@dalgo/bigquery 0.0.0-stage → 0.2.0

package/dist/analytical/metadata-client.js

@@ -0,0 +1,247 @@
+import { object, same } from "./metadata.js";
+import { bounds, cloneFrozen, exactKeys, identifier, integerText, nonempty, project, timestamp, validatePrincipal } from "./protocol.js";
+import { abortable, realClock, Transport } from "./transport.js";
+import { AnalyticalError, fail } from "./wire.js";
+function source(value) {
+    exactKeys(value, ["sourceId", "sourceProject", "datasetId", "tableId"]);
+    nonempty(value.sourceId, 128);
+    project(value.sourceProject);
+    identifier(value.datasetId);
+    identifier(value.tableId);
+}
+function consent(value, expected) {
+    exactKeys(value, ["purpose", "ownerId", "consentId", "source", "principal", "selectedJobProject"]);
+    if (value.purpose !== "metadata-only")
+        fail("approval_required");
+    nonempty(value.ownerId);
+    nonempty(value.consentId);
+    source(value.source);
+    if (!same(value.source, expected))
+        fail("approval_changed");
+    validatePrincipal(value.principal);
+    if (value.principal.kind !== "google-user")
+        fail("auth_required");
+    project(value.selectedJobProject);
+}
+function wireText(value, maximum = 1024) {
+    if (typeof value !== "string" || value.length < 1 || value.length > maximum)
+        fail("malformed_wire");
+}
+function nativeSchema(value) {
+    const schema = object(value);
+    let count = 0;
+    const fields = (value, depth) => {
+        if (!Array.isArray(value) || value.length === 0)
+            fail("malformed_wire");
+        if (depth > 8)
+            fail("response_limit");
+        const names = new Set();
+        for (const raw of value) {
+            if (++count > 1024)
+                fail("response_limit");
+            const field = object(raw);
+            wireText(field.name, 300);
+            wireText(field.type, 64);
+            if (!/^[A-Z][A-Z0-9_]*$/u.test(field.type) || names.has(field.name))
+                fail("malformed_wire");
+            names.add(field.name);
+            if (field.mode !== undefined && (typeof field.mode !== "string" || !["NULLABLE", "REQUIRED", "REPEATED"].includes(field.mode)))
+                fail("malformed_wire");
+            if ((field.type === "RECORD" || field.type === "STRUCT") !== Object.hasOwn(field, "fields"))
+                fail("malformed_wire");
+            if (field.fields !== undefined)
+                fields(field.fields, depth + 1);
+        }
+    };
+    fields(schema.fields, 0);
+}
+function projection(raw, expected, table) {
+    const value = object(raw);
+    const referenceKey = table ? "tableReference" : "datasetReference";
+    const reference = object(value[referenceKey]);
+    exactKeys(reference, table ? ["projectId", "datasetId", "tableId"] : ["projectId", "datasetId"], [], "malformed_wire");
+    if (reference.projectId !== expected.sourceProject || reference.datasetId !== expected.datasetId || table && reference.tableId !== expected.tableId)
+        fail("source_changed");
+    // Dataset location is authoritative for this discovery; do not assume US.
+    if (!table || Object.hasOwn(value, "location"))
+        wireText(value.location, 64);
+    if (table) {
+        wireText(value.type, 64);
+        nativeSchema(value.schema);
+    }
+    for (const key of ["etag", "lastModifiedTime"]) {
+        if (!Object.hasOwn(value, key))
+            continue;
+        if (key === "lastModifiedTime")
+            integerText(value[key]);
+        else
+            wireText(value[key]);
+    }
+    const keys = table
+        ? [referenceKey, "type", "location", "etag", "lastModifiedTime", "schema", "timePartitioning", "rangePartitioning", "clustering", "requirePartitionFilter"]
+        : [referenceKey, "location", "etag", "lastModifiedTime"];
+    const result = {};
+    for (const key of keys)
+        if (Object.hasOwn(value, key))
+            result[key] = value[key];
+    return result;
+}
+/** No query, dry-run, row, ledger, export or cost-admission method exists here. */
+export class BigQueryMetadataClient {
+    #sources;
+    #authorize;
+    #current;
+    #transport;
+    #clock;
+    #bounds;
+    #active = false;
+    constructor(config) {
+        exactKeys(config, ["sources", "provider", "authorizeMetadata", "currentMetadataBinding"], ["limits", "fetch", "clock"]);
+        if (!Array.isArray(config.sources) || config.sources.length < 1 || config.sources.length > 128 || typeof config.authorizeMetadata !== "function" || typeof config.currentMetadataBinding !== "function")
+            fail("invalid_input");
+        const sources = cloneFrozen(config.sources);
+        sources.forEach(source);
+        if (new Set(sources.map(value => value.sourceId)).size !== sources.length)
+            fail("invalid_input");
+        this.#sources = new Map(sources.map(value => [value.sourceId, value]));
+        this.#authorize = config.authorizeMetadata;
+        this.#current = config.currentMetadataBinding;
+        exactKeys(config.limits ?? {}, [], ["responseBytes", "totalResponseBytes", "wallMs", "httpMs"]);
+        this.#bounds = bounds({ responseBytes: 256 * 1024, totalResponseBytes: 1024 * 1024, wallMs: 30000, ...(config.limits ?? {}) });
+        this.#clock = config.clock ?? realClock;
+        this.#transport = new Transport(config.provider, config.fetch ?? ((url, init) => globalThis.fetch(url, init)), this.#clock);
+    }
+    async discover(sourceId, options = {}) {
+        nonempty(sourceId, 128);
+        const requested = this.#sources.get(sourceId);
+        if (requested === undefined)
+            fail("policy_denied");
+        exactKeys(options, [], ["signal", "deadline"]);
+        const signal = options.signal;
+        if (signal !== undefined && !(signal instanceof globalThis.AbortSignal))
+            fail("invalid_input");
+        const now = this.#clock.now();
+        if (!Number.isSafeInteger(now) || !Number.isSafeInteger(now + this.#bounds.wallMs) || options.deadline !== undefined && !Number.isSafeInteger(options.deadline))
+            fail("invalid_input");
+        const deadline = Math.min(now + this.#bounds.wallMs, options.deadline ?? Number.MAX_SAFE_INTEGER);
+        const controller = new AbortController();
+        const abort = () => controller.abort();
+        if (signal?.aborted || now >= deadline)
+            fail("local_stopped");
+        if (this.#active)
+            fail("policy_denied");
+        this.#active = true;
+        signal?.addEventListener("abort", abort, { once: true });
+        const timer = setTimeout(abort, deadline - now);
+        let result;
+        try {
+            // The overall abort race bounds preparation, retries and injected sleeps,
+            // even if a trusted integration ignores its signal.
+            result = await abortable(this.#discover(requested, deadline, controller.signal), controller.signal);
+        }
+        finally {
+            controller.abort();
+            this.#active = false;
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", abort);
+        }
+        // Public delivery follows all async work and cleanup (including abort
+        // listeners). No await or other consumer callback follows the joint guard.
+        if (signal?.aborted || this.#clock.now() >= deadline)
+            fail("local_stopped");
+        this.#assertCurrent(result.consent);
+        return result;
+    }
+    #assertCurrent(prepared) {
+        let current;
+        try {
+            const snapshot = this.#current(prepared.source);
+            if (snapshot === undefined)
+                fail("approval_changed");
+            current = cloneFrozen(snapshot);
+            exactKeys(current, ["consent", "read", "expiresAt"]);
+            consent(current.consent, prepared.source);
+            if (!same(current.consent, prepared))
+                fail("approval_changed");
+        }
+        catch {
+            // No consumer error text, credentials or malformed/asynchronous snapshot
+            // may escape the trusted joint-binding boundary.
+            fail("approval_changed");
+        }
+        if (current.read !== true)
+            fail("scope_missing");
+        if (!Number.isSafeInteger(current.expiresAt) || current.expiresAt <= this.#clock.now())
+            fail("auth_expired");
+    }
+    async #attest(requested, signal) {
+        if (signal.aborted)
+            fail("local_stopped");
+        const controller = new AbortController();
+        const abort = () => controller.abort();
+        signal.addEventListener("abort", abort, { once: true });
+        const timer = setTimeout(abort, this.#bounds.httpMs);
+        try {
+            const prepared = cloneFrozen(await abortable(this.#authorize(requested, controller.signal), controller.signal));
+            if (controller.signal.aborted)
+                fail("local_stopped");
+            consent(prepared, requested);
+            return prepared;
+        }
+        catch (error) {
+            if (error instanceof AnalyticalError)
+                throw error;
+            return fail("approval_required");
+        }
+        finally {
+            controller.abort();
+            clearTimeout(timer);
+            signal.removeEventListener("abort", abort);
+        }
+    }
+    async #discover(requested, deadline, signal) {
+        const prepared = await this.#attest(requested, signal);
+        await this.#transport.verify(prepared.principal, Math.min(deadline, this.#clock.now() + this.#bounds.httpMs), signal);
+        let bytes = 0;
+        const scope = {
+            bounds: this.#bounds, principal: prepared.principal, executionDeadline: deadline, signal,
+            remaining: async () => this.#bounds.totalResponseBytes - bytes,
+            debit: async (count) => { bytes += count; if (bytes > this.#bounds.totalResponseBytes)
+                fail("response_limit"); },
+            beforeDispatch: async () => {
+                const current = await this.#attest(requested, signal);
+                if (!same(current, prepared))
+                    fail("approval_changed");
+                // Consent preparation can disconnect/rotate the Google account while
+                // the transport awaits. Reverify before the physical dispatch.
+                await this.#transport.verify(prepared.principal, Math.min(deadline, this.#clock.now() + this.#bounds.httpMs), signal);
+            },
+        };
+        try {
+            const path = `projects/${requested.sourceProject}/datasets/${requested.datasetId}`;
+            // The existing synchronous dispatch hook runs after every async consent,
+            // identity and retry await, immediately before the physical fetch call.
+            const guard = () => this.#assertCurrent(prepared);
+            const dataset = projection(await this.#transport.call(scope, "GET", path, { datasetView: "METADATA" }, undefined, false, false, guard), requested, false);
+            const table = projection(await this.#transport.call(scope, "GET", `${path}/tables/${requested.tableId}`, { view: "STORAGE_STATS" }, undefined, false, false, guard), requested, true);
+            if (table.location !== undefined && table.location !== dataset.location)
+                fail("source_changed");
+            if (!same(await this.#attest(requested, signal), prepared))
+                fail("approval_changed");
+            await this.#transport.verify(prepared.principal, Math.min(deadline, this.#clock.now() + this.#bounds.httpMs), signal);
+            if (signal.aborted || this.#clock.now() >= deadline)
+                fail("local_stopped");
+            return cloneFrozen({
+                source: requested, consent: prepared, dataset, table, observedAt: timestamp(this.#clock.now()), responseBytes: bytes,
+                status: "inactive", queryAdmission: "blocked", costAdmission: "not-granted", projectPermissions: "unverified", billing: "unverified", sourceRights: "unreviewed", providerRetentionAuthorization: "not-granted",
+            });
+        }
+        catch (error) {
+            // The shared execution transport calls a missing resource result_expired;
+            // discovery never implies a result job existed.
+            if (error instanceof AnalyticalError && error.code === "result_expired")
+                fail("remote_failed");
+            throw error;
+        }
+    }
+}

package/dist/analytical/metadata-harness.d.ts

@@ -0,0 +1,28 @@
+import { type MetadataOptions, type MetadataSource, type MetadataLimits } from "./metadata-client.js";
+import { type GoogleTokenResponse } from "./google-identity.js";
+import { type Clock, type SafeFetch } from "./transport.js";
+import { type PublicMetadataObservation } from "./public-metadata.js";
+export interface MetadataFixtureHarnessConfig {
+    readonly sources: readonly MetadataSource[];
+    /** Explicit fixture identity and metadata transports; no live/default mode. */
+    readonly identityFetch: SafeFetch;
+    readonly metadataFetch: SafeFetch;
+    readonly clock?: Clock;
+    readonly limits?: Partial<MetadataLimits>;
+}
+/** Trusted application integration, never a command/JSON endpoint. Owner/session,
+ * source and project methods belong behind application-owner authentication.
+ * No snapshot setter, ledger, rows, jobs, storage or provider getter exists. */
+export declare class MetadataFixtureHarness {
+    #private;
+    constructor(config: MetadataFixtureHarnessConfig);
+    setOwner(ownerId: string | undefined): void;
+    select(sourceId: string, selectedJobProject: string): void;
+    disconnect(): void;
+    denyMetadataConsent(): void;
+    connect(response: GoogleTokenResponse, signal?: AbortSignal): Promise<void>;
+    /** Explicit current owner gesture; token connection never grants this consent. */
+    consentToMetadata(): void;
+    discover(options?: MetadataOptions): Promise<PublicMetadataObservation>;
+}
+//# sourceMappingURL=metadata-harness.d.ts.map

package/dist/analytical/metadata-harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata-harness.d.ts","sourceRoot":"","sources":["../../src/analytical/metadata-harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6E,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACjL,OAAO,EAA2D,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAKzH,OAAO,EAAa,KAAK,KAAK,EAAE,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAA0B,KAAK,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAE9F,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CAC3C;AACD;;gFAEgF;AAChF,qBAAa,sBAAsB;;gBAYd,MAAM,EAAE,4BAA4B;IAwBhD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK3C,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,IAAI;IAQ1D,UAAU,IAAI,IAAI;IAGlB,mBAAmB,IAAI,IAAI;IACrB,OAAO,CAAC,QAAQ,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxF,kFAAkF;IAC3E,iBAAiB,IAAI,IAAI;IASnB,QAAQ,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,yBAAyB,CAAC;CAwBzF"}

package/dist/analytical/metadata-harness.js

@@ -0,0 +1,127 @@
+import { BigQueryMetadataClient } from "./metadata-client.js";
+import { GoogleTokenIdentityProvider } from "./google-identity.js";
+import { cloneFrozen, exactKeys, nonempty, project } from "./protocol.js";
+import { same } from "./metadata.js";
+import { opaqueID } from "./ledger.js";
+import { fail } from "./wire.js";
+import { realClock } from "./transport.js";
+import { projectFixtureMetadata } from "./public-metadata.js";
+/** Trusted application integration, never a command/JSON endpoint. Owner/session,
+ * source and project methods belong behind application-owner authentication.
+ * No snapshot setter, ledger, rows, jobs, storage or provider getter exists. */
+export class MetadataFixtureHarness {
+    #provider;
+    #client;
+    #sources;
+    #clock;
+    #wallMs;
+    #owner;
+    #source;
+    #project;
+    #identity;
+    #binding;
+    #revision = 0;
+    constructor(config) {
+        exactKeys(config, ["sources", "identityFetch", "metadataFetch"], ["clock", "limits"]);
+        if (typeof config.identityFetch !== "function" || typeof config.metadataFetch !== "function")
+            fail("invalid_input");
+        this.#clock = config.clock ?? realClock;
+        this.#wallMs = config.limits?.wallMs ?? 30000;
+        this.#sources = new Map(cloneFrozen(config.sources).map(s => [s.sourceId, s]));
+        this.#provider = new GoogleTokenIdentityProvider({ fetch: config.identityFetch, now: () => this.#clock.now() });
+        this.#client = new BigQueryMetadataClient({ sources: config.sources, provider: this.#provider, fetch: config.metadataFetch, clock: this.#clock,
+            ...(config.limits === undefined ? {} : { limits: config.limits }),
+            authorizeMetadata: async (source) => {
+                const binding = this.#current(source);
+                if (!binding)
+                    fail("approval_required");
+                return binding.consent;
+            }, currentMetadataBinding: source => this.#current(source),
+        });
+    }
+    #invalidate() { this.#revision += 1; this.#binding = undefined; }
+    #current(source) {
+        const b = this.#binding;
+        if (!b || !this.#identity || !this.#owner || !this.#source || !same(source, this.#source) ||
+            b.consent.ownerId !== this.#owner || b.consent.selectedJobProject !== this.#project ||
+            !same(b.consent.principal, this.#identity.principal))
+            return undefined;
+        return b;
+    }
+    setOwner(ownerId) {
+        this.disconnect();
+        this.#owner = undefined;
+        if (ownerId !== undefined) {
+            nonempty(ownerId);
+            this.#owner = ownerId;
+        }
+    }
+    select(sourceId, selectedJobProject) {
+        this.#invalidate();
+        this.#source = undefined;
+        this.#project = undefined;
+        const source = this.#sources.get(sourceId);
+        if (!source)
+            fail("policy_denied");
+        project(selectedJobProject);
+        this.#source = source;
+        this.#project = selectedJobProject;
+    }
+    disconnect() {
+        this.#invalidate();
+        this.#identity = undefined;
+        this.#provider.disconnect();
+    }
+    denyMetadataConsent() { this.#invalidate(); }
+    async connect(response, signal) {
+        this.disconnect();
+        const revision = this.#revision;
+        const identity = await this.#provider.connect(response, signal);
+        if (revision !== this.#revision) {
+            this.#provider.disconnect();
+            fail("approval_changed");
+        }
+        this.#identity = identity;
+    }
+    /** Explicit current owner gesture; token connection never grants this consent. */
+    consentToMetadata() {
+        this.#invalidate();
+        const i = this.#identity;
+        if (!this.#owner || !this.#source || !this.#project)
+            fail("approval_required");
+        if (!i)
+            fail("auth_required");
+        if (i.expiresAt <= this.#clock.now())
+            fail("auth_expired");
+        const consent = { purpose: "metadata-only", ownerId: this.#owner, consentId: opaqueID(), source: this.#source, principal: i.principal, selectedJobProject: this.#project };
+        this.#binding = cloneFrozen({ consent, read: i.read, expiresAt: i.expiresAt });
+    }
+    async discover(options = {}) {
+        exactKeys(options, [], ["signal", "deadline"]);
+        // Read caller accessors once, before asynchronous work. The client receives
+        // a plain snapshot; delivery never rereads mutable caller options.
+        const signal = options.signal;
+        const requestedDeadline = options.deadline;
+        const operationOptions = { ...(signal === undefined ? {} : { signal }), ...(requestedDeadline === undefined ? {} : { deadline: requestedDeadline }) };
+        const source = this.#source;
+        if (!source || !this.#current(source))
+            fail("approval_required");
+        const revision = this.#revision;
+        const deadline = Math.min(this.#clock.now() + this.#wallMs, requestedDeadline ?? Number.MAX_SAFE_INTEGER);
+        const discovery = await this.#client.discover(source.sourceId, operationOptions);
+        const result = await projectFixtureMetadata(discovery);
+        // Hashing is asynchronous. Read every externally supplied callback/accessor
+        // before the final protected guard, including an AbortSignal subclass getter.
+        const now = this.#clock.now();
+        const aborted = signal?.aborted;
+        const binding = this.#current(source);
+        if (binding && binding.expiresAt <= now)
+            fail("auth_expired");
+        if (aborted || now >= deadline)
+            fail("local_stopped");
+        // No consumer callback or caller property access may follow this guard.
+        if (revision !== this.#revision || !binding || !same(binding.consent, discovery.consent))
+            fail("approval_changed");
+        return result;
+    }
+}

package/dist/analytical/metadata.d.ts

@@ -0,0 +1,8 @@
+import { type JsonValue } from "./wire.js";
+import { type Observation, type SchemaField, type SourceProfile } from "./protocol.js";
+export declare function object(value: JsonValue | undefined): Record<string, JsonValue>;
+export declare function decodeSchema(raw: JsonValue): readonly SchemaField[];
+export declare function validateDataset(raw: JsonValue, source: SourceProfile): void;
+export declare function same(a: unknown, b: unknown): boolean;
+export declare function validateTable(raw: JsonValue, source: SourceProfile, now: number): Promise<Observation>;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/analytical/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/analytical/metadata.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAA8G,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAOnM,wBAAgB,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CACtC;AAIzC,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,SAAS,WAAW,EAAE,CAoCnE;AACD,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAQ3E;AACD,wBAAgB,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAKpD;AACD,wBAAsB,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAgF5G"}

package/dist/analytical/metadata.js

@@ -0,0 +1,155 @@
+import { canonicalJSON } from "./canonical.js";
+import { fail, isObject } from "./wire.js";
+import { cloneFrozen, digest, exactKeys, integerText, normalizeParameter, supportedField, timestamp, validateSchema } from "./protocol.js";
+// Explicit classifications pinned to Google REST discovery / generated SDK v0.296.0.
+const tableMetadata = "creationTime description etag expirationTime friendlyName id kind labels lastModifiedTime numActiveLogicalBytes numActivePhysicalBytes numBytes numCurrentPhysicalBytes numLongTermBytes numLongTermLogicalBytes numLongTermPhysicalBytes numPartitions numPhysicalBytes numRows numTimeTravelPhysicalBytes numTotalLogicalBytes numTotalPhysicalBytes resourceTags selfLink streamingBuffer".split(" ");
+const tableRejected = "biglakeConfiguration cloneDefinition defaultCollation defaultRoundingMode encryptionConfiguration externalCatalogTableOptions externalDataConfiguration managedTableType materializedView materializedViewStatus maxStaleness model partitionDefinition replicas restrictions snapshotDefinition tableConstraints tableReplicationInfo view".split(" ");
+const datasetMetadata = "access creationTime defaultPartitionExpirationMs defaultTableExpirationMs description etag friendlyName id kind labels lastModifiedTime maxTimeTravelHours resourceTags satisfiesPzi satisfiesPzs selfLink storageBillingModel tags".split(" ");
+const datasetRejected = "catalogSource defaultCollation defaultEncryptionConfiguration defaultRoundingMode externalCatalogDatasetOptions externalDatasetReference isCaseInsensitive linkedDatasetMetadata linkedDatasetSource restrictions type".split(" ");
+const fieldRejected = "collation dataGovernanceTagsInfo dataPolicies dataPolicyList defaultValueExpression foreignTypeDefinition generatedColumn maxLength policyTags rangeElementType roundingMode timestampPrecision".split(" ");
+export function object(value) {
+    if (value === undefined || !isObject(value))
+        fail("malformed_wire");
+    return value;
+}
+function rejected(value, keys) {
+    for (const key of keys)
+        if (Object.hasOwn(value, key) && value[key] !== null)
+            fail("source_ineligible");
+}
+export function decodeSchema(raw) {
+    const schema = object(raw);
+    exactKeys(schema, ["fields"], [], "source_ineligible");
+    let count = 0;
+    const decode = (value, depth) => {
+        if (!Array.isArray(value) || value.length === 0 || depth > 8)
+            fail("malformed_wire");
+        return value.map(raw => {
+            if (++count > 1024)
+                fail("response_limit");
+            const field = object(raw);
+            exactKeys(field, ["name", "type"], ["mode", "fields", "precision", "scale", "description", "categories", ...fieldRejected], "source_ineligible");
+            rejected(field, fieldRejected);
+            if (typeof field.name !== "string" || typeof field.type !== "string" || field.name === "" || field.type === "")
+                fail("malformed_wire");
+            const mode = Object.hasOwn(field, "mode") ? field.mode : "NULLABLE";
+            if (typeof mode !== "string")
+                fail("malformed_wire");
+            const result = {
+                name: field.name, type: field.type, mode,
+                ...(Object.hasOwn(field, "fields") ? {
+                    fields: decode(field.fields, depth + 1)
+                } : {}),
+                ...(Object.hasOwn(field, "precision") ? {
+                    precision: integerText(field.precision)
+                } : {}),
+                ...(Object.hasOwn(field, "scale") ? {
+                    scale: integerText(field.scale)
+                } : {}),
+            };
+            return result;
+        });
+    };
+    const result = decode(schema.fields, 0);
+    validateSchema(result);
+    return cloneFrozen(result);
+}
+export function validateDataset(raw, source) {
+    const value = object(raw);
+    exactKeys(value, ["datasetReference", "location"], [...datasetMetadata, ...datasetRejected], "source_ineligible");
+    rejected(value, datasetRejected);
+    const ref = object(value.datasetReference);
+    exactKeys(ref, ["projectId", "datasetId"], [], "source_ineligible");
+    if (ref.projectId !== source.sourceProject || ref.datasetId !== source.datasetId || value.location !== source.location)
+        fail("source_changed");
+}
+export function same(a, b) {
+    const encoder = new TextEncoder();
+    const aa = canonicalJSON(encoder.encode(JSON.stringify(a)));
+    const bb = canonicalJSON(encoder.encode(JSON.stringify(b)));
+    return aa.length === bb.length && aa.every((value, index) => value === bb[index]);
+}
+export async function validateTable(raw, source, now) {
+    const value = object(raw);
+    exactKeys(value, ["tableReference", "type", "schema"], ["location", "timePartitioning", "rangePartitioning", "clustering", "requirePartitionFilter", ...tableMetadata, ...tableRejected], "source_ineligible");
+    rejected(value, tableRejected);
+    const table = object(value.tableReference);
+    exactKeys(table, ["projectId", "datasetId", "tableId"], [], "source_ineligible");
+    if (table.projectId !== source.sourceProject || table.datasetId !== source.datasetId || table.tableId !== source.tableId || (Object.hasOwn(value, "location") && value.location !== source.location))
+        fail("source_changed");
+    if (value.type !== "TABLE")
+        fail("source_ineligible");
+    const schema = decodeSchema(value.schema);
+    if (!same(schema, source.schema))
+        fail("source_changed");
+    const fields = new Map(schema.map(field => [field.name, field]));
+    const config = Object.create(null);
+    for (const key of ["timePartitioning", "rangePartitioning", "clustering", "requirePartitionFilter"]) {
+        if (!Object.hasOwn(value, key))
+            continue;
+        const item = value[key];
+        if (item === null)
+            fail("source_ineligible");
+        if (key === "requirePartitionFilter") {
+            if (typeof item !== "boolean")
+                fail("source_ineligible");
+        }
+        else {
+            const settings = object(item);
+            if (key === "clustering") {
+                exactKeys(settings, ["fields"], [], "source_ineligible");
+                if (!Array.isArray(settings.fields) || settings.fields.length < 1 || settings.fields.length > 4 || new Set(settings.fields).size !== settings.fields.length)
+                    fail("source_ineligible");
+                for (const name of settings.fields) {
+                    const field = typeof name === "string" ? fields.get(name) : undefined;
+                    if (field === undefined || field.mode === "REPEATED" || field.fields !== undefined || ["BOOL", "BOOLEAN", "BYTES", "JSON", "RECORD", "STRUCT", "GEOGRAPHY", "RANGE", "INTERVAL"].includes(field.type))
+                        fail("source_ineligible");
+                    supportedField(field);
+                }
+            }
+            else if (key === "timePartitioning") {
+                if (Object.hasOwn(value, "rangePartitioning"))
+                    fail("source_ineligible");
+                exactKeys(settings, ["type"], ["field", "expirationMs", "requirePartitionFilter"], "source_ineligible");
+                if (!["DAY", "HOUR", "MONTH", "YEAR"].includes(String(settings.type)))
+                    fail("source_ineligible");
+                if (Object.hasOwn(settings, "field")) {
+                    const field = typeof settings.field === "string" ? fields.get(settings.field) : undefined;
+                    if (field === undefined || !["DATE", "TIMESTAMP", "DATETIME"].includes(field.type))
+                        fail("source_ineligible");
+                }
+                if (Object.hasOwn(settings, "expirationMs"))
+                    integerText(settings.expirationMs);
+                if (Object.hasOwn(settings, "requirePartitionFilter") && typeof settings.requirePartitionFilter !== "boolean")
+                    fail("source_ineligible");
+                if (Object.hasOwn(settings, "requirePartitionFilter") && Object.hasOwn(value, "requirePartitionFilter") && settings.requirePartitionFilter !== value.requirePartitionFilter)
+                    fail("source_ineligible");
+            }
+            else {
+                exactKeys(settings, ["field", "range"], [], "source_ineligible");
+                const field = typeof settings.field === "string" ? fields.get(settings.field) : undefined;
+                if (field === undefined || !["INTEGER", "INT64"].includes(field.type))
+                    fail("source_ineligible");
+                const range = object(settings.range);
+                exactKeys(range, ["start", "end", "interval"], [], "source_ineligible");
+                const values = ["start", "end", "interval"].map(key => {
+                    const cell = normalizeParameter({
+                        name: "", type: "INT64"
+                    }, range[key]);
+                    return BigInt(cell);
+                });
+                if (values[0] >= values[1] || values[2] < 1n)
+                    fail("source_ineligible");
+            }
+        }
+        config[key] = item;
+    }
+    const payload = {
+        table: {
+            projectId: source.sourceProject, datasetId: source.datasetId, tableId: source.tableId
+        }, location: source.location, type: "TABLE", config, schema
+    };
+    return cloneFrozen({
+        ...payload, digest: await digest("Observation", payload), observedAt: timestamp(now)
+    });
+}