.stringify({
+              code: refused ? 'owner_mismatch' : 'db_error',
+              message: String(error),
+            })
+          );
+      }
+    });
+    await new Promise<void>((resolve) => ssp!.listen(0, '0.0.0.0', resolve));
+    sspUrl = `http://${callbackHost}:${(ssp.address() as AddressInfo).port}`;
   });
 
+  afterAll(async () => {
+    await new Promise((resolve) => ssp?.close(resolve));
+  });
+
+  /** Load the shipped `fn::query::register` against the stand-in; false when SurrealDB cannot reach it. */
+  async function registerFunctions(): Promise<boolean> {
+    if (sspReachable === null) {
+      sspReachable = await root
+        .query('RETURN http::post($url, { probe: true })', { url: `${sspUrl}/probe` })
+        .then(
+          () => true,
+          () => false
+        );
+    }
+    if (!sspReachable) return false;
+    await root.query(
+      cliSource('functions_remote_singlenode.surql')
+        .replaceAll('{{ENDPOINT}}', sspUrl)
+        .replaceAll('{{SECRET}}', 'it-secret')
+    );
+    return true;
+  }
+
   beforeEach(async () => {
     if (!reachable) return;
     database = `anon_query_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
@@ -290,6 +383,72 @@ describe('anonymous _00_query isolation (real SurrealDB)', () => {
     expect(await readBack(b, qa)).toBeNull();
   });
 
+  it("a guest who read another guest's view id cannot join it through fn::query::register; the owner's reconnect can", async (ctx) => {
+    if (!reachable) ctx.skip();
+    if (!(await registerFunctions())) ctx.skip();
+    const [a, sidA] = await guest();
+    const [b] = await guest();
+    const qa = viewId();
+    const register = (db: Surreal, owner?: string) =>
+      db.query('fn::query::register($config)', {
+        config: {
+          id: qa,
+          surql: 'SELECT * FROM item',
+          params: {},
+          ttl: '1h',
+          ...(owner ? { owner } : {}),
+        },
+      });
+
+    await register(a, 'secret-a');
+    const sent = posted.at(-1)!;
+    expect(sent).toMatchObject({ clientId: sidA, ownerHash: sha256('secret-a') });
+    // Only the hash leaves the database, and never inside `params` (the SSP's
+    // merge key is built from them).
+    expect(JSON.stringify(sent)).not.toContain('secret-a');
+    expect(String(sent.params)).not.toContain(sha256('secret-a'));
+    const before = await row(qa);
+    expect(before?.ownerHash).toBe(sha256('secret-a'));
+
+    // Anonymous view ids are world-readable on `_00_list_ref_anon`. With its
+    // own secret or with none, the stranger's registration is refused, so it
+    // never lands in `subscribers` and its DELETE still matches nothing.
+    await expect(register(b, 'secret-b')).rejects.toThrow();
+    await expect(register(b)).rejects.toThrow();
+    await b.query('DELETE $id', { id: qa });
+    expect(await row(qa)).toEqual(before);
+    expect(await readBack(b, qa)).toBeNull();
+
+    // The owner's reconnect: a new socket, the same page secret.
+    await a.close();
+    const [a2, sidA2] = await guest();
+    expect(await heartbeatFound(a2, qa)).toBe(false);
+    await register(a2, 'secret-a');
+    expect((await row(qa))?.subscribers.map((s: { id: string }) => s.id)).toEqual([sidA, sidA2]);
+    expect(await heartbeatFound(a2, qa)).toBe(true);
+    expect(await readBack(a2, qa)).toEqual({ rowCount: 3, state: 'ready' });
+  });
+
+  it('no caller can read or rewrite the owner hash, not even the owner', async (ctx) => {
+    if (!reachable) ctx.skip();
+    const [g, sidG] = await guest();
+    const qg = viewId();
+    await register(qg, sidG);
+    await root.query(`UPDATE $id SET ownerHash = 'stored'`, { id: qg });
+
+    const [own] = (await g.query('SELECT * FROM ONLY $id', { id: qg })) as [
+      Record<string, unknown>,
+    ];
+    expect(own.subscribers).toBeDefined();
+    expect(own).not.toHaveProperty('ownerHash');
+    for (const set of [`ownerHash = 'mine'`, 'ownerHash = NONE']) {
+      await g.query(`UPDATE $id SET ${set}`, { id: qg });
+      expect((await row(qg))?.ownerHash).toBe('stored');
+    }
+    // The heartbeat still writes what it needs to around the frozen field.
+    expect(await heartbeatFound(g, qg)).toBe(true);
+  });
+
   it('the owning guest can still release its view', async (ctx) => {
     if (!reachable) ctx.skip();
     const [a, sidA] = await guest();

package/src/query/register.saga.ts

@@ -161,7 +161,13 @@ export function* registerRemote(env: SagaEnv, hash: QueryHash, retry = false): S
     const table = listRefTable(env, state);
     const results = (yield fx.remote.query(
       sql.registerSelect(table),
-      sql.registerVars({ id: entry.def.id, surql: entry.def.surql, params: { ...entry.def.params }, ttl: entry.def.ttl }),
+      sql.registerVars({
+        id: entry.def.id,
+        surql: entry.def.surql,
+        params: { ...entry.def.params },
+        ttl: entry.def.ttl,
+        ...(state.ownerSecret ? { owner: state.ownerSecret } : {}),
+      }),
       env.remoteTimeoutMs
     )) as StatementResult[];
     const stillThere = (yield fx.state.read((s) => s.queries.has(hash))) as boolean;

package/src/query/sql.test.ts

@@ -39,6 +39,12 @@ describe('query sql builders (golden against the previous builders)', () => {
       config: { id, surql: 's', params: { a: 1 }, ttl: '10m' },
       in: id,
     });
+    // The owner secret rides beside params, never inside them: params name
+    // the computation the SSP shares between views.
+    expect(sql.registerVars({ id, surql: 's', params: { a: 1 }, ttl: '10m', owner: 'k' })).toEqual({
+      config: { id, surql: 's', params: { a: 1 }, ttl: '10m', owner: 'k' },
+      in: id,
+    });
   });
   it('the LIVE on a per-user table is unfiltered; FETCH out only when bodies ride inline', () => {
     expect(sql.listRefLive('_00_list_ref_user_x', { inlineBodies: true, sessionIds: ['s1'] })).toEqual({

package/src/query/sql.ts

@@ -93,6 +93,14 @@ export interface RegisterPayload {
   surql: string;
   params: Record<string, unknown>;
   ttl: string;
+  /**
+   * The registering page's secret. `fn::query::register` forwards only its
+   * hash, and the SSP lets a registration onto an existing anonymous view
+   * only with the hash that view was registered with: every signed-out
+   * visitor is `anon`, and anyone can read an anonymous view's id. Kept out
+   * of `params`, which name the computation the SSP shares between views.
+   */
+  owner?: string;
 }
 
 /** Register + read back edges/meta/children in ONE request. */

package/src/state/client-state.ts

@@ -114,6 +114,13 @@ export interface ClientState {
   readonly userId: string | null;
   /** The principal the current session salt was minted for. */
   readonly saltUserId: string | null;
+  /**
+   * This page's secret, sent with every registration (`$config.owner`). An
+   * anonymous view answers only to the secret it was registered with, so it
+   * lives as long as the page's views: a reconnect keeps it, and a reload
+   * that keeps the salt keeps it too.
+   */
+  readonly ownerSecret: string | null;
   /** Latest bucket-switch target; an older switch that wakes up to a newer target skips. */
   readonly pendingBucket: string | null;
   readonly tabId: string;
@@ -167,6 +174,7 @@ export function emptyState(init: { tabId: string }): ClientState {
     sessionId: null,
     userId: null,
     saltUserId: null,
+    ownerSecret: null,
     pendingBucket: null,
     tabId: init.tabId,
     tabRole: 'solo',

package/src/state/reducers.ts

@@ -444,7 +444,10 @@ export const setFailedCount =
 export const setIdentity =
   (
     patch: Partial<
-      Pick<ClientState, 'sessionId' | 'userId' | 'saltUserId' | 'pendingBucket' | 'bucketId' | 'tabRole' | 'localReady' | 'primed'>
+      Pick<
+        ClientState,
+        'sessionId' | 'userId' | 'saltUserId' | 'ownerSecret' | 'pendingBucket' | 'bucketId' | 'tabRole' | 'localReady' | 'primed'
+      >
     >
   ): Reducer =>
   (s) => ({ ...s, ...patch });

package/src/testing/adapters.ts

@@ -78,7 +78,11 @@ export function fakeAdapters(over: {
       clear: (key) => void timers.pending.delete(key),
     },
     clock: { now: () => now },
-    ids: { mutation: () => `_00_pending_mutations:${String(++ids).padStart(13, '0')}_0001_tab`, salt: () => `salt-${++ids}` },
+    ids: {
+      mutation: () => `_00_pending_mutations:${String(++ids).padStart(13, '0')}_0001_tab`,
+      salt: () => `salt-${++ids}`,
+      owner: () => `owner-${++ids}`,
+    },
     hash: sha256Hex,
     services,
   };

package/src/utils/index.ts

@@ -51,6 +51,17 @@ export function generateId(): string {
   return Uuid.v4().toString().replace(/-/g, '');
 }
 
+/**
+ * 32 random bytes, hex: the secret a page proves it owns its anonymous views
+ * with (`$config.owner` on `fn::query::register`). `getRandomValues` rather
+ * than `randomUUID`, which a page served over plain http does not have.
+ */
+export function mintOwnerSecret(): string {
+  const bytes = new Uint8Array(32);
+  globalThis.crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+}
+
 export function generateNewTableId<S extends SchemaStructure, T extends TableNames<S>>(
   tableName: T
 ): RecordId {