@concavejs/docstore-bun-sqlite 0.0.1-alpha.15 → 0.0.1-alpha.16

package/dist/index.js

@@ -1052,19 +1052,7 @@ function hexToString(hex) {
   const buffer = hexToArrayBuffer(hex);
   return new TextDecoder().decode(buffer);
 }
-function deserializeDeveloperId(developerId) {
-  if (!developerId) {
-    return null;
-  }
-  for (const separator of [DOC_ID_SEPARATOR, LEGACY_DOC_ID_SEPARATOR]) {
-    const parts = developerId.split(separator);
-    if (parts.length === 2 && parts[0] && parts[1]) {
-      return { table: parts[0], internalId: parts[1] };
-    }
-  }
-  return null;
-}
-var BYTE_TO_HEX, HEX_TO_NIBBLE, DOC_ID_SEPARATOR = ":", LEGACY_DOC_ID_SEPARATOR = ";";
+var BYTE_TO_HEX, HEX_TO_NIBBLE;
 var init_utils = __esm(() => {
   BYTE_TO_HEX = [];
   for (let i2 = 0;i2 < 256; i2++) {
@@ -3312,7 +3300,7 @@ async function listSystemFunctions(options = {}) {
     const listing = filteredListings[i2];
     const result = analysisResults[i2];
     if (result.status === "rejected") {
-      if (!isNpmPackageError(result.reason)) {
+      if (!isExpectedNonFunctionModuleLoadError(result.reason)) {
         console.warn(`Failed to analyze module "${listing.path}":`, result.reason);
       }
       continue;
@@ -3473,7 +3461,10 @@ async function discoverCronSpecs(options = {}) {
   }
   return cronSpecs;
 }
-function isNpmPackageError(error) {
+function isExpectedNonFunctionModuleLoadError(error) {
+  return isNpmPackageResolutionError(error) || isStubbedComponentDependencyError(error);
+}
+function isNpmPackageResolutionError(error) {
   if (!(error instanceof Error))
     return false;
   const causes = error.causes;
@@ -3489,6 +3480,15 @@ function isNpmPackageError(error) {
     return !modulePath.startsWith(".") && !modulePath.startsWith("/");
   });
 }
+function isStubbedComponentDependencyError(error) {
+  if (!(error instanceof Error))
+    return false;
+  if (error.message.includes("could not be resolved while bundling component modules") && error.message.includes("only an error if this module is loaded at runtime")) {
+    return true;
+  }
+  const causes = error.causes;
+  return Array.isArray(causes) && causes.some((cause) => isStubbedComponentDependencyError(cause));
+}
 var moduleAnalysisCache, moduleLoaderApiPromise = null, unsubscribeModuleLoader = null;
 var init_function_introspection = __esm(() => {
   init_analysis();
@@ -5416,6 +5416,10 @@ function parseBoolean(value) {
     return;
   return value.toLowerCase() === "true" || value === "1";
 }
+function isDevEnvironment(env) {
+  const environment = getEnvValue("ENVIRONMENT", env) ?? getEnvValue("CONCAVE_ENVIRONMENT", env) ?? getEnvValue("NODE_ENV", env);
+  return environment === "development" || parseBoolean(getEnvValue("CONCAVE_DEV", env)) === true;
+}
 function parseNumber(value) {
   if (!value)
     return;
@@ -5425,8 +5429,7 @@ function parseNumber(value) {
 function resolveAdminAuthConfigFromEnv(env) {
   const token = getEnvValue("ADMIN_TOKEN", env) ?? getEnvValue("CONCAVE_ADMIN_TOKEN", env) ?? getEnvValue("CONCAVE_ADMIN_KEY", env);
   const allowInsecure = parseBoolean(getEnvValue("CONCAVE_ALLOW_INSECURE_ADMIN", env)) ?? parseBoolean(getEnvValue("ALLOW_INSECURE_ADMIN", env));
-  const environment = getEnvValue("ENVIRONMENT", env) ?? getEnvValue("CONCAVE_ENVIRONMENT", env) ?? getEnvValue("NODE_ENV", env);
-  const allowInsecureFromEnv = allowInsecure ?? environment === "development";
+  const allowInsecureFromEnv = allowInsecure ?? isDevEnvironment(env);
   if (!token && !allowInsecureFromEnv) {
     return;
   }
@@ -5438,8 +5441,7 @@ function resolveAdminAuthConfigFromEnv(env) {
 function resolveSystemAuthConfigFromEnv(env) {
   const token = getEnvValue("SYSTEM_TOKEN", env) ?? getEnvValue("CONCAVE_SYSTEM_TOKEN", env) ?? getEnvValue("CONCAVE_SYSTEM_KEY", env);
   const allowInsecure = parseBoolean(getEnvValue("CONCAVE_ALLOW_INSECURE_SYSTEM", env)) ?? parseBoolean(getEnvValue("ALLOW_INSECURE_SYSTEM", env));
-  const environment = getEnvValue("ENVIRONMENT", env) ?? getEnvValue("CONCAVE_ENVIRONMENT", env) ?? getEnvValue("NODE_ENV", env);
-  const allowInsecureFromEnv = allowInsecure ?? environment === "development";
+  const allowInsecureFromEnv = allowInsecure ?? isDevEnvironment(env);
   if (!token && !allowInsecureFromEnv) {
     return;
   }
@@ -5659,35 +5661,35 @@ var init_jwt = __esm(() => {
 
 // ../core/dist/auth/auth-context.js
 function getAuthContext() {
-  return authContext.getStore();
+  return userIdentityContextStorage.getStore();
 }
-function getPrincipal() {
-  return principalContext.getStore();
+function getResolvedAuthContext() {
+  return resolvedAuthContextStorage.getStore();
 }
-async function runWithAuth(auth, fn, principal) {
-  return principalContext.run(principal, () => authContext.run(auth, fn));
+async function runWithAuth(auth, fn, resolvedAuthContext) {
+  return resolvedAuthContextStorage.run(resolvedAuthContext, () => userIdentityContextStorage.run(auth, fn));
 }
-var AUTH_CONTEXT_SYMBOL, PRINCIPAL_CONTEXT_SYMBOL, globalAuthContext, authContext, principalContext;
+var AUTH_CONTEXT_SYMBOL, RESOLVED_AUTH_CONTEXT_SYMBOL, globalAuthContext, userIdentityContextStorage, resolvedAuthContextStorage;
 var init_auth_context = __esm(() => {
   init_context_storage();
   AUTH_CONTEXT_SYMBOL = Symbol.for("@concavejs/core/auth-context");
-  PRINCIPAL_CONTEXT_SYMBOL = Symbol.for("@concavejs/core/principal-context");
+  RESOLVED_AUTH_CONTEXT_SYMBOL = Symbol.for("@concavejs/core/resolved-auth-context");
   globalAuthContext = globalThis;
-  authContext = globalAuthContext[AUTH_CONTEXT_SYMBOL] ?? new ContextStorage;
-  principalContext = globalAuthContext[PRINCIPAL_CONTEXT_SYMBOL] ?? new ContextStorage;
+  userIdentityContextStorage = globalAuthContext[AUTH_CONTEXT_SYMBOL] ?? new ContextStorage;
+  resolvedAuthContextStorage = globalAuthContext[RESOLVED_AUTH_CONTEXT_SYMBOL] ?? new ContextStorage;
   if (!globalAuthContext[AUTH_CONTEXT_SYMBOL]) {
-    globalAuthContext[AUTH_CONTEXT_SYMBOL] = authContext;
+    globalAuthContext[AUTH_CONTEXT_SYMBOL] = userIdentityContextStorage;
   }
-  if (!globalAuthContext[PRINCIPAL_CONTEXT_SYMBOL]) {
-    globalAuthContext[PRINCIPAL_CONTEXT_SYMBOL] = principalContext;
+  if (!globalAuthContext[RESOLVED_AUTH_CONTEXT_SYMBOL]) {
+    globalAuthContext[RESOLVED_AUTH_CONTEXT_SYMBOL] = resolvedAuthContextStorage;
   }
 });
 
-// ../core/dist/auth/principal.js
-function anonymousPrincipal() {
+// ../core/dist/auth/resolved-auth-context.js
+function anonymousAuthContext() {
   return { kind: "none", scopes: [] };
 }
-function userPrincipal(identity, token, tenantId) {
+function userAuthContext(identity, token, tenantId) {
   const email = identity.email;
   const subject = identity.subject;
   return {
@@ -5699,7 +5701,7 @@ function userPrincipal(identity, token, tenantId) {
     label: email ?? subject
   };
 }
-function adminPrincipal(opts = {}) {
+function adminAuthContext(opts = {}) {
   return {
     kind: "admin",
     scopes: opts.scopes ?? ["*"],
@@ -5709,7 +5711,7 @@ function adminPrincipal(opts = {}) {
     label: opts.label ?? "admin"
   };
 }
-function systemPrincipal(opts = {}) {
+function systemAuthContext(opts = {}) {
   return {
     kind: "system",
     scopes: opts.scopes ?? ["*"],
@@ -5718,48 +5720,122 @@ function systemPrincipal(opts = {}) {
     label: opts.label ?? "system"
   };
 }
-function hasCapability(principal, capability) {
-  if (principal.kind === "none" || principal.kind === "user") {
+function hasCapability(authContext, capability) {
+  if (authContext.kind === "none" || authContext.kind === "user") {
     return false;
   }
-  if (principal.scopes.includes("*")) {
+  if (authContext.scopes.includes("*")) {
     return true;
   }
-  return principal.scopes.includes(capability);
+  return authContext.scopes.includes(capability);
 }
-function canCallInternal(principal) {
-  return principal.kind === "admin" || principal.kind === "system" || principal.kind === "service";
+function canCallInternal(authContext) {
+  return authContext.kind === "admin" || authContext.kind === "system" || authContext.kind === "service";
 }
-function canAccessComponents(principal) {
-  return principal.kind === "admin" || principal.kind === "system";
+function canAccessComponents(authContext) {
+  return authContext.kind === "admin" || authContext.kind === "system";
 }
 function isAuthPrivileged(auth) {
   return auth?.tokenType === "Admin" || auth?.tokenType === "System";
 }
-function legacyAuthContextToPrincipal(authContext2, tenantId) {
-  switch (authContext2.tokenType) {
+function resolvedAuthContextToWireAuthContext(authContext) {
+  switch (authContext.kind) {
+    case "admin":
+      return { tokenType: "Admin", token: authContext.token, userIdentity: authContext.userIdentity };
+    case "system":
+      return { tokenType: "System", token: authContext.token, userIdentity: authContext.userIdentity };
+    case "user":
+      return { tokenType: "User", token: authContext.token, userIdentity: authContext.userIdentity };
+    case "service":
+      return { tokenType: "Admin", token: authContext.token, userIdentity: authContext.userIdentity };
+    default:
+      return { tokenType: "None" };
+  }
+}
+function wireAuthContextToResolvedAuthContext(authContext, tenantId) {
+  switch (authContext.tokenType) {
     case "Admin":
-      return adminPrincipal({
-        token: authContext2.token,
+      return adminAuthContext({
+        token: authContext.token,
         tenantId,
-        impersonating: authContext2.userIdentity,
+        impersonating: authContext.userIdentity,
         label: "admin"
       });
     case "System":
-      return systemPrincipal({
-        token: authContext2.token,
+      return systemAuthContext({
+        token: authContext.token,
         tenantId,
         label: "system"
       });
     case "User":
-      if (authContext2.userIdentity) {
-        return userPrincipal(authContext2.userIdentity, authContext2.token, tenantId);
+      if (authContext.userIdentity) {
+        return userAuthContext(authContext.userIdentity, authContext.token, tenantId);
       }
-      return anonymousPrincipal();
+      return anonymousAuthContext();
     default:
-      return anonymousPrincipal();
+      return anonymousAuthContext();
+  }
+}
+
+// ../core/dist/auth/execution-auth.js
+function isResolvedAuthContext(value) {
+  return value !== null && typeof value === "object" && "kind" in value && "scopes" in value && !("tokenType" in value);
+}
+function isWireAuthContext(value) {
+  if (value === null || typeof value !== "object" || !("tokenType" in value)) {
+    return false;
+  }
+  const tokenType = value.tokenType;
+  return tokenType === "Admin" || tokenType === "System" || tokenType === "User" || tokenType === "None";
+}
+function resolveExecutionAuth(auth, tenantId) {
+  if (isResolvedAuthContext(auth)) {
+    return {
+      authContext: auth,
+      userIdentity: auth.userIdentity,
+      wireAuthContext: resolvedAuthContextToWireAuthContext(auth),
+      executorAuth: resolvedAuthContextToWireAuthContext(auth)
+    };
+  }
+  if (isWireAuthContext(auth)) {
+    const wireAuthContext = normalizeWireAuthContext(auth);
+    return {
+      authContext: wireAuthContextToResolvedAuthContext(wireAuthContext, tenantId),
+      userIdentity: wireAuthContext.userIdentity,
+      wireAuthContext,
+      executorAuth: wireAuthContext
+    };
+  }
+  if (auth) {
+    return {
+      authContext: userAuthContext(auth, undefined, tenantId),
+      userIdentity: auth,
+      executorAuth: auth
+    };
   }
+  return {
+    authContext: anonymousAuthContext(),
+    wireAuthContext: { tokenType: "None" },
+    executorAuth: undefined
+  };
 }
+function normalizeWireAuthContext(auth) {
+  if (auth.tokenType !== "User" || auth.userIdentity || !auth.token) {
+    return auth;
+  }
+  const userIdentity = identityFromTrustedToken(auth.token);
+  if (!userIdentity) {
+    return auth;
+  }
+  return {
+    ...auth,
+    userIdentity
+  };
+}
+var init_execution_auth = __esm(() => {
+  init_jwt();
+  init_auth_context();
+});
 
 // ../core/dist/auth/auth-resolver.js
 function isLikelyJwt(token) {
@@ -5810,10 +5886,10 @@ class DefaultAuthResolver {
     const token = request.token;
     const tenantId = request.tenantId ?? this.config.tenantId;
     if (!token && hint === "auto") {
-      return { principal: anonymousPrincipal() };
+      return { authContext: anonymousAuthContext() };
     }
     if (hint === "None") {
-      return { principal: anonymousPrincipal() };
+      return { authContext: anonymousAuthContext() };
     }
     if (hint === "Admin") {
       return this.resolveAdmin(token, request.impersonating, tenantId);
@@ -5836,7 +5912,7 @@ class DefaultAuthResolver {
     if (token) {
       return this.resolveUser(token, tenantId);
     }
-    return { principal: anonymousPrincipal() };
+    return { authContext: anonymousAuthContext() };
   }
   isInsecureAdminFallbackEnabled() {
     if (this.config.allowInsecure) {
@@ -5856,13 +5932,13 @@ class DefaultAuthResolver {
       return scoped;
     }
     this.assertAdminToken(token);
-    const principal = adminPrincipal({
+    const authContext = adminAuthContext({
       token,
       tenantId,
       impersonating,
       label: "admin"
     });
-    return { principal, userIdentity: impersonating };
+    return { authContext, userIdentity: impersonating };
   }
   async resolveSystem(token, impersonating, tenantId) {
     const scoped = await this.tryResolveScopedManagementJwt(token, "System", tenantId, impersonating);
@@ -5870,16 +5946,16 @@ class DefaultAuthResolver {
       return scoped;
     }
     this.assertSystemToken(token);
-    const principal = systemPrincipal({
+    const authContext = systemAuthContext({
       token,
       tenantId,
       label: "system"
     });
-    return { principal, userIdentity: impersonating };
+    return { authContext, userIdentity: impersonating };
   }
   async resolveUser(token, tenantId) {
     if (!token) {
-      return { principal: anonymousPrincipal() };
+      return { authContext: anonymousAuthContext() };
     }
     const providers = this.config.jwtProviders;
     if (providers && providers.length > 0) {
@@ -5887,8 +5963,8 @@ class DefaultAuthResolver {
       for (const providerConfig of providers) {
         try {
           const identity2 = await verifyJwtAndGetIdentity(token, providerConfig);
-          const principal2 = userPrincipal(identity2, token, tenantId);
-          return { principal: principal2, userIdentity: identity2 };
+          const authContext2 = userAuthContext(identity2, token, tenantId);
+          return { authContext: authContext2, userIdentity: identity2 };
         } catch (error) {
           errors2.push(error instanceof Error ? error : new Error(String(error)));
         }
@@ -5896,8 +5972,8 @@ class DefaultAuthResolver {
       if (this.config.jwtConfig) {
         try {
           const identity2 = await verifyJwtAndGetIdentity(token, this.config.jwtConfig);
-          const principal2 = userPrincipal(identity2, token, tenantId);
-          return { principal: principal2, userIdentity: identity2 };
+          const authContext2 = userAuthContext(identity2, token, tenantId);
+          return { authContext: authContext2, userIdentity: identity2 };
         } catch (error) {
           errors2.push(error instanceof Error ? error : new Error(String(error)));
         }
@@ -5906,8 +5982,8 @@ class DefaultAuthResolver {
       throw new JWTValidationError("INVALID_TOKEN", `JWT verification failed for all providers: ${messages}`);
     }
     const identity = await verifyJwtAndGetIdentity(token, this.config.jwtConfig);
-    const principal = userPrincipal(identity, token, tenantId);
-    return { principal, userIdentity: identity };
+    const authContext = userAuthContext(identity, token, tenantId);
+    return { authContext, userIdentity: identity };
   }
   isAdminToken(token) {
     return !!this.config.adminAuth?.token && token === this.config.adminAuth.token;
@@ -6018,24 +6094,24 @@ class DefaultAuthResolver {
       }
     }
     const label = readStringClaim(claims, cfg.labelClaim ?? "email") ?? readStringClaim(claims, "sub") ?? undefined;
-    const principalTenantId = tokenTenantId ?? tenantId;
+    const authContextTenantId = tokenTenantId ?? tenantId;
     if (expectedType === "Admin") {
-      const principal2 = adminPrincipal({
+      const authContext2 = adminAuthContext({
         token,
-        tenantId: principalTenantId,
+        tenantId: authContextTenantId,
         scopes: effectiveScopes,
         impersonating,
         label
       });
-      return { principal: principal2, userIdentity: impersonating };
+      return { authContext: authContext2, userIdentity: impersonating };
     }
-    const principal = systemPrincipal({
+    const authContext = systemAuthContext({
       token,
-      tenantId: principalTenantId,
+      tenantId: authContextTenantId,
       scopes: effectiveScopes,
       label
     });
-    return { principal, userIdentity: impersonating };
+    return { authContext, userIdentity: impersonating };
   }
 }
 
@@ -6187,44 +6263,44 @@ var init_auth_resolver = __esm(() => {
 
 // ../core/dist/auth/authorization-policy.js
 class DefaultAuthorizationPolicy {
-  authorize(principal, action) {
+  authorize(authContext, action) {
     switch (action.kind) {
       case "call_function":
-        return this.authorizeCallFunction(principal, action);
+        return this.authorizeCallFunction(authContext, action);
       case "call_system_function":
-        return this.authorizeSystemFunction(principal, action);
+        return this.authorizeSystemFunction(authContext, action);
       case "access_component":
-        return this.authorizeComponentAccess(principal, action);
+        return this.authorizeComponentAccess(authContext, action);
       case "management_operation":
-        return this.authorizeManagementOp(principal, action);
+        return this.authorizeManagementOp(authContext, action);
       case "custom":
         return deny(`Custom action '${action.name}' not handled by default policy`);
     }
   }
-  authorizeCallFunction(principal, action) {
-    if (action.isInternal && !canCallInternal(principal)) {
+  authorizeCallFunction(authContext, action) {
+    if (action.isInternal && !canCallInternal(authContext)) {
       return deny("Internal functions require admin, system, or service authentication", "FORBIDDEN_INTERNAL");
     }
-    if (action.componentPath && !canAccessComponents(principal)) {
+    if (action.componentPath && !canAccessComponents(authContext)) {
       return deny("Component-scoped function calls require admin or system authentication", "FORBIDDEN_COMPONENT");
     }
     return ALLOWED;
   }
-  authorizeSystemFunction(principal, action) {
-    if (!canCallInternal(principal)) {
+  authorizeSystemFunction(authContext, action) {
+    if (!canCallInternal(authContext)) {
       return deny(`System function '${action.functionName}' requires admin, system, or service authentication`, "FORBIDDEN_SYSTEM");
     }
     return ALLOWED;
   }
-  authorizeComponentAccess(principal, _action) {
-    if (!canAccessComponents(principal)) {
+  authorizeComponentAccess(authContext, _action) {
+    if (!canAccessComponents(authContext)) {
       return deny("Component access requires admin or system authentication", "FORBIDDEN_COMPONENT");
     }
     return ALLOWED;
   }
-  authorizeManagementOp(principal, action) {
-    if (!hasCapability(principal, action.capability)) {
-      return deny(`Principal lacks required capability '${action.capability}'` + (action.resource ? ` for resource '${action.resource}'` : ""), "FORBIDDEN_CAPABILITY");
+  authorizeManagementOp(authContext, action) {
+    if (!hasCapability(authContext, action.capability)) {
+      return deny(`ResolvedAuthContext lacks required capability '${action.capability}'` + (action.resource ? ` for resource '${action.resource}'` : ""), "FORBIDDEN_CAPABILITY");
     }
     return ALLOWED;
   }
@@ -6232,8 +6308,8 @@ class DefaultAuthorizationPolicy {
 function deny(reason, code2) {
   return { allowed: false, reason, code: code2 };
 }
-function requireAuthorization(principal, action, policy = defaultAuthorizationPolicy) {
-  const decision = policy.authorize(principal, action);
+function requireAuthorization(authContext, action, policy = defaultAuthorizationPolicy) {
+  const decision = policy.authorize(authContext, action);
   if (!decision.allowed) {
     const err = new Error(decision.reason);
     err.code = decision.code ?? "FORBIDDEN";
@@ -6256,6 +6332,7 @@ var init_auth_config_service = __esm(() => {
 var init_auth = __esm(() => {
   init_jwt();
   init_auth_context();
+  init_execution_auth();
   init_auth_resolver();
   init_authorization_policy();
   init_auth_config_service();
@@ -6354,6 +6431,7 @@ function createTableRegistrySnapshot(tables, partial) {
     fullName: table.fullName,
     isSystem: table.isSystem,
     visibility: table.visibility,
+    state: table.state,
     createdAt: table.createdAt
   })).sort((a, b) => a.tableNumber - b.tableNumber);
   const updatedAt = partial?.updatedAt ?? Date.now();
@@ -6970,11 +7048,11 @@ var init_system_tables = __esm(() => {
 
 // ../core/dist/system/internal.js
 function requireSystemCapability(capability) {
-  const principal2 = getPrincipal();
-  if (!principal2) {
+  const authContext = getResolvedAuthContext();
+  if (!authContext) {
     throw new Error("System functions require authentication context");
   }
-  requireAuthorization(principal2, { kind: "management_operation", capability });
+  requireAuthorization(authContext, { kind: "management_operation", capability });
 }
 function createSystemFunctions(deps) {
   const { query, mutation } = deps;
@@ -8328,8 +8406,8 @@ Path: ${formatPath(path)}
 Value: ${formatValue(value)}
 Validator: v.id("${validator2.tableName}")`);
         }
-        const tableName2 = tableNameFromConvexId(value, options);
-        if (!tableName2 || !isMatchingValidatorTable(tableName2, validator2.tableName, options.componentPath)) {
+        const tableName = tableNameFromConvexId(value, options);
+        if (!tableName || !isMatchingValidatorTable(tableName, validator2.tableName, options.componentPath)) {
           throw new Error(`Value does not match validator.
 Path: ${formatPath(path)}
 Value: ${formatValue(value)}
@@ -8337,14 +8415,10 @@ Validator: v.id("${validator2.tableName}")`);
         }
         return;
       }
-      const tableName = tableNameFromId(value);
-      if (!tableName || !isMatchingValidatorTable(tableName, validator2.tableName, options.componentPath)) {
-        throw new Error(`Value does not match validator.
+      throw new Error(`Value does not match validator.
 Path: ${formatPath(path)}
 Value: ${formatValue(value)}
 Validator: v.id("${validator2.tableName}")`);
-      }
-      return;
     }
     case "array": {
       if (!Array.isArray(value)) {
@@ -8413,13 +8487,6 @@ Validator: v.object({...})`);
     }
   }
 }
-function tableNameFromId(id) {
-  const parts = deserializeDeveloperId(id);
-  if (!parts) {
-    return null;
-  }
-  return hexToString(parts.table);
-}
 function tableNameFromConvexId(id, options) {
   try {
     const decoded = decodeDocumentId(id);
@@ -8535,7 +8602,6 @@ function isSimpleObject2(value) {
 }
 var ValidatorError, referencedTableNamesCache;
 var init_validator2 = __esm(() => {
-  init_utils();
   init_interface2();
   init_module_loader();
   init_id_codec();
@@ -8632,60 +8698,7 @@ var GLOBALS_TABLE_SCHEMA = `
 `;
 // ../core/dist/abstractions/runtime-services.js
 function resolveRuntimeServices(services) {
-  if (isResolvedRuntimeServices(services)) {
-    return services;
-  }
-  const storageCapabilities = resolveStorageCapabilities(services);
-  return {
-    ...services,
-    blobstore: storageCapabilities.blobs?.store,
-    searchstore: storageCapabilities.search,
-    vecstore: storageCapabilities.vector,
-    storageCapabilities
-  };
-}
-function isResolvedRuntimeServices(services) {
-  return "storageCapabilities" in services;
-}
-function resolveStorageCapabilities(services) {
-  const blobCapability = resolveBlobCapability(services.capabilities?.blobs);
-  const searchCapability = resolveSearchCapability(services.capabilities?.search, services.docstore);
-  const vectorCapability = resolveVectorCapability(services.capabilities?.vector, services.docstore);
-  return {
-    ...blobCapability ? { blobs: blobCapability } : {},
-    ...searchCapability ? { search: searchCapability } : {},
-    ...vectorCapability ? { vector: vectorCapability } : {}
-  };
-}
-function resolveBlobCapability(capability) {
-  if (!capability) {
-    return;
-  }
-  if (!isBlobCapabilityObject(capability)) {
-    throw new Error("storage.blobstore must be false or an object with a BlobStore in storage.blobstore.store");
-  }
-  if (capability.consistency !== "atomic" && capability.consistency !== "eventual") {
-    throw new Error('storage.blobstore.consistency must be "atomic" or "eventual"');
-  }
-  return {
-    store: capability.store,
-    consistency: capability.consistency
-  };
-}
-function isBlobCapabilityObject(capability) {
-  return typeof capability === "object" && capability !== null && typeof capability.store?.store === "function" && typeof capability.store?.get === "function" && typeof capability.store?.delete === "function" && typeof capability.store?.getUrl === "function";
-}
-function resolveSearchCapability(capability, _docstore) {
-  if (capability === false) {
-    return;
-  }
-  return capability;
-}
-function resolveVectorCapability(capability, _docstore) {
-  if (capability === false) {
-    return;
-  }
-  return capability;
+  return services;
 }
 // ../core/dist/abstractions/storage-spec.js
 var CAPABILITY_MAP_KEYS = new Set([
@@ -8694,10 +8707,7 @@ var CAPABILITY_MAP_KEYS = new Set([
   "search",
   "vecstore",
   "transaction",
-  "close",
-  "documents",
-  "blobs",
-  "vector"
+  "close"
 ]);
 
 // ../core/dist/index.js
@@ -8848,6 +8858,7 @@ init_interface();
 // ../core/dist/queryengine/developer-id.js
 init_utils();
 init_id_codec();
+var LEGACY_INTERNAL_DOCUMENT_ID_RE = /^([0-9a-fA-F]+):([0-9a-fA-F]{32})$/;
 function parseDeveloperId(developerId) {
   if (isValidDocumentId(developerId)) {
     try {
@@ -8857,13 +8868,11 @@ function parseDeveloperId(developerId) {
         internalId: internalIdToHex(decoded.internalId),
         tableNumber: decoded.tableNumber
       };
-    } catch {}
-  }
-  const parts = deserializeDeveloperId(developerId);
-  if (!parts) {
-    return null;
+    } catch {
+      return null;
+    }
   }
-  return { table: parts.table, internalId: parts.internalId };
+  return parseLegacyInternalDocumentId(developerId);
 }
 async function parseDeveloperIdWithTableRegistry(developerId, tableRegistry) {
   if (isValidDocumentId(developerId)) {
@@ -8897,6 +8906,20 @@ function parseStorageId(storageId) {
   }
   return null;
 }
+function parseLegacyInternalDocumentId(developerId) {
+  const match = LEGACY_INTERNAL_DOCUMENT_ID_RE.exec(developerId);
+  if (!match) {
+    return null;
+  }
+  const table = match[1].toLowerCase();
+  if (table.length === 0 || table.length % 2 !== 0) {
+    return null;
+  }
+  return {
+    table,
+    internalId: match[2].toLowerCase()
+  };
+}
 function isTablePlaceholder(table) {
   return table.startsWith("#");
 }
@@ -9027,6 +9050,123 @@ class UncommittedWrites {
   }
 }
 
+// ../core/dist/transactor/occ-transaction.js
+init_udf_trace();
+
+// ../core/dist/limits/transaction-headroom.js
+init_values();
+var MEBIBYTE = 1024 * 1024;
+var TRANSACTION_HEADROOM_LIMITS = {
+  bytesRead: 16 * MEBIBYTE,
+  bytesWritten: 16 * MEBIBYTE,
+  databaseQueries: 4096,
+  documentsRead: 32000,
+  documentsWritten: 16000,
+  functionsScheduled: 1000,
+  scheduledFunctionArgsBytes: 16 * MEBIBYTE
+};
+var encoder = new TextEncoder;
+function remaining(limit, used) {
+  return Math.max(0, limit - used);
+}
+function estimateConvexValueBytes(value) {
+  const json = JSON.stringify(convexToJson(value));
+  return encoder.encode(json).byteLength;
+}
+
+class TransactionHeadroomTracker {
+  bytesRead = 0;
+  documentsRead = 0;
+  databaseQueries = 0;
+  functionsScheduled = 0;
+  scheduledFunctionArgsBytes = 0;
+  bytesWritten = 0;
+  writtenDocuments = new Map;
+  recordDatabaseQuery(count = 1) {
+    this.databaseQueries += count;
+  }
+  recordRead(value) {
+    this.documentsRead += 1;
+    this.bytesRead += estimateConvexValueBytes(value);
+  }
+  recordReads(values) {
+    for (const value of values) {
+      this.recordRead(value);
+    }
+  }
+  recordScheduledFunction(args) {
+    this.functionsScheduled += 1;
+    this.scheduledFunctionArgsBytes += estimateConvexValueBytes(args);
+  }
+  trackWrittenDocument(documentKey, value) {
+    const nextBytes = estimateConvexValueBytes(value);
+    const previousBytes = this.writtenDocuments.get(documentKey);
+    if (previousBytes !== undefined) {
+      this.bytesWritten -= previousBytes;
+    }
+    this.writtenDocuments.set(documentKey, nextBytes);
+    this.bytesWritten += nextBytes;
+  }
+  snapshot() {
+    return {
+      bytesRead: this.bytesRead,
+      documentsRead: this.documentsRead,
+      databaseQueries: this.databaseQueries,
+      functionsScheduled: this.functionsScheduled,
+      scheduledFunctionArgsBytes: this.scheduledFunctionArgsBytes,
+      bytesWritten: this.bytesWritten,
+      writtenDocuments: new Map(this.writtenDocuments)
+    };
+  }
+  restore(snapshot) {
+    this.bytesRead = snapshot.bytesRead;
+    this.documentsRead = snapshot.documentsRead;
+    this.databaseQueries = snapshot.databaseQueries;
+    this.functionsScheduled = snapshot.functionsScheduled;
+    this.scheduledFunctionArgsBytes = snapshot.scheduledFunctionArgsBytes;
+    this.bytesWritten = snapshot.bytesWritten;
+    this.writtenDocuments.clear();
+    for (const [documentKey, bytes] of snapshot.writtenDocuments) {
+      this.writtenDocuments.set(documentKey, bytes);
+    }
+  }
+  getHeadroom() {
+    return {
+      bytesRead: {
+        used: this.bytesRead,
+        remaining: remaining(TRANSACTION_HEADROOM_LIMITS.bytesRead, this.bytesRead)
+      },
+      bytesWritten: {
+        used: this.bytesWritten,
+        remaining: remaining(TRANSACTION_HEADROOM_LIMITS.bytesWritten, this.bytesWritten)
+      },
+      databaseQueries: {
+        used: this.databaseQueries,
+        remaining: remaining(TRANSACTION_HEADROOM_LIMITS.databaseQueries, this.databaseQueries)
+      },
+      documentsRead: {
+        used: this.documentsRead,
+        remaining: remaining(TRANSACTION_HEADROOM_LIMITS.documentsRead, this.documentsRead)
+      },
+      documentsWritten: {
+        used: this.writtenDocuments.size,
+        remaining: remaining(TRANSACTION_HEADROOM_LIMITS.documentsWritten, this.writtenDocuments.size)
+      },
+      functionsScheduled: {
+        used: this.functionsScheduled,
+        remaining: remaining(TRANSACTION_HEADROOM_LIMITS.functionsScheduled, this.functionsScheduled)
+      },
+      scheduledFunctionArgsBytes: {
+        used: this.scheduledFunctionArgsBytes,
+        remaining: remaining(TRANSACTION_HEADROOM_LIMITS.scheduledFunctionArgsBytes, this.scheduledFunctionArgsBytes)
+      }
+    };
+  }
+}
+
+// ../core/dist/transactor/occ-commit.js
+init_udf_trace();
+
 // ../core/dist/transactor/occ-validation.js
 init_interface();
 init_interface();
@@ -9064,7 +9204,7 @@ function createDocumentReadValidationMap(docstore, documentReads) {
   if (pendingIds.length === 0) {
     return;
   }
-  return docstore.get_many(pendingIds);
+  return docstore.getMany(pendingIds);
 }
 async function validateDocumentRead(docstore, key, readVersion, currentDocsPromise) {
   const parsedId = parseDocumentIdKey(key);
@@ -9121,7 +9261,7 @@ async function validateIndexRangeRead(docstore, indexId, startKey, endKey, readT
   const interval = { start: startKey, end: endKey };
   const validationReadTimestamp = resolveValidationReadTimestamp(docstore, readTimestamp);
   const currentDocIds = new Set;
-  for await (const [, doc] of docstore.index_scan(encodedIndexId, encodedTableId, validationReadTimestamp, interval, Order.Asc)) {
+  for await (const [, doc] of docstore.indexScan(encodedIndexId, encodedTableId, validationReadTimestamp, interval, Order.Asc)) {
     currentDocIds.add(documentIdKey(doc.value.id));
   }
   for (const docId of currentDocIds) {
@@ -9160,119 +9300,47 @@ function resolveValidationReadTimestamp(docstore, minimumTimestamp) {
   return latestKnownTimestamp > minimumTimestamp ? latestKnownTimestamp : minimumTimestamp;
 }
 
-// ../core/dist/transactor/occ-transaction.js
+// ../core/dist/transactor/occ-commit.js
 init_commit_lock();
-init_udf_trace();
-
-// ../core/dist/limits/transaction-headroom.js
-init_values();
-var MEBIBYTE = 1024 * 1024;
-var TRANSACTION_HEADROOM_LIMITS = {
-  bytesRead: 16 * MEBIBYTE,
-  bytesWritten: 16 * MEBIBYTE,
-  databaseQueries: 4096,
-  documentsRead: 32000,
-  documentsWritten: 16000,
-  functionsScheduled: 1000,
-  scheduledFunctionArgsBytes: 16 * MEBIBYTE
-};
-var encoder = new TextEncoder;
-function remaining(limit, used) {
-  return Math.max(0, limit - used);
-}
-function estimateConvexValueBytes(value) {
-  const json = JSON.stringify(convexToJson(value));
-  return encoder.encode(json).byteLength;
-}
-
-class TransactionHeadroomTracker {
-  bytesRead = 0;
-  documentsRead = 0;
-  databaseQueries = 0;
-  functionsScheduled = 0;
-  scheduledFunctionArgsBytes = 0;
-  bytesWritten = 0;
-  writtenDocuments = new Map;
-  recordDatabaseQuery(count = 1) {
-    this.databaseQueries += count;
-  }
-  recordRead(value) {
-    this.documentsRead += 1;
-    this.bytesRead += estimateConvexValueBytes(value);
-  }
-  recordReads(values) {
-    for (const value of values) {
-      this.recordRead(value);
+async function commitOccWrites(request) {
+  let committedTimestamp = 0n;
+  const runCommit = async () => {
+    await withTraceSpan("occ.validate_read_set", "transaction", async () => {
+      await validateReadSetForCommit(request.docstore, request.readChecks, request.writtenDocKeys);
+    }, {
+      readCheckCount: request.readChecks.length
+    });
+    committedTimestamp = await request.allocateCommitTimestamp();
+    addTraceEvent("occ.commit_timestamp_allocated", {
+      commitTimestamp: committedTimestamp.toString()
+    });
+    for (const entry of request.writeEntries) {
+      entry.ts = committedTimestamp;
     }
-  }
-  recordScheduledFunction(args) {
-    this.functionsScheduled += 1;
-    this.scheduledFunctionArgsBytes += estimateConvexValueBytes(args);
-  }
-  trackWrittenDocument(documentKey, value) {
-    const nextBytes = estimateConvexValueBytes(value);
-    const previousBytes = this.writtenDocuments.get(documentKey);
-    if (previousBytes !== undefined) {
-      this.bytesWritten -= previousBytes;
+    for (const indexEntry of request.indexEntries) {
+      indexEntry.ts = committedTimestamp;
     }
-    this.writtenDocuments.set(documentKey, nextBytes);
-    this.bytesWritten += nextBytes;
-  }
-  snapshot() {
-    return {
-      bytesRead: this.bytesRead,
-      documentsRead: this.documentsRead,
-      databaseQueries: this.databaseQueries,
-      functionsScheduled: this.functionsScheduled,
-      scheduledFunctionArgsBytes: this.scheduledFunctionArgsBytes,
-      bytesWritten: this.bytesWritten,
-      writtenDocuments: new Map(this.writtenDocuments)
-    };
-  }
-  restore(snapshot) {
-    this.bytesRead = snapshot.bytesRead;
-    this.documentsRead = snapshot.documentsRead;
-    this.databaseQueries = snapshot.databaseQueries;
-    this.functionsScheduled = snapshot.functionsScheduled;
-    this.scheduledFunctionArgsBytes = snapshot.scheduledFunctionArgsBytes;
-    this.bytesWritten = snapshot.bytesWritten;
-    this.writtenDocuments.clear();
-    for (const [documentKey, bytes] of snapshot.writtenDocuments) {
-      this.writtenDocuments.set(documentKey, bytes);
+    if (request.writeEntries.length > 0 || request.indexEntries.size > 0) {
+      await withTraceSpan("occ.persist_writes", "storage", async () => {
+        await request.docstore.write(request.writeEntries, request.indexEntries, "Error");
+      }, {
+        documentCount: request.writeEntries.length,
+        indexUpdateCount: request.indexEntries.size
+      });
     }
+  };
+  try {
+    await commitWithDerivedSync(request.docstore, { searchstore: request.searchstore, vecstore: request.vecstore }, request.writeEntries, runCommit);
+  } catch (error) {
+    if (error instanceof ConflictError) {
+      addTraceEvent("occ.conflict", {
+        message: error.message
+      });
+      throw error;
+    }
+    throw error;
   }
-  getHeadroom() {
-    return {
-      bytesRead: {
-        used: this.bytesRead,
-        remaining: remaining(TRANSACTION_HEADROOM_LIMITS.bytesRead, this.bytesRead)
-      },
-      bytesWritten: {
-        used: this.bytesWritten,
-        remaining: remaining(TRANSACTION_HEADROOM_LIMITS.bytesWritten, this.bytesWritten)
-      },
-      databaseQueries: {
-        used: this.databaseQueries,
-        remaining: remaining(TRANSACTION_HEADROOM_LIMITS.databaseQueries, this.databaseQueries)
-      },
-      documentsRead: {
-        used: this.documentsRead,
-        remaining: remaining(TRANSACTION_HEADROOM_LIMITS.documentsRead, this.documentsRead)
-      },
-      documentsWritten: {
-        used: this.writtenDocuments.size,
-        remaining: remaining(TRANSACTION_HEADROOM_LIMITS.documentsWritten, this.writtenDocuments.size)
-      },
-      functionsScheduled: {
-        used: this.functionsScheduled,
-        remaining: remaining(TRANSACTION_HEADROOM_LIMITS.functionsScheduled, this.functionsScheduled)
-      },
-      scheduledFunctionArgsBytes: {
-        used: this.scheduledFunctionArgsBytes,
-        remaining: remaining(TRANSACTION_HEADROOM_LIMITS.scheduledFunctionArgsBytes, this.scheduledFunctionArgsBytes)
-      }
-    };
-  }
+  return committedTimestamp;
 }
 
 // ../core/dist/transactor/occ-transaction.js
@@ -9427,7 +9495,7 @@ class OccMutationTransaction {
     const requests = Array.from(this.pendingLatestFetches.values());
     this.pendingLatestFetches.clear();
     try {
-      const fetched = await withTraceSpan("tx.get_many_latest", "storage", () => this.docstore.get_many(requests.map((request) => request.id), this.snapshotTimestamp), { documentCount: requests.length });
+      const fetched = await withTraceSpan("tx.getManyLatest", "storage", () => this.docstore.getMany(requests.map((request) => request.id), this.snapshotTimestamp), { documentCount: requests.length });
       for (const request of requests) {
         const key = documentIdKey(request.id);
         const latest = fetched.get(key) ?? null;
@@ -9456,7 +9524,7 @@ class OccMutationTransaction {
       missingIds.push(id);
     }
     if (missingIds.length > 0) {
-      const fetched = await withTraceSpan("tx.get_many_latest", "storage", () => this.docstore.get_many(missingIds, this.snapshotTimestamp), { documentCount: missingIds.length });
+      const fetched = await withTraceSpan("tx.getManyLatest", "storage", () => this.docstore.getMany(missingIds, this.snapshotTimestamp), { documentCount: missingIds.length });
       for (const id of missingIds) {
         const key = documentIdKey(id);
         const latest = fetched.get(key) ?? null;
@@ -9587,43 +9655,16 @@ class OccMutationTransaction {
         stagedIndexCount: indexEntries.size,
         readCheckCount: readChecks.length
       });
-      let committedTimestamp = 0n;
-      const runCommit = async () => {
-        await withTraceSpan("occ.validate_read_set", "transaction", async () => {
-          await validateReadSetForCommit(this.docstore, readChecks, writtenDocKeys);
-        }, {
-          readCheckCount: readChecks.length
-        });
-        committedTimestamp = await this.allocateCommitTimestamp();
-        addTraceEvent("occ.commit_timestamp_allocated", {
-          commitTimestamp: committedTimestamp.toString()
-        });
-        for (const entry of writeEntries) {
-          entry.ts = committedTimestamp;
-        }
-        for (const indexEntry of indexEntries) {
-          indexEntry.ts = committedTimestamp;
-        }
-        if (writeEntries.length > 0 || indexEntries.size > 0) {
-          await withTraceSpan("occ.persist_writes", "storage", async () => {
-            await this.docstore.write(writeEntries, indexEntries, "Error");
-          }, {
-            documentCount: writeEntries.length,
-            indexUpdateCount: indexEntries.size
-          });
-        }
-      };
-      try {
-        await commitWithDerivedSync(this.docstore, { searchstore: this.searchstore, vecstore: this.vecstore }, writeEntries, runCommit);
-      } catch (error) {
-        if (error instanceof ConflictError) {
-          addTraceEvent("occ.conflict", {
-            message: error.message
-          });
-          throw error;
-        }
-        throw error;
-      }
+      const committedTimestamp = await commitOccWrites({
+        docstore: this.docstore,
+        searchstore: this.searchstore,
+        vecstore: this.vecstore,
+        writeEntries,
+        indexEntries,
+        readChecks,
+        writtenDocKeys,
+        allocateCommitTimestamp: () => this.allocateCommitTimestamp()
+      });
       setCurrentTraceSpanAttributes({
         committedTimestamp: committedTimestamp.toString()
       });
@@ -9651,6 +9692,7 @@ class SchemaService {
   tableCache = new Map;
   schemaValidator;
   componentPath;
+  tableRegistry;
   runtimeMetadataSnapshot;
   constructor(componentPath, tableRegistry, runtimeMetadataSnapshot) {
     this.componentPath = componentPath;
@@ -9861,7 +9903,7 @@ class SnapshotDocAccess {
       missingIds.push(id);
     }
     if (missingIds.length > 0) {
-      const fetched = await withTraceSpan("doc_access.get_many", "storage", () => this.docstore.get_many(missingIds, snapshotTimestamp), { documentCount: missingIds.length });
+      const fetched = await withTraceSpan("doc_access.getMany", "storage", () => this.docstore.getMany(missingIds, snapshotTimestamp), { documentCount: missingIds.length });
       for (const id of missingIds) {
         const docKey = documentIdKey(id);
         const cacheKey = `${snapshotTimestamp}:${documentIdKey(id)}`;
@@ -9907,7 +9949,7 @@ class SnapshotDocAccess {
     this.pendingLatestBatches.delete(snapshotTimestamp);
     const requests = Array.from(batch.values());
     try {
-      const results = await withTraceSpan("doc_access.get_many", "storage", () => this.docstore.get_many(requests.map((request) => request.id), snapshotTimestamp), { documentCount: requests.length });
+      const results = await withTraceSpan("doc_access.getMany", "storage", () => this.docstore.getMany(requests.map((request) => request.id), snapshotTimestamp), { documentCount: requests.length });
       for (const request of requests) {
         request.resolve(results.get(documentIdKey(request.id)) ?? null);
       }
@@ -9928,7 +9970,7 @@ class SnapshotDocAccess {
   hasTransaction() {
     return false;
   }
-  getDocStore() {
+  getIndexReader() {
     return this.docstore;
   }
   getWriteVersion() {
@@ -9984,7 +10026,7 @@ class TransactionalDocAccess {
   hasTransaction() {
     return true;
   }
-  getDocStore() {
+  getIndexReader() {
     return this.docstore;
   }
   getWriteVersion() {
@@ -10175,7 +10217,7 @@ function rangeExpressionsToIndexBounds(expressions, indexFields) {
   }
   return { start, end };
 }
-async function executeIndexQuery(docstore, tableName, indexName, indexFields, expressions, order, limit, cursor, snapshotTimestamp, onDocumentRead, options) {
+async function executeIndexQuery(indexReader, tableName, indexName, indexFields, expressions, order, limit, cursor, snapshotTimestamp, onDocumentRead, options) {
   return withTraceSpan("query.index.scan", "storage", async () => {
     const tableId = stringToHex(tableName);
     const indexId = stringToHex(`${tableName}:${indexName}`);
@@ -10197,8 +10239,8 @@ async function executeIndexQuery(docstore, tableName, indexName, indexFields, ex
     }
     const results = [];
     const scanLimit = limit !== null ? limit + 1 : Number.MAX_SAFE_INTEGER;
-    const bulkDocStore = docstore;
-    const canUseResumePushdown = resumeIndexKey !== null && typeof bulkDocStore.index_scan_rows_after_key === "function";
+    const bulkIndexReader = indexReader;
+    const canUseResumePushdown = resumeIndexKey !== null && typeof bulkIndexReader.indexScanRowsAfterKey === "function";
     const skippingNeedsInMemoryPass = cursor !== null;
     const pushdownLimit = limit !== null && !skippingNeedsInMemoryPass ? scanLimit : undefined;
     let count = 0;
@@ -10236,21 +10278,21 @@ async function executeIndexQuery(docstore, tableName, indexName, indexFields, ex
         addTraceEvent("query.index.scan.pushdown_resume", {
           resumeMode: "index_key"
         });
-        const rows = await bulkDocStore.index_scan_rows_after_key(indexId, tableId, readTimestamp, interval, indexOrder, resumeIndexKey, pushdownLimit);
+        const rows = await bulkIndexReader.indexScanRowsAfterKey(indexId, tableId, readTimestamp, interval, indexOrder, resumeIndexKey, pushdownLimit);
         for (const [indexKey, document] of rows) {
           if (!processRow(indexKey, document)) {
             break;
           }
         }
-      } else if (typeof bulkDocStore.index_scan_rows === "function") {
-        const rows = await bulkDocStore.index_scan_rows(indexId, tableId, readTimestamp, interval, indexOrder, pushdownLimit);
+      } else if (typeof bulkIndexReader.indexScanRows === "function") {
+        const rows = await bulkIndexReader.indexScanRows(indexId, tableId, readTimestamp, interval, indexOrder, pushdownLimit);
         for (const [indexKey, document] of rows) {
           if (!processRow(indexKey, document)) {
             break;
           }
         }
       } else {
-        const generator = docstore.index_scan(indexId, tableId, readTimestamp, interval, indexOrder, pushdownLimit);
+        const generator = indexReader.indexScan(indexId, tableId, readTimestamp, interval, indexOrder, pushdownLimit);
         for await (const [indexKey, document] of generator) {
           if (!processRow(indexKey, document)) {
             break;
@@ -10952,7 +10994,7 @@ async function executeIndexRangePlan(plan, cursor, limit, deps) {
     let paginationResult;
     let usedFallback = false;
     try {
-      const indexResult = await executeIndexQuery(deps.docStore.getDocStore(), plan.fullTableName, plan.indexDescriptor, plan.indexFields, plan.expressions, plan.order, limit, cursor, deps.context.snapshotTimestamp, observedDocuments ? (latestDoc) => {
+      const indexResult = await executeIndexQuery(deps.docStore.getIndexReader(), plan.fullTableName, plan.indexDescriptor, plan.indexFields, plan.expressions, plan.order, limit, cursor, deps.context.snapshotTimestamp, observedDocuments ? (latestDoc) => {
         observedDocuments.set(documentIdKey(latestDoc.value.id), latestDoc);
       } : undefined, {
         bounds: { start, end }
@@ -12084,19 +12126,30 @@ function getSyscallApiProfile(id = "convex-1.0") {
 }
 
 // ../core/dist/kernel/syscalls/capabilities.js
-var CAPABILITY_UDF_TYPES = {
-  databaseRead: ["query", "mutation"],
-  databaseWrite: ["mutation"],
-  nestedQuery: ["query", "mutation", "action", "httpAction"],
-  nestedMutation: ["mutation", "action", "httpAction"],
-  nestedAction: ["action", "httpAction"],
-  actionSearch: ["action", "httpAction"],
-  functionHandle: ["query", "mutation", "action", "httpAction"],
-  mutationScheduler: ["mutation"],
-  actionScheduler: ["action", "httpAction"]
+var UDF_SYSCALL_CAPABILITIES = {
+  query: ["databaseRead", "nestedQuery", "functionHandle", "transactionHeadroom"],
+  mutation: [
+    "databaseRead",
+    "databaseWrite",
+    "nestedQuery",
+    "nestedMutation",
+    "functionHandle",
+    "mutationScheduler",
+    "transactionHeadroom"
+  ],
+  action: ["nestedQuery", "nestedMutation", "nestedAction", "actionSearch", "functionHandle", "actionScheduler"],
+  httpAction: ["nestedQuery", "nestedMutation", "nestedAction", "actionSearch", "functionHandle", "actionScheduler"]
 };
+var NESTED_UDF_CAPABILITY = {
+  query: "nestedQuery",
+  mutation: "nestedMutation",
+  action: "nestedAction"
+};
+function hasSyscallCapability(udfType, capability) {
+  return UDF_SYSCALL_CAPABILITIES[udfType].includes(capability);
+}
 function assertSyscallCapability(udfType, capability, operation) {
-  if (CAPABILITY_UDF_TYPES[capability].includes(udfType)) {
+  if (hasSyscallCapability(udfType, capability)) {
     return;
   }
   throw new Error(`${operation} not available in ${formatUdfType(udfType)}`);
@@ -12115,6 +12168,12 @@ function formatUdfType(udfType) {
 }
 
 // ../core/dist/kernel/syscalls/action-syscalls.js
+var NESTED_UDF_OPERATION = {
+  query: "Nested queries",
+  mutation: "Nested mutations",
+  action: "Nested actions"
+};
+
 class ActionSyscalls {
   context;
   queryRuntime;
@@ -12140,7 +12199,7 @@ class ActionSyscalls {
     router.registerAsync(this.ops.createFunctionHandle, (args) => this.handleCreateFunctionHandle(args));
   }
   async handleActionQuery(args) {
-    this.requireNestedQuery();
+    this.requireNestedCall("query");
     const target = resolveFunctionTarget(args, this.context.componentPath);
     const udfArguments = normalizeUdfArgsPayload(args.args);
     return await this.invocationManager.execute(target.udfPath, udfArguments, "query", target.componentPath);
@@ -12174,15 +12233,8 @@ class ActionSyscalls {
     assertSyscallCapability(this.context.udfType, "actionSearch", "Search");
     return this.queryRuntime.runSearchAction(args.query);
   }
-  requireNestedQuery() {
-    assertSyscallCapability(this.context.udfType, "nestedQuery", "Nested queries");
-  }
   requireNestedCall(type) {
-    if (type === "query") {
-      this.requireNestedQuery();
-      return;
-    }
-    assertSyscallCapability(this.context.udfType, type === "mutation" ? "nestedMutation" : "nestedAction", type === "mutation" ? "Nested mutations" : "Nested actions");
+    assertSyscallCapability(this.context.udfType, NESTED_UDF_CAPABILITY[type], NESTED_UDF_OPERATION[type]);
   }
 }
 
@@ -12518,7 +12570,7 @@ class HeadroomSyscalls {
     router.registerAsync(this.ops.headroom, async () => this.handleHeadroom());
   }
   handleHeadroom() {
-    if (this.context.udfType !== "query" && this.context.udfType !== "mutation") {
+    if (!hasSyscallCapability(this.context.udfType, "transactionHeadroom")) {
       throw new Error(`Unknown async operation: ${this.ops.headroom}`);
     }
     return this.context.getTransactionHeadroom();
@@ -12539,14 +12591,14 @@ class IdentitySyscalls {
   }
   handleGetUserIdentity() {
     this.context.markAuthAccessed();
-    const authContext2 = this.context.authContext;
-    if (!authContext2) {
+    const authContext = this.context.authContext;
+    if (!authContext) {
       return null;
     }
-    if (authContext2.userIdentity) {
-      return authContext2.userIdentity;
+    if (authContext.userIdentity) {
+      return authContext.userIdentity;
     }
-    const token = authContext2.token;
+    const token = authContext.token;
     if (!token) {
       return null;
     }
@@ -12585,14 +12637,16 @@ class JsSyscallRouter {
 
 // ../core/dist/kernel/syscalls/query-syscalls.js
 class QuerySyscalls {
-  queryRuntime;
   nextQueryId = 1;
   queryResults = {};
   pendingQueries = {};
+  context;
+  queryRuntime;
   ops;
-  constructor(queryRuntime, ops = CONVEX_1_0_SYSCALL_API.query) {
-    this.queryRuntime = queryRuntime;
-    this.ops = ops;
+  constructor(options) {
+    this.context = options.context;
+    this.queryRuntime = options.queryRuntime;
+    this.ops = options.ops ?? CONVEX_1_0_SYSCALL_API.query;
   }
   register(router) {
     router.registerSync(this.ops.queryStream, (args) => this.handleQueryStream(args));
@@ -12601,18 +12655,21 @@ class QuerySyscalls {
     router.registerAsync(this.ops.queryPage, (args) => this.handleQueryPage(args));
   }
   handleQueryStream(args) {
+    this.requireDatabaseRead();
     const { query } = args;
     const queryId = this.nextQueryId++;
     this.pendingQueries[queryId] = query;
     return { queryId };
   }
   handleQueryCleanup(args) {
+    this.requireDatabaseRead();
     const queryId = args.queryId;
     delete this.pendingQueries[queryId];
     delete this.queryResults[queryId];
     return {};
   }
   async handleQueryStreamNext(args) {
+    this.requireDatabaseRead();
     const queryId = args.queryId;
     if (this.pendingQueries[queryId]) {
       const query = this.pendingQueries[queryId];
@@ -12632,6 +12689,7 @@ class QuerySyscalls {
     return { value, done: false };
   }
   async handleQueryPage(args) {
+    this.requireDatabaseRead();
     const { query, cursor, pageSize } = args;
     if (cursor === "_end_cursor") {
       return {
@@ -12647,6 +12705,9 @@ class QuerySyscalls {
       continueCursor: paginatedResult.hasMore ? paginatedResult.nextCursor : "_end_cursor"
     };
   }
+  requireDatabaseRead() {
+    assertSyscallCapability(this.context.udfType, "databaseRead", "Database reads");
+  }
 }
 
 // ../core/dist/kernel/syscalls/schedule-syscalls.js
@@ -12660,15 +12721,17 @@ class ScheduleSyscalls {
     this.ops = options.ops ?? CONVEX_1_0_SYSCALL_API.schedule;
   }
   register(router) {
-    router.registerAsync(this.ops.schedule, (args) => this.handleSchedule(args, false), { argsFormat: "convex" });
-    router.registerAsync(this.ops.scheduleFromAction, (args) => this.handleSchedule(args, true), {
+    router.registerAsync(this.ops.schedule, (args) => this.handleSchedule(args, "mutationScheduler"), {
       argsFormat: "convex"
     });
-    router.registerAsync(this.ops.cancelJobFromAction, (args) => this.handleCancelJob(args, true));
-    router.registerAsync(this.ops.cancelJob, (args) => this.handleCancelJob(args, false));
+    router.registerAsync(this.ops.scheduleFromAction, (args) => this.handleSchedule(args, "actionScheduler"), {
+      argsFormat: "convex"
+    });
+    router.registerAsync(this.ops.cancelJobFromAction, (args) => this.handleCancelJob(args, "actionScheduler"));
+    router.registerAsync(this.ops.cancelJob, (args) => this.handleCancelJob(args, "mutationScheduler"));
   }
-  async handleSchedule(args, isAction) {
-    this.requireScheduler(isAction);
+  async handleSchedule(args, capability) {
+    this.requireScheduler(capability);
     const target = resolveFunctionTarget(args, this.context.componentPath);
     const { args: fnArgs, ts } = args;
     if (fnArgs === undefined || typeof ts !== "number") {
@@ -12677,8 +12740,8 @@ class ScheduleSyscalls {
     const componentPathForJob = normalizeComponentPathValue(target.componentPath ?? this.context.componentPath);
     return this.scheduler.schedule(target.udfPath, fnArgs, ts, componentPathForJob);
   }
-  async handleCancelJob(args, isAction) {
-    this.requireScheduler(isAction);
+  async handleCancelJob(args, capability) {
+    this.requireScheduler(capability);
     const { id, state } = args;
     if (typeof id !== "string") {
       throw new Error("`id` argument for `cancel_job` must be a string.");
@@ -12686,8 +12749,8 @@ class ScheduleSyscalls {
     await this.scheduler.cancel(id, state);
     return {};
   }
-  requireScheduler(isAction) {
-    assertSyscallCapability(this.context.udfType, isAction ? "actionScheduler" : "mutationScheduler", "Scheduler");
+  requireScheduler(capability) {
+    assertSyscallCapability(this.context.udfType, capability, "Scheduler");
   }
 }
 
@@ -12829,7 +12892,11 @@ class KernelSyscalls {
       context: resources.context,
       udfExecutor: resources.udfExecutor
     });
-    new QuerySyscalls(resources.queryRuntime, syscallApi.query).register(this.router);
+    new QuerySyscalls({
+      context: resources.context,
+      queryRuntime: resources.queryRuntime,
+      ops: syscallApi.query
+    }).register(this.router);
     new DatabaseSyscalls({
       context: resources.context,
       docStore: resources.docStore,
@@ -13559,6 +13626,16 @@ function rangesToTables(ranges) {
   }
   return tables;
 }
+function cloneSetMap(source) {
+  const clone = new Map;
+  copySetMap(source, clone);
+  return clone;
+}
+function copySetMap(source, target) {
+  for (const [key, values] of source) {
+    target.set(key, new Set(values));
+  }
+}
 var TABLE_WRITE_TIMESTAMP_TTL_MS = 60 * 60 * 1000;
 var RECENT_WRITE_RANGE_TTL_MS = 60 * 1000;
 var TABLE_WRITE_TIMESTAMP_MAX_SIZE = 1e4;
@@ -13572,6 +13649,30 @@ class SubscriptionGraph {
   clientQueryToId = new Map;
   hashToTables = new Map;
   tableToHashes = new Map;
+  apply(change) {
+    const snapshot = this.snapshot();
+    try {
+      switch (change.type) {
+        case "subscribe":
+          this.setClientQueryHash(change.clientQuery, change.queryId, change.queryHash);
+          this.setQueryTables(change.queryHash, change.tables);
+          break;
+        case "unsubscribe":
+          this.removeClientQuery(change.clientQuery);
+          break;
+        case "unsubscribeClient":
+          this.removeClient(change.clientId);
+          break;
+        case "renameClient":
+          this.renameClient(change.oldClientId, change.newClientId);
+          break;
+      }
+      this.assertConsistent();
+    } catch (error) {
+      this.restore(snapshot);
+      throw error;
+    }
+  }
   getClientQueriesForHash(hash) {
     return this.hashToClientQueries.get(hash) ?? new Set;
   }
@@ -13624,6 +13725,11 @@ class SubscriptionGraph {
     const hash = this.clientQueryToHash.get(oldKey);
     if (!hash)
       return;
+    if (oldKey === newKey) {
+      this.clientQueryToId.set(oldKey, newQueryId);
+      return;
+    }
+    this.removeClientQuery(newKey);
     this.clientQueryToHash.delete(oldKey);
     this.clientQueryToId.delete(oldKey);
     this.clientQueryToHash.set(newKey, hash);
@@ -13632,6 +13738,54 @@ class SubscriptionGraph {
     cqSet.delete(oldKey);
     cqSet.add(newKey);
   }
+  assertConsistent() {
+    for (const [hash, clientQueries] of this.hashToClientQueries) {
+      if (clientQueries.size === 0) {
+        throw new Error(`SubscriptionGraph invariant failed: empty client query set for ${hash}`);
+      }
+      for (const clientQuery of clientQueries) {
+        if (this.clientQueryToHash.get(clientQuery) !== hash) {
+          throw new Error(`SubscriptionGraph invariant failed: stale client query ${clientQuery} for ${hash}`);
+        }
+        if (!this.clientQueryToId.has(clientQuery)) {
+          throw new Error(`SubscriptionGraph invariant failed: missing query id for ${clientQuery}`);
+        }
+      }
+    }
+    for (const [clientQuery, hash] of this.clientQueryToHash) {
+      if (!this.hashToClientQueries.get(hash)?.has(clientQuery)) {
+        throw new Error(`SubscriptionGraph invariant failed: missing reverse hash entry for ${clientQuery}`);
+      }
+      if (!this.clientQueryToId.has(clientQuery)) {
+        throw new Error(`SubscriptionGraph invariant failed: missing query id for ${clientQuery}`);
+      }
+    }
+    for (const clientQuery of this.clientQueryToId.keys()) {
+      if (!this.clientQueryToHash.has(clientQuery)) {
+        throw new Error(`SubscriptionGraph invariant failed: orphaned query id for ${clientQuery}`);
+      }
+    }
+    for (const [hash, tables] of this.hashToTables) {
+      if (!this.hashToClientQueries.has(hash)) {
+        throw new Error(`SubscriptionGraph invariant failed: table dependencies for orphaned hash ${hash}`);
+      }
+      for (const table of tables) {
+        if (!this.tableToHashes.get(table)?.has(hash)) {
+          throw new Error(`SubscriptionGraph invariant failed: missing reverse table entry for ${hash} on ${table}`);
+        }
+      }
+    }
+    for (const [table, hashes] of this.tableToHashes) {
+      if (hashes.size === 0) {
+        throw new Error(`SubscriptionGraph invariant failed: empty hash set for table ${table}`);
+      }
+      for (const hash of hashes) {
+        if (!this.hashToTables.get(hash)?.has(table)) {
+          throw new Error(`SubscriptionGraph invariant failed: stale table hash ${hash} for ${table}`);
+        }
+      }
+    }
+  }
   setQueryTables(hash, tables) {
     if (!this.hashToClientQueries.has(hash))
       return;
@@ -13687,6 +13841,56 @@ class SubscriptionGraph {
   *hashes() {
     yield* this.hashToClientQueries.keys();
   }
+  removeClient(clientId) {
+    const prefix = `${clientId}:`;
+    const keysToRemove = [];
+    for (const [key] of this.clientQueryToHash) {
+      if (key.startsWith(prefix)) {
+        keysToRemove.push(key);
+      }
+    }
+    for (const key of keysToRemove) {
+      this.removeClientQuery(key);
+    }
+  }
+  renameClient(oldClientId, newClientId) {
+    const prefix = `${oldClientId}:`;
+    const updates = [];
+    for (const [key] of this.clientQueryToHash) {
+      if (key.startsWith(prefix)) {
+        const queryId = this.clientQueryToId.get(key);
+        if (queryId !== undefined) {
+          updates.push({ oldKey: key, newKey: makeClientQueryKey(newClientId, queryId), queryId });
+        }
+      }
+    }
+    for (const { oldKey, newKey, queryId } of updates) {
+      this.renameClientQuery(oldKey, newKey, queryId);
+    }
+  }
+  snapshot() {
+    return {
+      hashToClientQueries: cloneSetMap(this.hashToClientQueries),
+      clientQueryToHash: new Map(this.clientQueryToHash),
+      clientQueryToId: new Map(this.clientQueryToId),
+      hashToTables: cloneSetMap(this.hashToTables),
+      tableToHashes: cloneSetMap(this.tableToHashes)
+    };
+  }
+  restore(snapshot) {
+    this.hashToClientQueries.clear();
+    this.clientQueryToHash.clear();
+    this.clientQueryToId.clear();
+    this.hashToTables.clear();
+    this.tableToHashes.clear();
+    copySetMap(snapshot.hashToClientQueries, this.hashToClientQueries);
+    for (const [key, value] of snapshot.clientQueryToHash)
+      this.clientQueryToHash.set(key, value);
+    for (const [key, value] of snapshot.clientQueryToId)
+      this.clientQueryToId.set(key, value);
+    copySetMap(snapshot.hashToTables, this.hashToTables);
+    copySetMap(snapshot.tableToHashes, this.tableToHashes);
+  }
 }
 
 class SubscriptionManager {
@@ -13697,9 +13901,14 @@ class SubscriptionManager {
   subscribe(clientId, queryId, dependencies, queryHash, snapshotTimestamp) {
     const hash = queryHash ?? makeClientQueryKey(clientId, queryId);
     const clientQueryKey = makeClientQueryKey(clientId, queryId);
-    this.graph.setClientQueryHash(clientQueryKey, queryId, hash);
     const tables = rangesToTables(dependencies.ranges);
-    this.graph.setQueryTables(hash, tables);
+    this.graph.apply({
+      type: "subscribe",
+      clientQuery: clientQueryKey,
+      queryId,
+      queryHash: hash,
+      tables
+    });
     let needsRerun = false;
     const now = Date.now();
     const preciseCheckedTables = new Set;
@@ -13742,18 +13951,10 @@ class SubscriptionManager {
   }
   unsubscribe(clientId, queryId) {
     const clientQueryKey = makeClientQueryKey(clientId, queryId);
-    this.graph.removeClientQuery(clientQueryKey);
+    this.graph.apply({ type: "unsubscribe", clientQuery: clientQueryKey });
   }
   unsubscribeAll(clientId) {
-    const keysToRemove = [];
-    for (const [key] of this.graph.clientQueries()) {
-      if (key.startsWith(`${clientId}:`)) {
-        keysToRemove.push(key);
-      }
-    }
-    for (const key of keysToRemove) {
-      this.graph.removeClientQuery(key);
-    }
+    this.graph.apply({ type: "unsubscribeClient", clientId });
   }
   findAffectedQueries(writtenRanges) {
     const writtenTables = rangesToTables(writtenRanges);
@@ -13864,18 +14065,7 @@ class SubscriptionManager {
     return queries;
   }
   updateSessionId(oldClientId, newClientId) {
-    const updates = [];
-    for (const [key] of this.graph.clientQueries()) {
-      if (key.startsWith(`${oldClientId}:`)) {
-        const queryId = this.graph.getOriginalQueryId(key);
-        if (queryId !== undefined) {
-          updates.push({ oldKey: key, newKey: makeClientQueryKey(newClientId, queryId), queryId });
-        }
-      }
-    }
-    for (const { oldKey, newKey, queryId } of updates) {
-      this.graph.renameClientQuery(oldKey, newKey, queryId);
-    }
+    this.graph.apply({ type: "renameClient", oldClientId, newClientId });
   }
   getStats() {
     const clients = new Set;
@@ -13890,7 +14080,9 @@ class SubscriptionManager {
       totalTrackedWriteTimestamps: this.tableWriteTimestamps.size
     };
   }
-  assertConsistency() {}
+  assertConsistency() {
+    this.graph.assertConsistent();
+  }
   forceCleanupTableWriteTimestamps() {
     const sizeBefore = this.tableWriteTimestamps.size;
     this.lastCleanupTime = 0;
@@ -14340,13 +14532,13 @@ var udfMathRandom2 = () => {
   const udfRuntime = UDF_ASYNC_CONTEXT.getStore();
   return (udfRuntime?.mathRandom ?? OG_MATH_RANDOM)();
 };
-var udfSetInterval = (callback, delay) => {
+var udfSetInterval = (callback, delay, ...args) => {
   const udfRuntime = UDF_ASYNC_CONTEXT.getStore();
-  return (udfRuntime?.setInterval ?? OG_SET_INTERVAL)(callback, delay ?? 0);
+  return (udfRuntime?.setInterval ?? OG_SET_INTERVAL)(callback, delay ?? 0, ...args);
 };
-var udfSetTimeout = (callback, delay) => {
+var udfSetTimeout = (callback, delay, ...args) => {
   const udfRuntime = UDF_ASYNC_CONTEXT.getStore();
-  return (udfRuntime?.setTimeout ?? OG_SET_TIMEOUT)(callback, delay ?? 0);
+  return (udfRuntime?.setTimeout ?? OG_SET_TIMEOUT)(callback, delay ?? 0, ...args);
 };
 var udfCryptoRandomUUID2 = () => {
   const udfRuntime = UDF_ASYNC_CONTEXT.getStore();
@@ -14420,15 +14612,19 @@ function resolveSeed(kind, requestId, tnow) {
   fallbackSeedCounter += 1;
   return `udf:${kind}:${tnow}:${fallbackSeedCounter}:${OG_CRYPTO_RANDOM_UUID()}`;
 }
+function isKernelAuthContext(auth) {
+  return !!auth && typeof auth === "object" && "tokenType" in auth && (auth.tokenType === "Admin" || auth.tokenType === "System" || auth.tokenType === "User" || auth.tokenType === "None");
+}
 function resolveEffectiveKernelAuth(auth) {
   const ambientIdentity = getAuthContext();
-  if (auth && typeof auth === "object" && "tokenType" in auth) {
+  if (isKernelAuthContext(auth)) {
     return {
       ...auth,
       userIdentity: auth.userIdentity ?? ambientIdentity
     };
   }
-  return ambientIdentity ?? auth;
+  const userIdentity = ambientIdentity ?? auth;
+  return userIdentity ? { tokenType: "User", userIdentity } : undefined;
 }
 function resolveExecutionIdGenerator(deterministicSeed, explicitIdGenerator) {
   if (explicitIdGenerator) {
@@ -14437,20 +14633,12 @@ function resolveExecutionIdGenerator(deterministicSeed, explicitIdGenerator) {
   return idGeneratorContext.getStore() ?? (deterministicSeed ? createDeterministicIdGenerator(deterministicSeed) : undefined);
 }
 function createExecutionKernel(options) {
-  const capabilities = {};
-  if (options.storage) {
-    capabilities.blobs = { store: options.storage, consistency: "eventual" };
-  }
-  if (options.searchstore) {
-    capabilities.search = options.searchstore;
-  }
-  if (options.vecstore) {
-    capabilities.vector = options.vecstore;
-  }
   const convex = buildKernel({
     services: {
       docstore: options.docstore,
-      capabilities,
+      ...options.storage ? { blobstore: options.storage } : {},
+      ...options.searchstore ? { searchstore: options.searchstore } : {},
+      ...options.vecstore ? { vecstore: options.vecstore } : {},
       udfExecutor: options.udfExecutor
     },
     authContext: resolveEffectiveKernelAuth(options.auth),
@@ -14721,6 +14909,82 @@ async function runUdfHttpAction(docstore, fn, auth, storage2, searchstore2, vecs
 
 // ../core/dist/udf/executor/inline.js
 init_module_loader();
+
+// ../core/dist/udf/function-resolution.js
+function normalizeUdfFunctionTarget(input, options = {}) {
+  const policy = options.policy ?? {};
+  if (input.startsWith("function://")) {
+    if (policy.allowFunctionHandle === false) {
+      throw new Error(`Invalid UDF path: ${input}`);
+    }
+    const remainder = input.slice("function://".length);
+    const separatorIndex = remainder.indexOf(";");
+    if (separatorIndex === -1) {
+      throw new Error(`Invalid function handle: ${input}`);
+    }
+    const componentPath = normalizeComponentPath2(remainder.slice(0, separatorIndex));
+    const udfPath = remainder.slice(separatorIndex + 1);
+    const target = normalizePlainUdfPath(udfPath, {
+      componentPath: componentPath ?? options.componentPath,
+      policy
+    });
+    return {
+      ...target,
+      componentPath: componentPath ?? target.componentPath,
+      isFunctionHandle: true
+    };
+  }
+  return normalizePlainUdfPath(input, options);
+}
+function classifyUdfFunction(fn) {
+  if (fn === null || typeof fn !== "object" && typeof fn !== "function") {
+    return null;
+  }
+  const types = [];
+  if (fn.isQuery)
+    types.push("query");
+  if (fn.isMutation)
+    types.push("mutation");
+  if (fn.isAction)
+    types.push("action");
+  return types.length === 1 ? types[0] : null;
+}
+function normalizePlainUdfPath(input, options = {}) {
+  const policy = options.policy ?? {};
+  let path = input;
+  if (policy.allowSlashPath && !path.includes(":") && path.includes("/")) {
+    const lastSlash = path.lastIndexOf("/");
+    path = path.substring(0, lastSlash) + ":" + path.substring(lastSlash + 1);
+  }
+  const parts = path.split(":");
+  if (parts.length === 2 && parts[0].length > 0 && parts[1].length > 0) {
+    return {
+      path,
+      modulePath: parts[0],
+      exportName: parts[1],
+      componentPath: normalizeComponentPath2(options.componentPath),
+      isFunctionHandle: false
+    };
+  }
+  if (parts.length === 1 && policy.allowDefaultExport && parts[0].length > 0) {
+    return {
+      path: `${parts[0]}:default`,
+      modulePath: parts[0],
+      exportName: "default",
+      componentPath: normalizeComponentPath2(options.componentPath),
+      isFunctionHandle: false
+    };
+  }
+  throw new Error(`Invalid UDF path: ${input}`);
+}
+function normalizeComponentPath2(componentPath) {
+  if (!componentPath) {
+    return;
+  }
+  return componentPath.length > 0 ? componentPath : undefined;
+}
+
+// ../core/dist/udf/executor/inline.js
 init_validator2();
 
 // ../core/dist/errors/index.js
@@ -14890,22 +15154,8 @@ class InlineUdfExecutor {
     this.bootstrapState = options.bootstrapState ?? new InlineExecutorBootstrapState;
   }
   withAmbientAuth(auth, fn) {
-    let authContext2;
-    let userIdentity;
-    if (auth && typeof auth === "object" && "tokenType" in auth) {
-      authContext2 = auth;
-      userIdentity = authContext2.tokenType === "User" && !authContext2.userIdentity && authContext2.token ? identityFromTrustedToken(authContext2.token) : authContext2.userIdentity;
-      if (userIdentity && authContext2.tokenType === "User") {
-        authContext2 = {
-          ...authContext2,
-          userIdentity
-        };
-      }
-    } else {
-      userIdentity = auth;
-    }
-    const principal2 = authContext2 ? legacyAuthContextToPrincipal(authContext2) : userIdentity ? legacyAuthContextToPrincipal({ tokenType: "User", userIdentity }) : legacyAuthContextToPrincipal({ tokenType: "None" });
-    return runWithAuth(userIdentity, fn, principal2);
+    const executionAuth = resolveExecutionAuth(auth);
+    return runWithAuth(executionAuth.userIdentity, fn, executionAuth.authContext);
   }
   get docstore() {
     return this.services.docstore;
@@ -14921,27 +15171,32 @@ class InlineUdfExecutor {
   }
   async execute(functionPath, args, udfType, auth, componentPath, requestId, snapshotTimestamp) {
     const bootstrapTiming = await this.ensureBootstrapped();
-    const [moduleName, functionName2] = this.parseUdfPath(functionPath);
-    const finalRequestId = requestId ?? this.requestIdFactory(udfType, functionPath);
-    const isSystemFunction = moduleName === "_system" || functionPath.startsWith("_system:");
+    const target = normalizeUdfFunctionTarget(functionPath, {
+      componentPath,
+      policy: { allowFunctionHandle: true }
+    });
+    const { modulePath: moduleName, exportName: functionName2 } = target;
+    const finalRequestId = requestId ?? this.requestIdFactory(udfType, target.path);
+    const executionAuth = resolveExecutionAuth(auth);
+    const isSystemFunction = moduleName === "_system" || target.path.startsWith("_system:");
     const startTime = performance.now();
     const invokeUdf = async () => {
-      const module = await withTraceSpan("udf.load_module", "runtime", () => this.loadModule(moduleName, componentPath), { moduleName, componentPath: componentPath ?? "" });
+      const module = await withTraceSpan("udf.load_module", "runtime", () => this.loadModule(moduleName, target.componentPath), { moduleName, componentPath: target.componentPath ?? "" });
       const fn = module?.[functionName2];
-      this.assertFunctionExport(functionName2, moduleName, fn, udfType, auth);
-      await withTraceSpan("udf.validate_args", "runtime", () => this.validateArgs(fn, args, componentPath), {
+      const resolvedType = this.assertFunctionExport(functionName2, moduleName, fn, udfType, executionAuth.executorAuth);
+      await withTraceSpan("udf.validate_args", "runtime", () => this.validateArgs(fn, args, target.componentPath), {
         moduleName,
         functionName: functionName2,
-        componentPath: componentPath ?? ""
+        componentPath: target.componentPath ?? ""
       });
       const argsString = JSON.stringify(convexToJson([args]));
-      if (fn.isQuery) {
+      if (resolvedType === "query") {
         return withTraceSpan("udf.invoke_query", "runtime", async () => JSON.parse(await fn.invokeQuery(argsString)), { moduleName, functionName: functionName2 });
       }
-      if (fn.isMutation) {
+      if (resolvedType === "mutation") {
         return withTraceSpan("udf.invoke_mutation", "runtime", async () => JSON.parse(await fn.invokeMutation(argsString)), { moduleName, functionName: functionName2 });
       }
-      if (fn.isAction) {
+      if (resolvedType === "action") {
         return withTraceSpan("udf.invoke_action", "runtime", async () => JSON.parse(await fn.invokeAction(finalRequestId, argsString)), { moduleName, functionName: functionName2 });
       }
       throw new Error(`Function "${functionName2}" has no valid type`);
@@ -14951,15 +15206,15 @@ class InlineUdfExecutor {
         type: udfType,
         docstore: this.docstore,
         fn: invokeUdf,
-        auth,
+        auth: executionAuth.executorAuth,
         storage: this.blobstore,
         searchstore: this.searchstore,
         vecstore: this.vecstore,
         requestId: finalRequestId,
         udfExecutor: this,
-        componentPath,
+        componentPath: target.componentPath,
         snapshotOverride: udfType === "query" ? snapshotTimestamp : undefined,
-        functionPath,
+        functionPath: target.path,
         tableRegistry: this.tableRegistry
       });
     };
@@ -14970,7 +15225,7 @@ class InlineUdfExecutor {
         const duration = performance.now() - startTime;
         const logEntry = {
           timestamp: Date.now(),
-          functionName: functionPath,
+          functionName: target.path,
           functionType: udfType,
           status: "success",
           duration: Math.round(duration * 100) / 100,
@@ -15029,6 +15284,7 @@ class InlineUdfExecutor {
     }
     const runHttpUdf = () => resolvedRoute.handler.invokeHttpAction(request);
     const finalRequestId = requestId ?? this.requestIdFactory("http", `${request.method}:${url.pathname}`);
+    const executionAuth = resolveExecutionAuth(auth);
     const functionPath = `${request.method} ${url.pathname}`;
     const startTime = performance.now();
     const recordHttpExecution = (status, extra) => {
@@ -15058,9 +15314,9 @@ class InlineUdfExecutor {
     try {
       const response = await this.withAmbientAuth(auth, async () => {
         if (!this.moduleRegistry) {
-          return runUdfHttpAction(this.docstore, runHttpUdf, auth, this.blobstore, this.searchstore, this.vecstore, finalRequestId, this, resolvedRoute.componentPath);
+          return runUdfHttpAction(this.docstore, runHttpUdf, executionAuth.executorAuth, this.blobstore, this.searchstore, this.vecstore, finalRequestId, this, resolvedRoute.componentPath);
         }
-        return withModuleRegistry(this.moduleRegistry, () => runUdfHttpAction(this.docstore, runHttpUdf, auth, this.blobstore, this.searchstore, this.vecstore, finalRequestId, this, resolvedRoute.componentPath));
+        return withModuleRegistry(this.moduleRegistry, () => runUdfHttpAction(this.docstore, runHttpUdf, executionAuth.executorAuth, this.blobstore, this.searchstore, this.vecstore, finalRequestId, this, resolvedRoute.componentPath));
       });
       recordHttpExecution("success", { statusCode: response.status });
       return response;
@@ -15154,23 +15410,21 @@ class InlineUdfExecutor {
     }
   }
   parseUdfPath(functionPath) {
-    const parts = functionPath.split(":");
-    if (parts.length !== 2) {
-      throw new Error(`Invalid UDF path: ${functionPath}`);
-    }
-    return [parts[0], parts[1]];
+    const target = normalizeUdfFunctionTarget(functionPath);
+    return [target.modulePath, target.exportName];
   }
   assertFunctionExport(functionName2, moduleName, fn, udfType, auth) {
     if (typeof fn !== "function") {
       throw new Error(`Function "${functionName2}" not found in module "${moduleName}"`);
     }
-    if (udfType === "query" && !fn.isQuery) {
+    const actualType = classifyUdfFunction(fn);
+    if (udfType === "query" && actualType !== "query") {
       throw new Error(`Function "${functionName2}" is not a query`);
     }
-    if (udfType === "mutation" && !fn.isMutation) {
+    if (udfType === "mutation" && actualType !== "mutation") {
       throw new Error(`Function "${functionName2}" is not a mutation`);
     }
-    if (udfType === "action" && !fn.isAction) {
+    if (udfType === "action" && actualType !== "action") {
       throw new Error(`Function "${functionName2}" is not an action`);
     }
     if (fn.isInternal) {
@@ -15181,6 +15435,7 @@ class InlineUdfExecutor {
         throw new InternalFunctionAccessError(functionPath);
       }
     }
+    return udfType;
   }
   async validateArgs(fn, args, componentPath) {
     const callContext2 = getCallContext();
@@ -15340,7 +15595,7 @@ init_analysis();
 init_module_loader();
 // ../core/dist/udf/execution-adapter.js
 init_auth_context();
-init_jwt();
+init_execution_auth();
 // ../core/dist/http/api-router.js
 init_auth();
 init_auth_resolver();
@@ -15777,7 +16032,7 @@ class ScheduledFunctionExecutor {
       return [];
     }
     const tables = new Set;
-    for await (const entry of this.docstore.load_documents({
+    for await (const entry of this.docstore.loadDocuments({
       min_timestamp_inclusive: sinceExclusive + 1n,
       max_timestamp_exclusive: maxTimestamp + 1n
     }, Order.Asc)) {
@@ -16455,10 +16710,10 @@ class BaseSqliteDocStore {
       }
     }
   }
-  async index_scan_rows(indexId, tableId, readTimestamp, interval, order, limit) {
+  async indexScanRows(indexId, tableId, readTimestamp, interval, order, limit) {
     return this.scanIndexRows(indexId, tableId, readTimestamp, interval, order, limit);
   }
-  async index_scan_rows_after_key(indexId, tableId, readTimestamp, interval, order, resumeAfterKey, limit) {
+  async indexScanRowsAfterKey(indexId, tableId, readTimestamp, interval, order, resumeAfterKey, limit) {
     return this.scanIndexRows(indexId, tableId, readTimestamp, interval, order, limit, resumeAfterKey);
   }
   async scanIndexRows(indexId, tableId, readTimestamp, interval, order, limit, resumeAfterKey) {
@@ -16560,13 +16815,13 @@ class BaseSqliteDocStore {
     }
     return results;
   }
-  async* index_scan(indexId, tabletId, readTimestamp, interval, order, limit) {
-    const rows = await this.index_scan_rows(indexId, tabletId, readTimestamp, interval, order, limit);
+  async* indexScan(indexId, tabletId, readTimestamp, interval, order, limit) {
+    const rows = await this.indexScanRows(indexId, tabletId, readTimestamp, interval, order, limit);
     for (const row of rows) {
       yield row;
     }
   }
-  async* load_documents(range, order) {
+  async* loadDocuments(range, order) {
     const orderClause = order === Order.Asc ? "ASC" : "DESC";
     const query = `
       SELECT id, ts, table_id, json_value, deleted, prev_ts 
@@ -16604,7 +16859,7 @@ class BaseSqliteDocStore {
     const rows = await stmt.all(key, JSON.stringify(value));
     return rows.length > 0;
   }
-  async previous_revisions(queries) {
+  async previousRevisions(queries) {
     const results = new Map;
     const stmt = this.getPreparedStatement(`
       SELECT ts, json_value, deleted, prev_ts
@@ -16629,7 +16884,7 @@ class BaseSqliteDocStore {
     }
     return results;
   }
-  async previous_revisions_of_documents(queries) {
+  async previousRevisionsOfDocuments(queries) {
     const results = new Map;
     const stmt = this.getPreparedStatement(`
       SELECT ts, json_value, deleted, prev_ts
@@ -16686,7 +16941,7 @@ class BaseSqliteDocStore {
       prev_ts: row.prev_ts != null ? BigInt(row.prev_ts) : null
     };
   }
-  async get_many(ids, readTimestamp) {
+  async getMany(ids, readTimestamp) {
     const results = new Map;
     if (ids.length === 0) {
       return results;