@spooky-sync/core 0.0.1-canary.321 → 0.0.1-canary.323

package/src/client/services.test.ts

@@ -25,7 +25,7 @@ describe('reload salt', () => {
 
   it('a salt left on the way out is taken once, by the same principal', () => {
     leaveReloadSalt('s1', 'user:a');
-    expect(takeReloadSalt('user:a')).toEqual({ salt: 's1', sessionIds: [] });
+    expect(takeReloadSalt('user:a')).toEqual({ salt: 's1', sessionIds: [], owner: null });
     // Taken, not read: a tab duplicated from this page finds nothing.
     expect(takeReloadSalt('user:a')).toBeNull();
   });
@@ -34,9 +34,23 @@ describe('reload salt', () => {
     // The reloaded page's views keep edges stamped by these sockets, and the
     // anonymous LIVE only hears sessions it knows.
     leaveReloadSalt('s1', null, ['sid-1', 'sid-2']);
-    expect(takeReloadSalt(null)).toEqual({ salt: 's1', sessionIds: ['sid-1', 'sid-2'] });
+    expect(takeReloadSalt(null)).toEqual({ salt: 's1', sessionIds: ['sid-1', 'sid-2'], owner: null });
     (g.sessionStorage as MemoryStorage).setItem('sp00ky:salt', JSON.stringify({ salt: 's2', authId: null, sessionIds: ['ok', 7, null] }));
-    expect(takeReloadSalt(null)).toEqual({ salt: 's2', sessionIds: ['ok'] });
+    expect(takeReloadSalt(null)).toEqual({ salt: 's2', sessionIds: ['ok'], owner: null });
+  });
+
+  it("the page's owner secret travels with the salt, so the reloaded page still owns its anonymous views", () => {
+    leaveReloadSalt('s1', null, [], 'secret-1');
+    expect(takeReloadSalt(null)).toEqual({ salt: 's1', sessionIds: [], owner: 'secret-1' });
+    // Gone with the salt: a duplicated tab mints its own.
+    expect(takeReloadSalt(null)).toBeNull();
+    // A different principal re-salts, and the secret is not handed over either.
+    leaveReloadSalt('s2', 'user:a', [], 'secret-2');
+    expect(takeReloadSalt(null)).toBeNull();
+    for (const owner of ['', 7, null]) {
+      (g.sessionStorage as MemoryStorage).setItem('sp00ky:salt', JSON.stringify({ salt: 's3', authId: null, owner }));
+      expect(takeReloadSalt(null)?.owner).toBeNull();
+    }
   });
 
   it('another principal, or none, mints a fresh salt', () => {

package/src/client/services.ts

@@ -21,12 +21,13 @@ import { TabsCoordinator, type CoordinatorHooks } from '../services/tabs/coordin
 import type { LeaderSyncHub, SyncForwarder } from '../services/tabs/coordinator';
 import { computeTabsFingerprint, hash53 } from '../services/tabs/protocol';
 import type { SqliteCacheEngine } from '../services/database/sqlite-cache-engine';
+import { columnFingerprints } from '../services/database/sqlite-column-reset';
 import type { BlobCache } from '../services/blobs/index';
 import { MemoryBlobStore, createBlobCache, resolveBlobBudget } from '../services/blobs/index';
 import type { Adapters } from '../kernel/interpreter';
 import type { RuntimeEvent } from '../kernel/events';
 import type { ServiceCalls } from '../kernel/effects';
-import { encodeRecordId } from '../utils/index';
+import { encodeRecordId, mintOwnerSecret } from '../utils/index';
 import { sha256Hex } from '../utils/sha256';
 import { leaveViewsBeacon, listRefLive } from '../query/sql';
 import { hashOfEdge, rowOfEdge } from '../utils/edges';
@@ -59,20 +60,28 @@ const RELOAD_SALT_KEY = 'sp00ky:salt';
  * query onto the `_00_query` row it already had, which the SSP answers from
  * the live view instead of building a new one.
  *
+ * The page's owner secret travels with it: an anonymous row answers only to
+ * the secret it was registered with, so the next page needs the same one to
+ * rejoin those views. `null` from a page that predates it; the next page then
+ * mints one, and the rows it left (which hold no secret) take the new one.
+ *
  * Taken, not read: the key is absent while a page lives, so a duplicated tab
  * (which copies sessionStorage) mints its own salt rather than sharing this
  * tab's remote views.
  */
-export function takeReloadSalt(authId: string | null): { salt: string; sessionIds: string[] } | null {
+export function takeReloadSalt(
+  authId: string | null
+): { salt: string; sessionIds: string[]; owner: string | null } | null {
   try {
     if (typeof sessionStorage === 'undefined') return null;
     const raw = sessionStorage.getItem(RELOAD_SALT_KEY);
     if (raw === null) return null;
     sessionStorage.removeItem(RELOAD_SALT_KEY);
-    const left = JSON.parse(raw) as { salt?: unknown; authId?: unknown; sessionIds?: unknown };
+    const left = JSON.parse(raw) as { salt?: unknown; authId?: unknown; sessionIds?: unknown; owner?: unknown };
     if (typeof left.salt !== 'string' || left.salt === '' || (left.authId ?? null) !== authId) return null;
     const sessionIds = Array.isArray(left.sessionIds) ? left.sessionIds.filter((sid): sid is string => typeof sid === 'string') : [];
-    return { salt: left.salt, sessionIds };
+    const owner = typeof left.owner === 'string' && left.owner !== '' ? left.owner : null;
+    return { salt: left.salt, sessionIds, owner };
   } catch {
     return null;
   }
@@ -84,11 +93,17 @@ export function takeReloadSalt(authId: string | null): { salt: string; sessionId
  * The session ids of this page's sockets go with it. The views the next page
  * re-registers keep the edges this page's sockets stamped, and the anonymous
  * LIVE only hears edges stamped by a session it knows (see `listRefLive`).
+ * So does the page's owner secret, which those views answer to.
  */
-export function leaveReloadSalt(salt: string, authId: string | null, sessionIds: ReadonlyArray<string> = []): void {
+export function leaveReloadSalt(
+  salt: string,
+  authId: string | null,
+  sessionIds: ReadonlyArray<string> = [],
+  owner: string | null = null
+): void {
   try {
     if (typeof sessionStorage !== 'undefined')
-      sessionStorage.setItem(RELOAD_SALT_KEY, JSON.stringify({ salt, authId, sessionIds }));
+      sessionStorage.setItem(RELOAD_SALT_KEY, JSON.stringify({ salt, authId, sessionIds, owner }));
   } catch {
     /* private-mode storage errors: the next page mints a fresh salt */
   }
@@ -268,9 +283,9 @@ export function createAdapters<S extends SchemaStructure>(config: Sp00kyConfig<S
       const left = takeReloadSalt(authId);
       if (!left) return null;
       s.remote.adoptSessionIds(left.sessionIds);
-      return left.salt;
+      return { salt: left.salt, owner: left.owner };
     },
-    'salt.leave': (salt, authId) => leaveReloadSalt(salt, authId, s.remote.sessionIds()),
+    'salt.leave': (salt, authId, owner) => leaveReloadSalt(salt, authId, s.remote.sessionIds(), owner),
     'local.connect': (bucketId) => s.local.connect(bucketId),
     'local.switchStore': (bucketId) => s.local.switchStore(bucketId),
     'local.beginSwitch': () => s.local.beginSwitch(),
@@ -294,6 +309,7 @@ export function createAdapters<S extends SchemaStructure>(config: Sp00kyConfig<S
         tables: [...config.schema.tables.map((t) => t.name), '_00_user_feature', '_00_app_release'],
         schemaHash: String(hash53(config.schemaSurql)),
         pendingIds: new Set(pendingIds),
+        columnFingerprints: columnFingerprints(config.schema.tables),
         onVersions: (_table, entries) => host.dispatch({ type: 'VersionsPrimed', entries }),
       }),
     'ssp.reset': () => s.streamProcessor.reset(),
@@ -411,7 +427,7 @@ export function createAdapters<S extends SchemaStructure>(config: Sp00kyConfig<S
       },
     },
     clock: { now: () => Date.now() },
-    ids: { mutation: () => mintMutationId(s.tabId), salt: mintSalt },
+    ids: { mutation: () => mintMutationId(s.tabId), salt: mintSalt, owner: mintOwnerSecret },
     hash: sha256Hex,
     services,
   };

package/src/kernel/effects.ts

@@ -53,7 +53,7 @@ export type Effect =
   | { kind: 'state.update'; fn: (s: ClientState) => ClientState }
   | { kind: 'state.wait'; until: (s: ClientState) => boolean }
   | { kind: 'now' }
-  | { kind: 'id'; scope: 'mutation' | 'salt' }
+  | { kind: 'id'; scope: IdScope }
   | { kind: 'hash'; input: string }
   | { kind: 'emit'; event: OutEvent }
   | { kind: 'dispatch'; event: RuntimeEvent }
@@ -62,6 +62,9 @@ export type Effect =
 
 export type EffectKind = Effect['kind'];
 
+/** `mutation`: an outbox row id. `salt`: a query-key salt. `owner`: a page's anonymous-view owner secret. */
+export type IdScope = 'mutation' | 'salt' | 'owner';
+
 /**
  * Calls into the legacy services that are adapters, not state: auth, tabs,
  * blobs, migrator, crdt, persistence, the SSP lifecycle, the remote socket.
@@ -70,8 +73,9 @@ export type EffectKind = Effect['kind'];
 export interface ServiceCalls {
   'hint.read': () => string | null;
   'hint.write': (bucketId: string) => void;
-  'salt.take': (authId: string | null) => string | null;
-  'salt.leave': (salt: string, authId: string | null) => void;
+  /** The salt (and owner secret) this tab's previous page left, if minted for `authId`. */
+  'salt.take': (authId: string | null) => { salt: string; owner: string | null } | null;
+  'salt.leave': (salt: string, authId: string | null, owner: string | null) => void;
   'local.connect': (bucketId: string) => Promise<void>;
   'local.switchStore': (bucketId: string) => Promise<void>;
   'local.beginSwitch': () => () => void;
@@ -154,7 +158,7 @@ export const fx = {
     wait: (until: (s: ClientState) => boolean): Effect => ({ kind: 'state.wait', until }),
   },
   now: (): Effect => ({ kind: 'now' }),
-  id: (scope: 'mutation' | 'salt'): Effect => ({ kind: 'id', scope }),
+  id: (scope: IdScope): Effect => ({ kind: 'id', scope }),
   hash: (input: string): Effect => ({ kind: 'hash', input }),
   emit: (event: OutEvent): Effect => ({ kind: 'emit', event }),
   dispatch: (event: RuntimeEvent): Effect => ({ kind: 'dispatch', event }),

package/src/kernel/interpreter.ts

@@ -4,7 +4,7 @@ import type { IngestRecord, StreamUpdate } from '../services/stream-processor/in
 import type { ClientState } from '../state/client-state';
 import type { InlineRow } from '../types';
 import { withTimeout } from '../utils/index';
-import type { Effect, RegisterResult, ServiceCalls, Settled, StatementResult } from './effects';
+import type { Effect, IdScope, RegisterResult, ServiceCalls, Settled, StatementResult } from './effects';
 import type { OutEvent, RuntimeEvent } from './events';
 
 /** The five adapters plus the pure ports, as the interpreter sees them. */
@@ -36,7 +36,7 @@ export interface Adapters {
   };
   timers: { set(key: string, ms: number, fire: () => void): void; clear(key: string): void };
   clock: { now(): number };
-  ids: { mutation(): string; salt(): string };
+  ids: Record<IdScope, () => string>;
   hash(input: string): Promise<string>;
   services: ServiceCalls;
 }
@@ -127,7 +127,7 @@ export function createInterpreter(adapters: Adapters, host: InterpreterHost): In
       case 'now':
         return adapters.clock.now();
       case 'id':
-        return effect.scope === 'mutation' ? adapters.ids.mutation() : adapters.ids.salt();
+        return adapters.ids[effect.scope]();
       case 'hash':
         return adapters.hash(effect.input);
       case 'emit':

package/src/live/index.test.ts

@@ -187,7 +187,12 @@ describe('createLiveFeed', () => {
     const input = (client as any).registerInput('notification', q.innerQuery, '10m');
     const env = defaultEnv(schema);
     const local = await runPure(registerLocal(env, input), {
-      state: { ...emptyState({ tabId: 't' }), sessionId: 'sess', userId: 'user:alice' },
+      state: {
+        ...emptyState({ tabId: 't' }),
+        sessionId: 'sess',
+        userId: 'user:alice',
+        ownerSecret: 'owner-k',
+      },
       handlers: {
         'local.getById': () => null,
         'ssp.register': () => ({
@@ -208,7 +213,7 @@ describe('createLiveFeed', () => {
     });
 
     const fake = new FakeSurreal();
-    const feed = feedWith(fake);
+    const feed = feedWith(fake, { ownerSecret: 'owner-k' });
     const sub = feed.subscribe(q, { onSet: () => {} });
     await sub.ready;
     const reg = fake.calls.find((c) => c.sql.startsWith('fn::query::register'))!;
@@ -409,7 +414,13 @@ describe('createLiveFeed', () => {
       fake.heartbeatGone = true;
       await vi.advanceTimersByTimeAsync(10_000);
       expect(fake.calls.some((c) => c.sql.startsWith('fn::query::heartbeat($id0)'))).toBe(true);
-      expect(fake.calls.filter((c) => c.sql.startsWith('fn::query::register'))).toHaveLength(2);
+      const registers = fake.calls.filter((c) => c.sql.startsWith('fn::query::register'));
+      expect(registers).toHaveLength(2);
+      // The re-registration proves it owns the view with the secret it was
+      // registered with (a fresh one per feed, at least 256 bits).
+      const owners = registers.map((c) => (c.vars!.config as { owner?: string }).owner);
+      expect(owners[0]).toMatch(/^[0-9a-f]{64}$/);
+      expect(owners[1]).toBe(owners[0]);
       await feed.close();
     } finally {
       vi.useRealTimers();

package/src/live/index.ts

@@ -10,7 +10,8 @@
  * - `fn::query::register($config)` plus the membership read-back in one
  *   request (`registerSelect` / `registerVars`, the same builders the full
  *   client's `registerRemote` uses; `$config = { id: _00_query:<key>, surql,
- *   params, ttl }`, key = sha256(JSON.stringify({ surql, params, sessionId })));
+ *   params, ttl, owner }`, key = sha256(JSON.stringify({ surql, params,
+ *   sessionId })), owner = the feed's `ownerSecret`);
  * - bodies with `SELECT * FROM $ids`;
  * - one `LIVE SELECT * FROM <the user's _00_list_ref table> FETCH out` per
  *   feed (on the shared anon table, filtered to the feed's own edges; see
@@ -48,7 +49,13 @@ import { decodeTokenClaims } from '../modules/auth/impersonation';
 import { hashOfEdge, rowOfEdge } from '../utils/edges';
 import { sha256Hex } from '../utils/sha256';
 import { parseQueryParams } from '../utils/parser';
-import { encodeRecordId, parseDuration, parseRecordIdString, withTimeout } from '../utils/index';
+import {
+  encodeRecordId,
+  mintOwnerSecret,
+  parseDuration,
+  parseRecordIdString,
+  withTimeout,
+} from '../utils/index';
 
 export type LiveToken = string | null | undefined;
 /** A token, or a function returning one (called on every connect). */
@@ -92,6 +99,14 @@ export interface LiveFeedOptions {
   ttl?: string;
   /** Salt of the `_00_query` keys. Default: a fresh random id per feed. */
   sessionId?: string;
+  /**
+   * The secret the feed's registrations prove they own their views with
+   * (`$config.owner`): a signed-out feed's view answers only to the secret it
+   * was registered with. Default: a fresh one per feed. Pass the same one
+   * wherever you pass the same `sessionId`, or the second registrant of a
+   * shared anonymous view is refused.
+   */
+  ownerSecret?: string;
   /**
    * The generated schema. Used to type query params (record ids, datetimes)
    * exactly like the full client does before registering. Taken from a query
@@ -384,6 +399,7 @@ class Feed implements LiveFeed {
   private liveStarting: Promise<boolean> | null = null;
   private readonly subs = new Map<string, SubState>();
   private readonly sessionId: string;
+  private readonly ownerSecret: string;
   /** `session::id()` of every socket this feed has had, oldest first. */
   private sockets: string[] = [];
   private readonly ttl: string;
@@ -403,6 +419,7 @@ class Feed implements LiveFeed {
 
   constructor(private readonly options: LiveFeedOptions) {
     this.sessionId = options.sessionId ?? randomId();
+    this.ownerSecret = options.ownerSecret ?? mintOwnerSecret();
     this.ttl = options.ttl ?? '10m';
     this.timeoutMs = options.timeoutMs ?? 15_000;
   }
@@ -804,7 +821,10 @@ class Feed implements LiveFeed {
 
   /** Register (or re-register) a view and read its membership back, in one request. */
   private async register(sub: SubState): Promise<Snapshot> {
-    const results = await this.q(registerSelect(this.table!), registerVars(sub.payload));
+    const results = await this.q(
+      registerSelect(this.table!),
+      registerVars({ ...sub.payload, owner: this.ownerSecret })
+    );
     let snap = snapshotAt(results, 1);
     for (let i = 0; snap && snap.state === 'materializing' && i < MATERIALIZE_RETRIES; i++) {
       await sleep(MATERIALIZE_RETRY_MS);

package/src/query/anon-query-isolation.integration.test.ts

@@ -1,8 +1,9 @@
-import { Socket } from 'node:net';
+import { createServer, type Server } from 'node:http';
+import { Socket, type AddressInfo } from 'node:net';
 import { createHash, randomUUID } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
-import { afterEach, beforeAll, beforeEach, describe, expect, it } from 'vitest';
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from 'vitest';
 import { RecordId, Surreal } from 'surrealdb';
 import { liveEndpoint } from '../live/index';
 import {
@@ -27,13 +28,36 @@ import {
  *     surrealdb/surrealdb:v3.1.5 start --user root --pass root --allow-all memory
  *
  * Override the endpoint with SURREAL_IT_ENDPOINT. Skips if unreachable.
+ *
+ * The registration tests also run the shipped `fn::query::register`, whose
+ * `http::post` must reach a stand-in SSP this test serves. SurrealDB reaches it
+ * at SURREAL_IT_CALLBACK_HOST (default `host.docker.internal`, the host as seen
+ * from Docker Desktop); those tests skip when it cannot.
  */
 const endpoint = liveEndpoint(process.env.SURREAL_IT_ENDPOINT ?? 'ws://127.0.0.1:18011');
+const callbackHost = process.env.SURREAL_IT_CALLBACK_HOST ?? 'host.docker.internal';
 const NS = 'it';
 
 const cliSource = (file: string) =>
   readFileSync(fileURLToPath(new URL(`../../../../apps/cli/src/${file}`, import.meta.url)), 'utf8');
 
+/**
+ * The SET clause ssp-node puts first in every registration write, read out of
+ * `packages/ssp-node/src/node.rs` so this test runs the shipped text.
+ */
+function ownerGuard(): string {
+  const src = readFileSync(
+    fileURLToPath(new URL('../../../ssp-node/src/node.rs', import.meta.url)),
+    'utf8'
+  );
+  const m = /pub const OWNER_GUARD: &str = "((?:[^"\\]|\\.)*)";/s.exec(src);
+  if (!m) throw new Error('OWNER_GUARD not found in ssp-node/src/node.rs');
+  // A Rust `\` at a line end drops the newline and the next line's indent.
+  return m[1].replace(/\\\n\s*/g, '');
+}
+
+const sha256 = (text: string) => createHash('sha256').update(text).digest('hex');
+
 /** Just the `_00_query` block: the rest of the file needs tables and modules this test does not. */
 function queryTableSchema(): string {
   const meta = cliSource('meta_tables_remote.surql');
@@ -61,6 +85,18 @@ UPSERT $id SET clientId = $sid, auth_id = $owner, surql = 'SELECT * FROM item',
     array::filter(subscribers ?? [], |$s| <string>$s.id != $sid AND <datetime>$s.seenAt + 1h > time::now()),
     { id: $sid, seenAt: time::now() })`;
 
+/**
+ * What the SSP writes, as root, when a session joins an anonymous view that
+ * already exists (`join_registered_view`), with the shipped ownership guard.
+ */
+const SSP_JOIN = () => `
+UPSERT type::record($id) SET ${ownerGuard()}, clientId = $sid, auth_id = auth_id ?? 'anon',
+  surql = surql ?? 'SELECT * FROM item', params = params ?? { auth: { id: '' }, access: '' },
+  ttl = ttl ?? 1h, lastActiveAt = time::now(), rowCount = rowCount ?? 3, state = state ?? 'ready',
+  subscribers = array::append(
+    array::filter(subscribers ?? [], |$s| <string>$s.id != $sid AND <datetime>$s.seenAt + 1h > time::now()),
+    { id: $sid, seenAt: time::now() })`;
+
 /** A `_00_query:<sha256>` id, the shape the client mints (and the pagehide beacon accepts). */
 const viewId = () =>
   new RecordId('_00_query', createHash('sha256').update(randomUUID()).digest('hex'));
@@ -71,6 +107,13 @@ describe('anonymous _00_query isolation (real SurrealDB)', () => {
   let reachable = false;
   const open: Surreal[] = [];
 
+  // The stand-in SSP: records what `fn::query::register` posts and answers it
+  // as ssp-node's warm join does (409 `owner_mismatch` when the guard throws).
+  const posted: Array<Record<string, unknown>> = [];
+  let ssp: Server | null = null;
+  let sspUrl = '';
+  let sspReachable: boolean | null = null;
+
   // A plain TCP probe: the SDK never rejects a connect to a refused port.
   beforeAll(async () => {
     const url = new URL(endpoint);
@@ -84,8 +127,58 @@ describe('anonymous _00_query isolation (real SurrealDB)', () => {
       socket.once('error', () => done(false));
       socket.connect(Number(url.port || 80), url.hostname, () => done(true));
     });
+    ssp = createServer(async (req, res) => {
+      let text = '';
+      for await (const chunk of req) text += chunk;
+      const body = JSON.parse(text) as Record<string, unknown>;
+      posted.push(body);
+      if (body.probe) return void res.writeHead(200).end('null');
+      try {
+        await root.query(SSP_JOIN(), {
+          id: body.id,
+          sid: body.clientId,
+          ownerHash: body.ownerHash ?? '',
+        });
+        res.writeHead(200, { 'content-type': 'application/json' }).end('null');
+      } catch (error) {
+        const refused = String(error).includes('owner_mismatch');
+        res
+          .writeHead(refused ? 409 : 500, { 'content-type': 'application/json' })
+          .end(
+            JSON.stringify({
+              code: refused ? 'owner_mismatch' : 'db_error',
+              message: String(error),
+            })
+          );
+      }
+    });
+    await new Promise<void>((resolve) => ssp!.listen(0, '0.0.0.0', resolve));
+    sspUrl = `http://${callbackHost}:${(ssp.address() as AddressInfo).port}`;
   });
 
+  afterAll(async () => {
+    await new Promise((resolve) => ssp?.close(resolve));
+  });
+
+  /** Load the shipped `fn::query::register` against the stand-in; false when SurrealDB cannot reach it. */
+  async function registerFunctions(): Promise<boolean> {
+    if (sspReachable === null) {
+      sspReachable = await root
+        .query('RETURN http::post($url, { probe: true })', { url: `${sspUrl}/probe` })
+        .then(
+          () => true,
+          () => false
+        );
+    }
+    if (!sspReachable) return false;
+    await root.query(
+      cliSource('functions_remote_singlenode.surql')
+        .replaceAll('{{ENDPOINT}}', sspUrl)
+        .replaceAll('{{SECRET}}', 'it-secret')
+    );
+    return true;
+  }
+
   beforeEach(async () => {
     if (!reachable) return;
     database = `anon_query_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
@@ -290,6 +383,72 @@ describe('anonymous _00_query isolation (real SurrealDB)', () => {
     expect(await readBack(b, qa)).toBeNull();
   });
 
+  it("a guest who read another guest's view id cannot join it through fn::query::register; the owner's reconnect can", async (ctx) => {
+    if (!reachable) ctx.skip();
+    if (!(await registerFunctions())) ctx.skip();
+    const [a, sidA] = await guest();
+    const [b] = await guest();
+    const qa = viewId();
+    const register = (db: Surreal, owner?: string) =>
+      db.query('fn::query::register($config)', {
+        config: {
+          id: qa,
+          surql: 'SELECT * FROM item',
+          params: {},
+          ttl: '1h',
+          ...(owner ? { owner } : {}),
+        },
+      });
+
+    await register(a, 'secret-a');
+    const sent = posted.at(-1)!;
+    expect(sent).toMatchObject({ clientId: sidA, ownerHash: sha256('secret-a') });
+    // Only the hash leaves the database, and never inside `params` (the SSP's
+    // merge key is built from them).
+    expect(JSON.stringify(sent)).not.toContain('secret-a');
+    expect(String(sent.params)).not.toContain(sha256('secret-a'));
+    const before = await row(qa);
+    expect(before?.ownerHash).toBe(sha256('secret-a'));
+
+    // Anonymous view ids are world-readable on `_00_list_ref_anon`. With its
+    // own secret or with none, the stranger's registration is refused, so it
+    // never lands in `subscribers` and its DELETE still matches nothing.
+    await expect(register(b, 'secret-b')).rejects.toThrow();
+    await expect(register(b)).rejects.toThrow();
+    await b.query('DELETE $id', { id: qa });
+    expect(await row(qa)).toEqual(before);
+    expect(await readBack(b, qa)).toBeNull();
+
+    // The owner's reconnect: a new socket, the same page secret.
+    await a.close();
+    const [a2, sidA2] = await guest();
+    expect(await heartbeatFound(a2, qa)).toBe(false);
+    await register(a2, 'secret-a');
+    expect((await row(qa))?.subscribers.map((s: { id: string }) => s.id)).toEqual([sidA, sidA2]);
+    expect(await heartbeatFound(a2, qa)).toBe(true);
+    expect(await readBack(a2, qa)).toEqual({ rowCount: 3, state: 'ready' });
+  });
+
+  it('no caller can read or rewrite the owner hash, not even the owner', async (ctx) => {
+    if (!reachable) ctx.skip();
+    const [g, sidG] = await guest();
+    const qg = viewId();
+    await register(qg, sidG);
+    await root.query(`UPDATE $id SET ownerHash = 'stored'`, { id: qg });
+
+    const [own] = (await g.query('SELECT * FROM ONLY $id', { id: qg })) as [
+      Record<string, unknown>,
+    ];
+    expect(own.subscribers).toBeDefined();
+    expect(own).not.toHaveProperty('ownerHash');
+    for (const set of [`ownerHash = 'mine'`, 'ownerHash = NONE']) {
+      await g.query(`UPDATE $id SET ${set}`, { id: qg });
+      expect((await row(qg))?.ownerHash).toBe('stored');
+    }
+    // The heartbeat still writes what it needs to around the frozen field.
+    expect(await heartbeatFound(g, qg)).toBe(true);
+  });
+
   it('the owning guest can still release its view', async (ctx) => {
     if (!reachable) ctx.skip();
     const [a, sidA] = await guest();

package/src/query/register.saga.ts

@@ -161,7 +161,13 @@ export function* registerRemote(env: SagaEnv, hash: QueryHash, retry = false): S
     const table = listRefTable(env, state);
     const results = (yield fx.remote.query(
       sql.registerSelect(table),
-      sql.registerVars({ id: entry.def.id, surql: entry.def.surql, params: { ...entry.def.params }, ttl: entry.def.ttl }),
+      sql.registerVars({
+        id: entry.def.id,
+        surql: entry.def.surql,
+        params: { ...entry.def.params },
+        ttl: entry.def.ttl,
+        ...(state.ownerSecret ? { owner: state.ownerSecret } : {}),
+      }),
       env.remoteTimeoutMs
     )) as StatementResult[];
     const stillThere = (yield fx.state.read((s) => s.queries.has(hash))) as boolean;

package/src/query/sql.test.ts

@@ -39,6 +39,12 @@ describe('query sql builders (golden against the previous builders)', () => {
       config: { id, surql: 's', params: { a: 1 }, ttl: '10m' },
       in: id,
     });
+    // The owner secret rides beside params, never inside them: params name
+    // the computation the SSP shares between views.
+    expect(sql.registerVars({ id, surql: 's', params: { a: 1 }, ttl: '10m', owner: 'k' })).toEqual({
+      config: { id, surql: 's', params: { a: 1 }, ttl: '10m', owner: 'k' },
+      in: id,
+    });
   });
   it('the LIVE on a per-user table is unfiltered; FETCH out only when bodies ride inline', () => {
     expect(sql.listRefLive('_00_list_ref_user_x', { inlineBodies: true, sessionIds: ['s1'] })).toEqual({

package/src/query/sql.ts

@@ -93,6 +93,14 @@ export interface RegisterPayload {
   surql: string;
   params: Record<string, unknown>;
   ttl: string;
+  /**
+   * The registering page's secret. `fn::query::register` forwards only its
+   * hash, and the SSP lets a registration onto an existing anonymous view
+   * only with the hash that view was registered with: every signed-out
+   * visitor is `anon`, and anyone can read an anonymous view's id. Kept out
+   * of `params`, which name the computation the SSP shares between views.
+   */
+  owner?: string;
 }
 
 /** Register + read back edges/meta/children in ONE request. */

package/src/services/database/cache-engine.ts

@@ -151,6 +151,16 @@ export interface LocalStore extends LocalCacheEngine {
    * without it boots the circuit empty, as before.
    */
   scanVersions?(tables: string[]): Promise<Record<string, [string, number][]>>;
+  /**
+   * Reset the cached `_00_rv` of every table whose column set (`fingerprints`,
+   * see `columnFingerprints`) changed since the store last recorded it, except
+   * the rows in `keep`, and record the new sets. Returns the tables reset.
+   * For engines that keep bodies across schema changes: a body landed under an
+   * older schema lacks the columns it did not know, at the server's version,
+   * and would never be fetched again. OPTIONAL: an engine that rebuilds its
+   * store on a schema change (SurrealDB) does not need it.
+   */
+  resetChangedTables?(fingerprints: Record<string, string>, keep: Set<string>): Promise<string[]>;
   /**
    * Circuit snapshot storage, keyed. Lives in the same durable store as the
    * rows (OPFS SQLite), so it is per-bucket by construction, atomic, and

package/src/services/database/sqlite-cache-engine.ts

@@ -30,6 +30,7 @@ import {
   type SqliteTransport,
 } from './sqlite-transport';
 import { PROMOTION_OPEN_OPTIONS } from './sqlite-open';
+import { COLUMNS_ROW_ID, planColumnReset } from './sqlite-column-reset';
 import type { EngineTx, Id, LocalStore, OrderBy, RelationFetch, Row } from './cache-engine';
 import type { EngineStorageDiagnostics } from '../../modules/devtools/storage-info';
 
@@ -898,6 +899,31 @@ export class SqliteCacheEngine implements LocalStore {
     return out;
   }
 
+  /**
+   * Reset the cached `_00_rv` of every table whose column set changed since
+   * the last boot, so its rows are fetched again whole. See
+   * `sqlite-column-reset.ts`. Returns the tables reset.
+   */
+  async resetChangedTables(fingerprints: Record<string, string>, keep: Set<string>): Promise<string[]> {
+    const { rows } = await this.call<{ rows: { data: unknown }[] }>('exec', {
+      sql: `SELECT data FROM "_00_schema" WHERE id = ?`,
+      bind: [COLUMNS_ROW_ID],
+    });
+    let stored: Record<string, string> | null = null;
+    try {
+      const raw = rows?.[0]?.data;
+      if (typeof raw === 'string') stored = JSON.parse(raw) as Record<string, string>;
+    } catch {
+      stored = null;
+    }
+    const { rows: tables } = await this.call<{ rows: { name: string }[] }>('exec', {
+      sql: `SELECT name FROM sqlite_master WHERE type = 'table'`,
+    });
+    const plan = planColumnReset(stored, fingerprints, new Set((tables ?? []).map((t) => t.name)), keep);
+    if (plan.statements.length > 0) await this.call('batch', plan.statements);
+    return plan.changed;
+  }
+
   async getSnapshot(key: string): Promise<StoredSnapshot | null> {
     const { rows } = await this.call<{ rows: { id: string; data: unknown }[] }>('exec', {
       sql: `SELECT id, data FROM "${SNAPSHOT_TABLE}" WHERE id IN (?, ?)`,