@spooky-sync/core 0.0.1-canary.321 → 0.0.1-canary.323

package/AGENTS.md

@@ -42,7 +42,7 @@ re-materialized from state, never patched in place.
 - Types: `Sp00kyConfig` (client-solid wraps it as `SyncedDbConfig`), `QueryTimeToLive`, `PersistenceClient`, `StoreType`, `UpdateOptions`, `RunOptions`, `PreloadOptions`.
 - Subpath: `@spooky-sync/core/otel` — `createOtelTransmit(endpoint)` for piping pino logs to OpenTelemetry.
 - `client.webPush` (`WebPushModule`, `db.webPush` in the Solid bindings) - Web Push on the page: `support()`, `info()`, `subscribe(opts)` (call from a click), `unsubscribe(opts)`, `sync()`, `isSubscribed()`, `update(opts)`, `devices()`, `notify(msg)`, `cancel(id)`, `test()`, `bridge()`, `onMessage(cb)`. Server calls are `fn::push::*`; typed `WebPushError`; config `webPush` in `types.ts`. Sign-out runs through `AuthService.onBeforeSignOut`.
-- Subpaths for service workers, workers and Node (no wasm, no pino, no DOM; `scripts/check-worker-entries.mjs` enforces it in `build`): `@spooky-sync/core/pure` (protocol builders), `@spooky-sync/core/live` (`createLiveFeed`, the live subscriber over the pure-JS SDK), `@spooky-sync/core/sw` (`installPushHandlers`, `getBridgedToken`). Built by the second tsdown config; chunks are prefixed `worker-`. See `docs/web-push-design.md` at the repo root.
+- Subpaths for service workers, workers and Node (no wasm, no pino, no DOM; `scripts/check-worker-entries.mjs` enforces it in `build`): `@spooky-sync/core/pure` (protocol builders), `@spooky-sync/core/live` (`createLiveFeed`, the live subscriber over the pure-JS SDK; a feed that shares views with another through the same `sessionId` must also pass the same `ownerSecret`, or a signed-out feed's second registration is refused 409 `owner_mismatch`), `@spooky-sync/core/sw` (`installPushHandlers`, `getBridgedToken`). Built by the second tsdown config; chunks are prefixed `worker-`. See `docs/web-push-design.md` at the repo root.
 
 ## Common gotchas
 

package/dist/index.d.ts

@@ -303,6 +303,10 @@ interface CircuitPrimeContext {
   /** Encoded ids with an unsettled local mutation (their `_00_rv` was bumped
    *  locally and may exceed the server's next version). */
   pendingIds: Set<string>;
+  /** Each table's client column set (`columnFingerprints`). An engine that
+   *  keeps bodies across schema changes resets the versions of a table whose
+   *  set changed before they are read, so its rows are fetched again whole. */
+  columnFingerprints?: Record<string, string>;
   /** Receives every `(id, rv)` the prime put into the circuit, per table, so
    *  the sync layer can skip re-downloading bodies it already has. */
   onVersions?: (table: string, entries: [string, number][]) => void;
@@ -1123,7 +1127,7 @@ type Effect = {
   kind: 'now';
 } | {
   kind: 'id';
-  scope: 'mutation' | 'salt';
+  scope: IdScope;
 } | {
   kind: 'hash';
   input: string;
@@ -1141,6 +1145,8 @@ type Effect = {
   name: ServiceName;
   args: unknown[];
 };
+/** `mutation`: an outbox row id. `salt`: a query-key salt. `owner`: a page's anonymous-view owner secret. */
+type IdScope = 'mutation' | 'salt' | 'owner';
 /**
  * Calls into the legacy services that are adapters, not state: auth, tabs,
  * blobs, migrator, crdt, persistence, the SSP lifecycle, the remote socket.
@@ -1149,8 +1155,12 @@ type Effect = {
 interface ServiceCalls {
   'hint.read': () => string | null;
   'hint.write': (bucketId: string) => void;
-  'salt.take': (authId: string | null) => string | null;
-  'salt.leave': (salt: string, authId: string | null) => void;
+  /** The salt (and owner secret) this tab's previous page left, if minted for `authId`. */
+  'salt.take': (authId: string | null) => {
+    salt: string;
+    owner: string | null;
+  } | null;
+  'salt.leave': (salt: string, authId: string | null, owner: string | null) => void;
   'local.connect': (bucketId: string) => Promise<void>;
   'local.switchStore': (bucketId: string) => Promise<void>;
   'local.beginSwitch': () => () => void;
@@ -1309,6 +1319,13 @@ interface ClientState {
   readonly userId: string | null;
   /** The principal the current session salt was minted for. */
   readonly saltUserId: string | null;
+  /**
+   * This page's secret, sent with every registration (`$config.owner`). An
+   * anonymous view answers only to the secret it was registered with, so it
+   * lives as long as the page's views: a reconnect keeps it, and a reload
+   * that keeps the salt keeps it too.
+   */
+  readonly ownerSecret: string | null;
   /** Latest bucket-switch target; an older switch that wakes up to a newer target skips. */
   readonly pendingBucket: string | null;
   readonly tabId: string;
@@ -1428,10 +1445,7 @@ interface Adapters {
   clock: {
     now(): number;
   };
-  ids: {
-    mutation(): string;
-    salt(): string;
-  };
+  ids: Record<IdScope, () => string>;
   hash(input: string): Promise<string>;
   services: ServiceCalls;
 }

package/dist/index.js

@@ -569,6 +569,16 @@ function generateId() {
 	return Uuid.v4().toString().replace(/-/g, "");
 }
 /**
+* 32 random bytes, hex: the secret a page proves it owns its anonymous views
+* with (`$config.owner` on `fn::query::register`). `getRandomValues` rather
+* than `randomUUID`, which a page served over plain http does not have.
+*/
+function mintOwnerSecret() {
+	const bytes = new Uint8Array(32);
+	globalThis.crypto.getRandomValues(bytes);
+	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
 * Read the millisecond count off a surrealdb `Duration`. Different `surrealdb`
 * releases expose it under `milliseconds` (current) or the older private
 * `_milliseconds` field, so read whichever is set; returns 0 when neither is.
@@ -2178,8 +2188,8 @@ function trimHistory(history, cap) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.321";
-const WASM_VERSION = "0.0.1-canary.321";
+const CORE_VERSION = "0.0.1-canary.323";
+const WASM_VERSION = "0.0.1-canary.323";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class DevToolsService {
 	version = CORE_VERSION;
@@ -3989,6 +3999,7 @@ function emptyState(init) {
 		sessionId: null,
 		userId: null,
 		saltUserId: null,
+		ownerSecret: null,
 		pendingBucket: null,
 		tabId: init.tabId,
 		tabRole: "solo",
@@ -4825,7 +4836,8 @@ function* registerRemote(env, hash, retry = false) {
 			id: entry.def.id,
 			surql: entry.def.surql,
 			params: { ...entry.def.params },
-			ttl: entry.def.ttl
+			ttl: entry.def.ttl,
+			...state.ownerSecret ? { owner: state.ownerSecret } : {}
 		}), env.remoteTimeoutMs);
 		if (!(yield fx.state.read((s) => s.queries.has(hash)))) return;
 		const register = stmt(results, 0);
@@ -5873,11 +5885,14 @@ function* boot(env, opts) {
 	yield fx.dispatch({ type: "PrimeCircuit" });
 	const restoredUserId = yield fx.service("auth.restoreSession");
 	const authId = yield fx.service("auth.sessionAuthId");
-	const salt = (yield fx.service("salt.take", authId)) ?? (yield fx.id("salt"));
+	const left = yield fx.service("salt.take", authId);
+	const salt = left?.salt ?? (yield fx.id("salt"));
+	const ownerSecret = left?.owner ?? (yield fx.id("owner"));
 	yield fx.state.update(setIdentity({
 		sessionId: salt,
 		userId: restoredUserId,
-		saltUserId: authId
+		saltUserId: authId,
+		ownerSecret
 	}));
 	yield fx.service("crdt.setSessionId", salt);
 	if (restoredUserId) yield fx.service("ssp.setSessionAuth", authId, yield fx.service("auth.access"));
@@ -5972,12 +5987,13 @@ function* versionsPrimed(entries) {
 * grace finds its views still warm.
 */
 function* pageHide() {
-	const [salt, saltUserId, ids] = yield fx.state.read((s) => [
+	const [salt, saltUserId, ownerSecret, ids] = yield fx.state.read((s) => [
 		s.sessionId,
 		s.saltUserId,
+		s.ownerSecret,
 		[...s.queries.values()].filter((e) => e.lifecycle.remote === "registered").map((e) => e.def.id)
 	]);
-	if (salt) yield fx.service("salt.leave", salt, saltUserId);
+	if (salt) yield fx.service("salt.leave", salt, saltUserId, ownerSecret);
 	if (ids.length > 0) yield fx.service("remote.releaseViews", ids);
 }
 function* warmBlobs() {
@@ -6084,7 +6100,7 @@ function createInterpreter(adapters, host) {
 			}
 			case "state.wait": return host.waitFor(effect.until, ctx?.signal);
 			case "now": return adapters.clock.now();
-			case "id": return effect.scope === "mutation" ? adapters.ids.mutation() : adapters.ids.salt();
+			case "id": return adapters.ids[effect.scope]();
 			case "hash": return adapters.hash(effect.input);
 			case "emit": return host.emit(effect.event);
 			case "dispatch": return host.dispatch(effect.event);
@@ -9611,6 +9627,84 @@ var PortSqliteTransport = class extends BaseTransport {
 	}
 };
 
+//#endregion
+//#region src/services/database/sqlite-column-reset.ts
+/**
+* Cached bodies outlive a schema change on the SQLite engine, and that loses
+* columns for good.
+*
+* A body is landed through `cleanRecord`, which keeps only the columns the
+* running app's schema declares, and is stored at the server's `_00_rv`. The
+* engine is schemaless (no migrator, nothing is recreated when the schema
+* changes), so a tab on an older build that fetched a row after the server
+* added and backfilled a column stored it WITHOUT that column at the new
+* version. The next build knows the column, but its local version equals the
+* server's, so the fetch plan never asks for the row again and the column
+* stays missing until something else bumps the row. (WhitePawn, 2026-10-11:
+* every puzzle read as unconverted because `layout` never arrived.)
+*
+* So the store remembers each table's column set (`_00_schema`, row
+* `columns`). On boot, before the prime reads the versions, a table whose set
+* changed, or every table when no set was recorded yet, gets its cached
+* `_00_rv` reset to 0. The bodies stay and keep rendering; any view that names
+* one of those rows sees it as stale and fetches it again, whole. Rows with an
+* unsettled local write keep their version: their echo is a newer body anyway.
+*/
+/** `_00_schema` row holding the recorded column sets. */
+const COLUMNS_ROW_ID = "columns";
+/**
+* The column set of every table, as `cleanRecord` sees it: the sorted declared
+* column names. Plain names rather than a hash, so a stored set says what it is.
+*/
+function columnFingerprints(tables) {
+	const out = {};
+	for (const t of tables) out[t.name] = Object.keys(t.columns).sort().join(",");
+	return out;
+}
+const sameSets = (a, b) => {
+	if (!a) return false;
+	const ka = Object.keys(a);
+	return ka.length === Object.keys(b).length && ka.every((k) => a[k] === b[k]);
+};
+/**
+* What to run for the column sets `current`, given the `stored` ones (null when
+* none were recorded), the tables that exist in the store, and the encoded ids
+* (`table:id`) with an unsettled local write.
+*/
+function planColumnReset(stored, current, existingTables, keep) {
+	if (sameSets(stored, current)) return {
+		changed: [],
+		statements: []
+	};
+	const keepByTable = /* @__PURE__ */ new Map();
+	for (const id of keep) {
+		const table = id.slice(0, id.indexOf(":"));
+		if (!keepByTable.has(table)) keepByTable.set(table, []);
+		keepByTable.get(table).push(id);
+	}
+	const changed = [];
+	const statements = [];
+	for (const [table, set] of Object.entries(current)) {
+		if (stored && stored[table] === set) continue;
+		if (!existingTables.has(table)) continue;
+		changed.push(table);
+		const reset = `UPDATE ${`"${table.replace(/"/g, "\"\"")}"`} SET data = json_set(data, '$._00_rv', 0) WHERE json_extract(data, '$._00_rv') != 0`;
+		const kept = keepByTable.get(table);
+		statements.push(kept ? {
+			sql: `${reset} AND id NOT IN (SELECT value FROM json_each(?))`,
+			bind: [JSON.stringify(kept)]
+		} : { sql: reset });
+	}
+	statements.push({
+		sql: `INSERT OR REPLACE INTO "_00_schema"(id, data) VALUES (?, ?)`,
+		bind: [COLUMNS_ROW_ID, JSON.stringify(current)]
+	});
+	return {
+		changed,
+		statements
+	};
+}
+
 //#endregion
 //#region src/services/database/sqlite-cache-engine.ts
 /**
@@ -10243,6 +10337,28 @@ var SqliteCacheEngine = class {
 		}
 		return out;
 	}
+	/**
+	* Reset the cached `_00_rv` of every table whose column set changed since
+	* the last boot, so its rows are fetched again whole. See
+	* `sqlite-column-reset.ts`. Returns the tables reset.
+	*/
+	async resetChangedTables(fingerprints, keep) {
+		const { rows } = await this.call("exec", {
+			sql: `SELECT data FROM "_00_schema" WHERE id = ?`,
+			bind: [COLUMNS_ROW_ID]
+		});
+		let stored = null;
+		try {
+			const raw = rows?.[0]?.data;
+			if (typeof raw === "string") stored = JSON.parse(raw);
+		} catch {
+			stored = null;
+		}
+		const { rows: tables } = await this.call("exec", { sql: `SELECT name FROM sqlite_master WHERE type = 'table'` });
+		const plan = planColumnReset(stored, fingerprints, new Set((tables ?? []).map((t) => t.name)), keep);
+		if (plan.statements.length > 0) await this.call("batch", plan.statements);
+		return plan.changed;
+	}
 	async getSnapshot(key) {
 		const { rows } = await this.call("exec", {
 			sql: `SELECT id, data FROM "${SNAPSHOT_TABLE}" WHERE id IN (?, ?)`,
@@ -10939,6 +11055,19 @@ var StreamProcessorService = class {
 		const epoch = this.db.epoch;
 		const alive = () => this.processor === processor && generation === this.stateGeneration && epoch === this.db.epoch;
 		const t0 = performance.now();
+		if (ctx.columnFingerprints && typeof this.db.resetChangedTables === "function") try {
+			const reset = await this.db.resetChangedTables(ctx.columnFingerprints, ctx.pendingIds);
+			if (!alive()) return;
+			if (reset.length > 0) this.logger.info({
+				tables: reset,
+				Category: "sp00ky-client::StreamProcessorService::primeFromLocal"
+			}, "Columns changed since these rows were cached; they will be fetched again");
+		} catch (e) {
+			this.logger.warn({
+				error: e,
+				Category: "sp00ky-client::StreamProcessorService::primeFromLocal"
+			}, "Column change check failed; cached versions kept");
+		}
 		let restored = false;
 		if (this.persistCircuit && typeof this.db.getSnapshot === "function" && typeof processor.load_store_state === "function") {
 			const snapshot = await this.db.getSnapshot(CIRCUIT_SNAPSHOT_KEY);
@@ -14742,6 +14871,11 @@ const RELOAD_SALT_KEY = "sp00ky:salt";
 * query onto the `_00_query` row it already had, which the SSP answers from
 * the live view instead of building a new one.
 *
+* The page's owner secret travels with it: an anonymous row answers only to
+* the secret it was registered with, so the next page needs the same one to
+* rejoin those views. `null` from a page that predates it; the next page then
+* mints one, and the rows it left (which hold no secret) take the new one.
+*
 * Taken, not read: the key is absent while a page lives, so a duplicated tab
 * (which copies sessionStorage) mints its own salt rather than sharing this
 * tab's remote views.
@@ -14755,9 +14889,11 @@ function takeReloadSalt(authId) {
 		const left = JSON.parse(raw);
 		if (typeof left.salt !== "string" || left.salt === "" || (left.authId ?? null) !== authId) return null;
 		const sessionIds = Array.isArray(left.sessionIds) ? left.sessionIds.filter((sid) => typeof sid === "string") : [];
+		const owner = typeof left.owner === "string" && left.owner !== "" ? left.owner : null;
 		return {
 			salt: left.salt,
-			sessionIds
+			sessionIds,
+			owner
 		};
 	} catch {
 		return null;
@@ -14769,13 +14905,15 @@ function takeReloadSalt(authId) {
 * The session ids of this page's sockets go with it. The views the next page
 * re-registers keep the edges this page's sockets stamped, and the anonymous
 * LIVE only hears edges stamped by a session it knows (see `listRefLive`).
+* So does the page's owner secret, which those views answer to.
 */
-function leaveReloadSalt(salt, authId, sessionIds = []) {
+function leaveReloadSalt(salt, authId, sessionIds = [], owner = null) {
 	try {
 		if (typeof sessionStorage !== "undefined") sessionStorage.setItem(RELOAD_SALT_KEY, JSON.stringify({
 			salt,
 			authId,
-			sessionIds
+			sessionIds,
+			owner
 		}));
 	} catch {}
 }
@@ -14840,7 +14978,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.321",
+			coreVersion: "0.0.1-canary.323",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,
@@ -14948,9 +15086,12 @@ function createAdapters(config, s, host, lateModules) {
 			const left = takeReloadSalt(authId);
 			if (!left) return null;
 			s.remote.adoptSessionIds(left.sessionIds);
-			return left.salt;
+			return {
+				salt: left.salt,
+				owner: left.owner
+			};
 		},
-		"salt.leave": (salt, authId) => leaveReloadSalt(salt, authId, s.remote.sessionIds()),
+		"salt.leave": (salt, authId, owner) => leaveReloadSalt(salt, authId, s.remote.sessionIds(), owner),
 		"local.connect": (bucketId) => s.local.connect(bucketId),
 		"local.switchStore": (bucketId) => s.local.switchStore(bucketId),
 		"local.beginSwitch": () => s.local.beginSwitch(),
@@ -14977,6 +15118,7 @@ function createAdapters(config, s, host, lateModules) {
 			],
 			schemaHash: String(hash53(config.schemaSurql)),
 			pendingIds: new Set(pendingIds),
+			columnFingerprints: columnFingerprints(config.schema.tables),
 			onVersions: (_table, entries) => host.dispatch({
 				type: "VersionsPrimed",
 				entries
@@ -15087,7 +15229,8 @@ function createAdapters(config, s, host, lateModules) {
 		clock: { now: () => Date.now() },
 		ids: {
 			mutation: () => mintMutationId(s.tabId),
-			salt: mintSalt
+			salt: mintSalt,
+			owner: mintOwnerSecret
 		},
 		hash: sha256Hex,
 		services

package/dist/live.d.ts

@@ -43,6 +43,14 @@ interface LiveFeedOptions {
   ttl?: string;
   /** Salt of the `_00_query` keys. Default: a fresh random id per feed. */
   sessionId?: string;
+  /**
+   * The secret the feed's registrations prove they own their views with
+   * (`$config.owner`): a signed-out feed's view answers only to the secret it
+   * was registered with. Default: a fresh one per feed. Pass the same one
+   * wherever you pass the same `sessionId`, or the second registrant of a
+   * shared anonymous view is refused.
+   */
+  ownerSecret?: string;
   /**
    * The generated schema. Used to type query params (record ids, datetimes)
    * exactly like the full client does before registering. Taken from a query

package/dist/live.js

@@ -1,4 +1,4 @@
-import { D as registerSelect, F as ANON_USER_ID, H as queryHashInput, I as DEFAULT_REF_MODE, O as registerVars, R as listRefTableFor, V as sha256Hex, _ as heartbeatBatch, a as metaFromRow, c as parseDuration, d as parseQueryParams, h as bodySelect, k as singleSnapshotSelect, l as parseRecordIdString, n as rowOfEdge, s as encodeRecordId, t as hashOfEdge, u as withTimeout, v as heartbeatRowGone, x as listRefLive } from "./worker-edges.js";
+import { A as singleSnapshotSelect, H as sha256Hex, I as ANON_USER_ID, L as DEFAULT_REF_MODE, O as registerSelect, S as listRefLive, U as queryHashInput, a as metaFromRow, c as mintOwnerSecret, d as withTimeout, f as parseQueryParams, g as bodySelect, k as registerVars, l as parseDuration, n as rowOfEdge, s as encodeRecordId, t as hashOfEdge, u as parseRecordIdString, v as heartbeatBatch, y as heartbeatRowGone, z as listRefTableFor } from "./worker-edges.js";
 import { n as decodeTokenClaims } from "./worker-impersonation.js";
 import { RecordId, Surreal } from "surrealdb";
 
@@ -15,7 +15,8 @@ import { RecordId, Surreal } from "surrealdb";
 * - `fn::query::register($config)` plus the membership read-back in one
 *   request (`registerSelect` / `registerVars`, the same builders the full
 *   client's `registerRemote` uses; `$config = { id: _00_query:<key>, surql,
-*   params, ttl }`, key = sha256(JSON.stringify({ surql, params, sessionId })));
+*   params, ttl, owner }`, key = sha256(JSON.stringify({ surql, params,
+*   sessionId })), owner = the feed's `ownerSecret`);
 * - bodies with `SELECT * FROM $ids`;
 * - one `LIVE SELECT * FROM <the user's _00_list_ref table> FETCH out` per
 *   feed (on the shared anon table, filtered to the feed's own edges; see
@@ -186,6 +187,7 @@ var Feed = class {
 	liveStarting = null;
 	subs = /* @__PURE__ */ new Map();
 	sessionId;
+	ownerSecret;
 	/** `session::id()` of every socket this feed has had, oldest first. */
 	sockets = [];
 	ttl;
@@ -202,6 +204,7 @@ var Feed = class {
 	constructor(options) {
 		this.options = options;
 		this.sessionId = options.sessionId ?? randomId();
+		this.ownerSecret = options.ownerSecret ?? mintOwnerSecret();
 		this.ttl = options.ttl ?? "10m";
 		this.timeoutMs = options.timeoutMs ?? 15e3;
 	}
@@ -539,7 +542,10 @@ var Feed = class {
 	}
 	/** Register (or re-register) a view and read its membership back, in one request. */
 	async register(sub) {
-		let snap = snapshotAt(await this.q(registerSelect(this.table), registerVars(sub.payload)), 1);
+		let snap = snapshotAt(await this.q(registerSelect(this.table), registerVars({
+			...sub.payload,
+			owner: this.ownerSecret
+		})), 1);
 		for (let i = 0; snap && snap.state === "materializing" && i < MATERIALIZE_RETRIES; i++) {
 			await sleep(MATERIALIZE_RETRY_MS);
 			snap = await this.readSnapshot(sub);

package/dist/pure.d.ts

@@ -234,6 +234,14 @@ interface RegisterPayload {
   surql: string;
   params: Record<string, unknown>;
   ttl: string;
+  /**
+   * The registering page's secret. `fn::query::register` forwards only its
+   * hash, and the SSP lets a registration onto an existing anonymous view
+   * only with the hash that view was registered with: every signed-out
+   * visitor is `anon`, and anyone can read an anonymous view's id. Kept out
+   * of `params`, which name the computation the SSP shares between views.
+   */
+  owner?: string;
 }
 /** Register + read back edges/meta/children in ONE request. */
 declare const registerSelect: (table: string) => string;

package/dist/pure.js

@@ -1,4 +1,4 @@
-import { A as subqueryListRefSelect, B as surql, C as queryRowCountBatchSelect, D as registerSelect, E as readViewRows, F as ANON_USER_ID, H as queryHashInput, I as DEFAULT_REF_MODE, L as bucketIdForUser, M as viewRecordId, N as viewRow, O as registerVars, P as ANON_LIST_REF_TABLE, R as listRefTableFor, S as listRefSelect, T as readLegacyViewRows, U as viewKeyInput, V as sha256Hex, _ as heartbeatBatch, a as metaFromRow, b as listRefBatchSelect, c as parseDuration, d as parseQueryParams, f as LEGACY_VIEW_TABLE, g as countViewRows, h as bodySelect, i as dedupeRecordVersions, j as upsertBodiesTx, k as singleSnapshotSelect, l as parseRecordIdString, m as batchSnapshotSelect, n as rowOfEdge, o as snapshotFromSingle, p as VIEW_TABLE, r as FAILED, s as encodeRecordId, t as hashOfEdge, v as heartbeatRowGone, w as queryRowCountSelect, x as listRefLive, y as leaveViewsBeacon, z as sanitizeUserId } from "./worker-edges.js";
+import { A as singleSnapshotSelect, B as sanitizeUserId, C as listRefSelect, D as readViewRows, E as readLegacyViewRows, F as ANON_LIST_REF_TABLE, H as sha256Hex, I as ANON_USER_ID, L as DEFAULT_REF_MODE, M as upsertBodiesTx, N as viewRecordId, O as registerSelect, P as viewRow, R as bucketIdForUser, S as listRefLive, T as queryRowCountSelect, U as queryHashInput, V as surql, W as viewKeyInput, _ as countViewRows, a as metaFromRow, b as leaveViewsBeacon, f as parseQueryParams, g as bodySelect, h as batchSnapshotSelect, i as dedupeRecordVersions, j as subqueryListRefSelect, k as registerVars, l as parseDuration, m as VIEW_TABLE, n as rowOfEdge, o as snapshotFromSingle, p as LEGACY_VIEW_TABLE, r as FAILED, s as encodeRecordId, t as hashOfEdge, u as parseRecordIdString, v as heartbeatBatch, w as queryRowCountBatchSelect, x as listRefBatchSelect, y as heartbeatRowGone, z as listRefTableFor } from "./worker-edges.js";
 import { n as decodeTokenClaims, t as IMPERSONATION_ACCESS } from "./worker-impersonation.js";
 import { a as sameBytes, i as isPushPayload, n as base64UrlToBytes, r as bytesToBase64Url, t as PUSH_PAYLOAD_VERSION } from "./worker-types.js";
 

package/dist/types.d.ts

@@ -451,6 +451,16 @@ interface LocalStore extends LocalCacheEngine {
    * without it boots the circuit empty, as before.
    */
   scanVersions?(tables: string[]): Promise<Record<string, [string, number][]>>;
+  /**
+   * Reset the cached `_00_rv` of every table whose column set (`fingerprints`,
+   * see `columnFingerprints`) changed since the store last recorded it, except
+   * the rows in `keep`, and record the new sets. Returns the tables reset.
+   * For engines that keep bodies across schema changes: a body landed under an
+   * older schema lacks the columns it did not know, at the server's version,
+   * and would never be fetched again. OPTIONAL: an engine that rebuilds its
+   * store on a schema change (SurrealDB) does not need it.
+   */
+  resetChangedTables?(fingerprints: Record<string, string>, keep: Set<string>): Promise<string[]>;
   /**
    * Circuit snapshot storage, keyed. Lives in the same durable store as the
    * rows (OPFS SQLite), so it is per-bucket by construction, atomic, and

package/dist/worker-edges.js

@@ -319,6 +319,16 @@ const parseRecordIdString = (id) => {
 	return new RecordId(table, idParts.join(":"));
 };
 /**
+* 32 random bytes, hex: the secret a page proves it owns its anonymous views
+* with (`$config.owner` on `fn::query::register`). `getRandomValues` rather
+* than `randomUUID`, which a page served over plain http does not have.
+*/
+function mintOwnerSecret() {
+	const bytes = new Uint8Array(32);
+	globalThis.crypto.getRandomValues(bytes);
+	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
 * Read the millisecond count off a surrealdb `Duration`. Different `surrealdb`
 * releases expose it under `milliseconds` (current) or the older private
 * `_milliseconds` field, so read whichever is set; returns 0 when neither is.
@@ -467,4 +477,4 @@ function rowOfEdge(value) {
 }
 
 //#endregion
-export { subqueryListRefSelect as A, surql as B, queryRowCountBatchSelect as C, registerSelect as D, readViewRows as E, ANON_USER_ID as F, queryHashInput as H, DEFAULT_REF_MODE as I, bucketIdForUser as L, viewRecordId as M, viewRow as N, registerVars as O, ANON_LIST_REF_TABLE as P, listRefTableFor as R, listRefSelect as S, readLegacyViewRows as T, viewKeyInput as U, sha256Hex as V, heartbeatBatch as _, metaFromRow as a, listRefBatchSelect as b, parseDuration as c, parseQueryParams as d, LEGACY_VIEW_TABLE as f, countViewRows as g, bodySelect as h, dedupeRecordVersions as i, upsertBodiesTx as j, singleSnapshotSelect as k, parseRecordIdString as l, batchSnapshotSelect as m, rowOfEdge as n, snapshotFromSingle as o, VIEW_TABLE as p, FAILED as r, encodeRecordId as s, hashOfEdge as t, withTimeout as u, heartbeatRowGone as v, queryRowCountSelect as w, listRefLive as x, leaveViewsBeacon as y, sanitizeUserId as z };
+export { singleSnapshotSelect as A, sanitizeUserId as B, listRefSelect as C, readViewRows as D, readLegacyViewRows as E, ANON_LIST_REF_TABLE as F, sha256Hex as H, ANON_USER_ID as I, DEFAULT_REF_MODE as L, upsertBodiesTx as M, viewRecordId as N, registerSelect as O, viewRow as P, bucketIdForUser as R, listRefLive as S, queryRowCountSelect as T, queryHashInput as U, surql as V, viewKeyInput as W, countViewRows as _, metaFromRow as a, leaveViewsBeacon as b, mintOwnerSecret as c, withTimeout as d, parseQueryParams as f, bodySelect as g, batchSnapshotSelect as h, dedupeRecordVersions as i, subqueryListRefSelect as j, registerVars as k, parseDuration as l, VIEW_TABLE as m, rowOfEdge as n, snapshotFromSingle as o, LEGACY_VIEW_TABLE as p, FAILED as r, encodeRecordId as s, hashOfEdge as t, parseRecordIdString as u, heartbeatBatch as v, queryRowCountBatchSelect as w, listRefBatchSelect as x, heartbeatRowGone as y, listRefTableFor as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.321",
+  "version": "0.0.1-canary.323",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -75,8 +75,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.321",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.321",
+    "@spooky-sync/query-builder": "0.0.1-canary.323",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.323",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.0.3",
     "blurhash": "^2.0.5",

package/src/boot/boot.saga.test.ts

@@ -43,24 +43,42 @@ describe('boot', () => {
       'releases.init',
     ]);
     expect(svc.calls[1]).toEqual(['local.connect', ['u1']]);
-    expect(out.state).toMatchObject({ bucketId: 'u1', userId: 'user:u1', saltUserId: 'user:u1', sessionId: 'salt-1', localReady: true });
+    expect(out.state).toMatchObject({
+      bucketId: 'u1',
+      userId: 'user:u1',
+      saltUserId: 'user:u1',
+      sessionId: 'salt-1',
+      ownerSecret: 'owner-2',
+      localReady: true,
+    });
     expect(out.dispatched.map((d) => d.type)).toEqual(['WarmBlobs', 'PrimeCircuit', 'AdoptPendingWrites', 'LifecycleTick', 'StartRemote']);
     // The view index is loaded before anything can paint; the first GC waits out the boot.
     expect(out.state.views).toEqual(new Map([['k', ['t:1']]]));
     expect(out.timers.get('gc')).toEqual({ ms: 30_000, event: { type: 'GcTick' } });
     expect(svc.names()).not.toContain('remote.connect');
   });
-  it('a reload keeps the salt its tab left for the same principal', async () => {
+  it('a reload keeps the salt its tab left for the same principal, and the owner secret its views answer to', async () => {
     const svc = fakeServices({
       'hint.read': () => 'u1',
       'auth.restoreSession': async () => 'user:u1',
       'auth.sessionAuthId': () => 'user:u1',
-      'salt.take': () => 'kept-salt',
+      'salt.take': () => ({ salt: 'kept-salt', owner: 'kept-owner' }),
     });
     const out = await runPure(boot(env, { sharedTabs: false }), { handlers: { service: svc.handler, 'local.query': () => [] } });
     expect(svc.calls).toContainEqual(['salt.take', ['user:u1']]);
     expect(svc.calls).toContainEqual(['crdt.setSessionId', ['kept-salt']]);
-    expect(out.state).toMatchObject({ sessionId: 'kept-salt', saltUserId: 'user:u1' });
+    expect(out.state).toMatchObject({ sessionId: 'kept-salt', saltUserId: 'user:u1', ownerSecret: 'kept-owner' });
+    expect(out.log.filter((e) => e.kind === 'id')).toEqual([]);
+  });
+  it('a salt left by a page that kept no owner secret gets a fresh one', async () => {
+    const svc = fakeServices({
+      'hint.read': () => null,
+      'auth.restoreSession': async () => null,
+      'auth.sessionAuthId': () => null,
+      'salt.take': () => ({ salt: 'kept-salt', owner: null }),
+    });
+    const out = await runPure(boot(env, { sharedTabs: false }), { handlers: { service: svc.handler, 'local.query': () => [] } });
+    expect(out.state).toMatchObject({ sessionId: 'kept-salt', ownerSecret: 'owner-1' });
   });
   it('shared tabs: takes the role from the coordinator, or falls back to solo; schemaless engines skip provisioning; anonymous skips session auth', async () => {
     const leader = fakeServices({ 'hint.read': () => null, 'tabs.start': async () => 'leader', 'local.usesSurqlSchema': () => false, 'auth.restoreSession': async () => null, 'auth.sessionAuthId': () => null });
@@ -146,12 +164,17 @@ describe('startRemote / primeCircuit / versionsPrimed / pageHide / warmBlobs', (
     expect(f.state.primed).toBe(true);
     expect(f.emitted).toEqual([expect.objectContaining({ level: 'warn' })]);
   });
-  it('pageHide leaves the salt for a reload before releasing views', async () => {
+  it('pageHide leaves the salt and owner secret for a reload before releasing views', async () => {
     const svc = fakeServices();
-    const s = { ...buildState([buildEntry({ def: { hash: 'a' }, lifecycle: { remote: 'registered' } })]), sessionId: 'salt-1', saltUserId: 'user:u1' };
+    const s = {
+      ...buildState([buildEntry({ def: { hash: 'a' }, lifecycle: { remote: 'registered' } })]),
+      sessionId: 'salt-1',
+      saltUserId: 'user:u1',
+      ownerSecret: 'owner-1',
+    };
     await runPure(pageHide(), { state: s, handlers: { service: svc.handler } });
     expect(svc.calls).toEqual([
-      ['salt.leave', ['salt-1', 'user:u1']],
+      ['salt.leave', ['salt-1', 'user:u1', 'owner-1']],
       ['remote.releaseViews', [[new RecordId('_00_query', 'a')]]],
     ]);
   });

package/src/boot/boot.saga.ts

@@ -44,9 +44,12 @@ export function* boot(env: SagaEnv, opts: BootOptions): Saga<void> {
 
   const restoredUserId = (yield fx.service('auth.restoreSession')) as string | null;
   const authId = (yield fx.service('auth.sessionAuthId')) as string | null;
-  // A reload keeps the salt its tab had, so registrations land on warm views.
-  const salt = (((yield fx.service('salt.take', authId)) as string | null) ?? (yield fx.id('salt'))) as string;
-  yield fx.state.update(R.setIdentity({ sessionId: salt, userId: restoredUserId, saltUserId: authId }));
+  // A reload keeps the salt its tab had, so registrations land on warm views,
+  // and the owner secret those views answer to.
+  const left = (yield fx.service('salt.take', authId)) as { salt: string; owner: string | null } | null;
+  const salt = (left?.salt ?? (yield fx.id('salt'))) as string;
+  const ownerSecret = (left?.owner ?? (yield fx.id('owner'))) as string;
+  yield fx.state.update(R.setIdentity({ sessionId: salt, userId: restoredUserId, saltUserId: authId, ownerSecret }));
   yield fx.service('crdt.setSessionId', salt);
   if (restoredUserId) yield fx.service('ssp.setSessionAuth', authId, (yield fx.service('auth.access')) as string | null);
 
@@ -123,12 +126,13 @@ export function* versionsPrimed(entries: Array<readonly [string, number]>): Saga
  * grace finds its views still warm.
  */
 export function* pageHide(): Saga<void> {
-  const [salt, saltUserId, ids] = (yield fx.state.read((s) => [
+  const [salt, saltUserId, ownerSecret, ids] = (yield fx.state.read((s) => [
     s.sessionId,
     s.saltUserId,
+    s.ownerSecret,
     [...s.queries.values()].filter((e) => e.lifecycle.remote === 'registered').map((e) => e.def.id),
-  ])) as [string | null, string | null, unknown[]];
-  if (salt) yield fx.service('salt.leave', salt, saltUserId);
+  ])) as [string | null, string | null, string | null, unknown[]];
+  if (salt) yield fx.service('salt.leave', salt, saltUserId, ownerSecret);
   if (ids.length > 0) yield fx.service('remote.releaseViews', ids);
 }