@rocicorp/zero 1.11.3 → 1.11.5

package/out/zero-cache/src/services/view-syncer/connection-context-manager.js

@@ -1,4 +1,4 @@
-import { InvalidConnectionRequest, Unauthorized } from "../../../../zero-protocol/src/error-kind-enum.js";
+import { InvalidConnectionRequest, Rehome, Unauthorized } from "../../../../zero-protocol/src/error-kind-enum.js";
 import { ZeroCache } from "../../../../zero-protocol/src/error-origin-enum.js";
 import { ProtocolErrorWithLevel } from "../../types/error-with-level.js";
 import { compileUrlPattern } from "../../custom/fetch.js";
@@ -27,9 +27,11 @@ var ConnectionContextManagerImpl = class {
 	#retransformIntervalMs;
 	#queryConfig;
 	#pushConfig;
+	#requireServerUserID;
+	#warnedUnverifiedUser = false;
 	#sharedRetransformReady = false;
 	#nextInsertionOrder = 0;
-	constructor(lc, revalidateIntervalSeconds, retransformIntervalSeconds, queryConfig, pushConfig, validateLegacyJWT, now) {
+	constructor(lc, revalidateIntervalSeconds, retransformIntervalSeconds, queryConfig, pushConfig, validateLegacyJWT, now, requireServerUserID = false) {
 		this.#lc = lc;
 		this.#now = now ?? Date.now;
 		this.#revalidateIntervalMs = revalidateIntervalSeconds === void 0 ? void 0 : revalidateIntervalSeconds * 1e3;
@@ -37,6 +39,7 @@ var ConnectionContextManagerImpl = class {
 		this.#queryConfig = queryConfig;
 		this.#pushConfig = pushConfig;
 		this.#validateLegacyJWT = validateLegacyJWT;
+		this.#requireServerUserID = requireServerUserID;
 	}
 	/**
 	* Creates or replaces the live record for a websocket connection.
@@ -165,6 +168,16 @@ var ConnectionContextManagerImpl = class {
 				message: "Connection userID does not match validated server userID.",
 				origin: ZeroCache
 			}, "warn");
+		} else if (validation.kind === "server-unverified" && connection.user.id !== null && connection.auth?.type !== "jwt") {
+			if (this.#requireServerUserID) throw new ProtocolErrorWithLevel({
+				kind: Unauthorized,
+				message: "Connection userID was not validated by the API server. The API server must return a userID for authenticated connections.",
+				origin: ZeroCache
+			}, "warn");
+			if (!this.#warnedUnverifiedUser) {
+				this.#warnedUnverifiedUser = true;
+				this.#lc.warn?.("The API server answered without a userID, so the userID claimed by the client was not verified. Return the userID from your query and mutate endpoints (zero-server does this when you pass userID to handleQueryRequest and handleMutateRequest), then set ZERO_AUTH_REQUIRE_SERVER_USER_ID=true to refuse unverified userIDs.");
+			}
 		}
 		const incomingUserState = validatedUserState ?? connection.user;
 		if (this.#group.pinnedUser !== void 0 && this.#group.pinnedUser.id !== incomingUserState.id) throw new ProtocolErrorWithLevel({
@@ -188,6 +201,31 @@ var ConnectionContextManagerImpl = class {
 			group: this.getGroupState()
 		};
 	}
+	/**
+	* Pins the group to the user persisted with its CVR, as bound by a validated
+	* connection to an earlier instance of the group's view-syncer. Later
+	* validations by this instance must match it, as they would had the group
+	* been pinned here.
+	*
+	* Throws a `Rehome` error if the group is already pinned to another user:
+	* the stored pin wins, so the connections validated here can no longer be
+	* trusted and the view-syncer should stop, leaving its clients to reconnect
+	* to a fresh instance that validates them against the stored pin.
+	*/
+	restorePinnedUser(pinnedUser) {
+		if (this.#group.pinnedUser === void 0) {
+			this.#setGroup({
+				...this.#group,
+				pinnedUser: { id: pinnedUser.id }
+			});
+			return;
+		}
+		if (this.#group.pinnedUser.id !== pinnedUser.id) throw new ProtocolErrorWithLevel({
+			kind: Rehome,
+			message: "Client group is pinned to a different userID than the one persisted with its CVR. Reconnect required.",
+			origin: ZeroCache
+		}, "warn");
+	}
 	/** Removes one connection due to failed auth and updates all derived background/deadline state. */
 	failConnection(selector, revision) {
 		return this.#removeConnection(selector, revision);

package/out/zero-cache/src/services/view-syncer/connection-context-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection-context-manager.js","names":["ErrorKind.Unauthorized","ErrorOrigin.ZeroCache","ErrorKind.InvalidConnectionRequest"],"sources":["../../../../../../zero-cache/src/services/view-syncer/connection-context-manager.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {InitConnectionBody} from '../../../../zero-protocol/src/connect.ts';\nimport {ErrorKind} from '../../../../zero-protocol/src/error-kind.ts';\nimport {ErrorOrigin} from '../../../../zero-protocol/src/error-origin.ts';\nimport type {UpdateAuthBody} from '../../../../zero-protocol/src/update-auth.ts';\nimport {\n  authEquals,\n  resolveAuth,\n  type Auth,\n  type ValidateLegacyJWT,\n} from '../../auth/auth.ts';\nimport type {ZeroConfig} from '../../config/zero-config.ts';\nimport {compileUrlPattern} from '../../custom/fetch.ts';\nimport {ProtocolErrorWithLevel} from '../../types/error-with-level.ts';\nimport type {ConnectParams} from '../../workers/connect-params.ts';\n\nexport type ConnectionState = 'provisional' | 'validated';\n\n/**\n * Normalized user identity shared by live connection state and group auth state.\n * `id: null` means logged out.\n */\nexport type UserState = {readonly id: string | null};\n\n/**\n * Delineates the two paths for validating a connection: either server can validate\n * the user's identity and return a definitive userID to trust, or we fall back to\n * trusting the one provided by the client in the incoming query params.\n */\nexport type ConnectionValidation =\n  | {kind: 'client-fallback'}\n  | {kind: 'server-validated'; validatedUserID: string | null};\n\n/**\n * Identifies one live websocket for a client slot.\n */\nexport type ConnectionSelector = {\n  readonly clientID: string;\n  readonly wsID: string;\n};\n\ntype FetchConfig = ZeroConfig['query'];\n\nexport type HeaderOptions = {\n  readonly apiKey?: string | undefined;\n  /** Allowlisted headers provided in the client options. */\n  readonly customHeaders?: Readonly<Record<string, string>> | undefined;\n  /** Allowlisted headers from the incoming HTTP request. */\n  readonly requestHeaders?: Readonly<Record<string, string>> | undefined;\n  readonly cookie?: string | undefined;\n  readonly origin?: string | undefined;\n};\n\nexport type ConnectionFetchContext = {\n  readonly url: string | undefined;\n  readonly allowedUrlPatterns: readonly URLPattern[] | undefined;\n  readonly headerOptions: HeaderOptions;\n};\n\n/**\n * A snapshot of one live connection tracked by the manager.\n *\n * `revalidateAt` is only populated while the connection is `validated`.\n */\nexport type ConnectionContext = {\n  readonly state: ConnectionState;\n\n  readonly clientID: string;\n  readonly wsID: string;\n  readonly user: UserState;\n\n  readonly auth: Auth | undefined;\n\n  readonly profileID: string | null;\n  readonly baseCookie: string | null;\n  readonly protocolVersion: number;\n\n  readonly revision: number;\n\n  readonly revalidateAt: number | undefined;\n\n  readonly insertionOrder: number;\n\n  readonly queryContext: ConnectionFetchContext;\n  readonly mutateContext: ConnectionFetchContext;\n};\n\n/**\n * Group-scoped auth state shared across the live connections.\n *\n * The background connection is the validated connection currently used for\n * shared background work. Retransform happens on a group level, and uses\n * the background connection's credential to refetch the latest queries.\n */\nexport type GroupAuthState = {\n  readonly pinnedUser: UserState | undefined;\n\n  readonly backgroundConnection: ConnectionSelector | undefined;\n  readonly retransformAt: number | undefined;\n  // Defer all maintenance in case a transient failure occurs.\n  readonly maintenanceNotBeforeAt: number | undefined;\n};\n\nexport type ConnectionContextManager = {\n  registerConnection(\n    selector: ConnectionSelector,\n    connectParams: ConnectParams,\n    auth?: Auth,\n  ): Readonly<ConnectionContext>;\n\n  initConnection(\n    selector: ConnectionSelector,\n    body: InitConnectionBody,\n  ): Readonly<ConnectionContext>;\n\n  updateAuth(\n    selector: ConnectionSelector,\n    body: UpdateAuthBody,\n  ): Promise<Readonly<ConnectionContext>>;\n\n  validateConnection(\n    selector: ConnectionSelector,\n    revision: number,\n    validation: ConnectionValidation,\n  ):\n    | Readonly<{\n        connection: ConnectionContext;\n        group: GroupAuthState;\n      }>\n    | undefined;\n\n  failConnection(\n    selector: ConnectionSelector,\n    revision: number,\n  ): Readonly<ConnectionContext> | undefined;\n  closeConnection(\n    selector: ConnectionSelector,\n  ): Readonly<ConnectionContext> | undefined;\n\n  markBackgroundRetransformSuccess(\n    selector: ConnectionSelector,\n    revision: number,\n  ): void;\n\n  setSharedRetransformReady(ready: boolean): void;\n\n  deferMaintenance(kind: 'revalidate' | 'retransform'): void;\n\n  getConnectionContext(\n    selector: ConnectionSelector,\n  ): Readonly<ConnectionContext> | undefined;\n  mustGetConnectionContext(\n    selector: ConnectionSelector,\n  ): Readonly<ConnectionContext>;\n\n  getBackgroundConnectionContext(): Readonly<ConnectionContext> | undefined;\n  mustGetBackgroundConnectionContext(): Readonly<ConnectionContext>;\n\n  getGroupState(): Readonly<GroupAuthState>;\n\n  planMaintenance(): {\n    dueRevalidations: Readonly<ConnectionContext>[];\n    dueRetransform: boolean;\n    earliestDeadlineAt: number | undefined;\n  };\n};\n\n/**\n * State machine for the auth state of a single `ViewSyncerService`.\n *\n * Connections are registered as `provisional`, optionally backfilled with\n * `initConnection` metadata, and then promoted to `validated` once their\n * effective `userID` is confirmed as valid. The manager also tracks which\n * validated connection currently serves as the group's background connection.\n */\nexport class ConnectionContextManagerImpl implements ConnectionContextManager {\n  readonly #lc: LogContext;\n\n  // The live connection records, keyed by clientID\n  readonly #connections = new Map<string, ConnectionContext>();\n  #group: GroupAuthState = {\n    pinnedUser: undefined,\n    backgroundConnection: undefined,\n    retransformAt: undefined,\n    maintenanceNotBeforeAt: undefined,\n  };\n\n  readonly #validateLegacyJWT: ValidateLegacyJWT | undefined;\n\n  readonly #now: () => number;\n  readonly #revalidateIntervalMs: number | undefined;\n  readonly #retransformIntervalMs: number | undefined;\n  readonly #queryConfig: FetchConfig | undefined;\n  readonly #pushConfig: FetchConfig | undefined;\n  #sharedRetransformReady = false;\n  #nextInsertionOrder = 0;\n\n  constructor(\n    lc: LogContext,\n    revalidateIntervalSeconds?: number,\n    retransformIntervalSeconds?: number,\n    queryConfig?: FetchConfig,\n    pushConfig?: FetchConfig,\n    validateLegacyJWT?: ValidateLegacyJWT,\n    now?: () => number,\n  ) {\n    this.#lc = lc;\n    this.#now = now ?? Date.now;\n    this.#revalidateIntervalMs =\n      revalidateIntervalSeconds === undefined\n        ? undefined\n        : revalidateIntervalSeconds * 1000;\n    this.#retransformIntervalMs =\n      retransformIntervalSeconds === undefined\n        ? undefined\n        : retransformIntervalSeconds * 1000;\n    this.#queryConfig = queryConfig;\n    this.#pushConfig = pushConfig;\n    this.#validateLegacyJWT = validateLegacyJWT;\n  }\n\n  /**\n   * Creates or replaces the live record for a websocket connection.\n   *\n   * Re-registering the same `clientID` drops the old socket record and starts\n   * the replacement back in `provisional` state.\n   */\n  registerConnection(\n    selector: ConnectionSelector,\n    connectParams: ConnectParams,\n    auth?: Auth,\n  ): Readonly<ConnectionContext> {\n    this.#removeConnection(selector);\n\n    const getContext = (type: 'query' | 'mutate'): ConnectionFetchContext => {\n      const config = type === 'query' ? this.#queryConfig : this.#pushConfig;\n\n      return {\n        url: config?.url?.[0],\n        allowedUrlPatterns: config?.url?.map(compileUrlPattern),\n        headerOptions: {\n          customHeaders: undefined,\n          requestHeaders: filterHeaders(\n            connectParams.requestHeaders,\n            config?.allowedRequestHeaders,\n          ),\n          origin: connectParams.origin,\n          apiKey: config?.apiKey,\n          cookie: config?.forwardCookies ? connectParams.httpCookie : undefined,\n        },\n      };\n    };\n\n    const connection: ConnectionContext = {\n      state: 'provisional',\n\n      clientID: connectParams.clientID,\n      wsID: connectParams.wsID,\n      revision: 0,\n      user: {id: connectParams.userID ?? null},\n      auth,\n\n      profileID: connectParams.profileID,\n      baseCookie: connectParams.baseCookie,\n      protocolVersion: connectParams.protocolVersion,\n\n      revalidateAt: undefined,\n\n      queryContext: getContext('query'),\n      mutateContext: getContext('mutate'),\n\n      insertionOrder: ++this.#nextInsertionOrder,\n    };\n    this.#storeConnection(connection);\n    this.#refreshBackgroundConnectionContext();\n    this.#updateBackgroundRetransformDeadline(false);\n    return connection;\n  }\n\n  /**\n   * Backfills `initConnection` data for sockets that were registered before the\n   * client could send its full init payload.\n   *\n   * This updates metadata only; it does not validate the connection.\n   */\n  initConnection(\n    selector: ConnectionSelector,\n    body: InitConnectionBody,\n  ): Readonly<ConnectionContext> {\n    const connection = this.#mustGetConnectionContext(selector);\n\n    let queryContext = connection.queryContext;\n    let mutateContext = connection.mutateContext;\n\n    if (body.userQueryURL) {\n      queryContext = {\n        ...queryContext,\n        url: body.userQueryURL,\n      };\n    }\n    if (body.userQueryHeaders) {\n      queryContext = {\n        ...queryContext,\n        headerOptions: {\n          ...queryContext.headerOptions,\n          customHeaders: filterHeaders(\n            body.userQueryHeaders,\n            this.#queryConfig?.allowedClientHeaders,\n          ),\n        },\n      };\n    }\n    if (body.userPushURL) {\n      mutateContext = {\n        ...mutateContext,\n        url: body.userPushURL,\n      };\n    }\n    if (body.userPushHeaders) {\n      mutateContext = {\n        ...mutateContext,\n        headerOptions: {\n          ...mutateContext.headerOptions,\n          customHeaders: filterHeaders(\n            body.userPushHeaders,\n            this.#pushConfig?.allowedClientHeaders,\n          ),\n        },\n      };\n    }\n\n    return this.#demoteConnection({\n      ...connection,\n      revision: connection.revision + 1,\n      queryContext,\n      mutateContext,\n    });\n  }\n\n  /**\n   * A material auth change demotes the connection back to provisional until it\n   * is validated again.\n   */\n  async updateAuth(\n    selector: ConnectionSelector,\n    body: UpdateAuthBody,\n  ): Promise<Readonly<ConnectionContext>> {\n    const connection = this.#mustGetConnectionContext(selector);\n\n    const nextAuth = await resolveAuth(\n      this.#lc,\n      connection.auth,\n      connection.user.id,\n      body.auth,\n      this.#validateLegacyJWT,\n    );\n\n    const authChanged = !authEquals(connection.auth, nextAuth);\n    if (authChanged) {\n      return this.#demoteConnection({\n        ...connection,\n        auth: nextAuth,\n        revision: connection.revision + 1,\n      });\n    }\n\n    if (nextAuth === connection.auth) {\n      return connection;\n    }\n\n    return this.#storeConnection({\n      ...connection,\n      auth: nextAuth,\n    });\n  }\n\n  /**\n   * Validates one connection against the group's pinned `userID`.\n   *\n   * The first successful validation binds the group `userID`. Later\n   * validations must match it. Validation also refreshes the connection's\n   * revalidation deadline and may pick the connection as the group\n   * background connection if none is currently available. If the websocket is\n   * gone by the time async validation finishes, this becomes a no-op.\n   */\n  validateConnection(\n    selector: ConnectionSelector,\n    revision: number,\n    validation: ConnectionValidation,\n  ):\n    | Readonly<{\n        connection: ConnectionContext;\n        group: GroupAuthState;\n      }>\n    | undefined {\n    const connection = this.#getConnectionContext(selector);\n    if (!connection) {\n      return undefined;\n    }\n\n    if (connection.revision !== revision) {\n      this.#lc.debug?.('Skipping validateConnection for stale revision', {\n        clientID: selector.clientID,\n        attemptedRevision: revision,\n        currentRevision: connection.revision,\n      });\n      return undefined;\n    }\n\n    let validatedUserState: UserState | undefined;\n\n    // If the API server has validated the user's identity, we ensure that\n    // the connection's claimed userID matches it.\n    if (validation.kind === 'server-validated') {\n      validatedUserState = {id: validation.validatedUserID};\n\n      // Check that the ws connection userID provided by the client\n      // matches the validated userID from the API server.\n      if (connection.user.id !== validatedUserState.id) {\n        throw new ProtocolErrorWithLevel(\n          {\n            kind: ErrorKind.Unauthorized,\n            message:\n              'Connection userID does not match validated server userID.',\n            origin: ErrorOrigin.ZeroCache,\n          },\n          'warn',\n        );\n      }\n    }\n\n    // The incoming user state is either the validated user state from the server\n    // or the WS client's claimed user state if no server validation occurred.\n    const incomingUserState = validatedUserState ?? connection.user;\n\n    // Once a client group is validated, every later validated connection must\n    // agree with that pinned identity.\n    if (\n      this.#group.pinnedUser !== undefined &&\n      this.#group.pinnedUser.id !== incomingUserState.id\n    ) {\n      throw new ProtocolErrorWithLevel(\n        {\n          kind: ErrorKind.Unauthorized,\n          message:\n            'Client groups are pinned to a single userID. Connection userID does not match existing client group userID.',\n          origin: ErrorOrigin.ZeroCache,\n        },\n        'warn',\n      );\n    }\n\n    if (this.#group.pinnedUser === undefined) {\n      this.#setGroup({\n        ...this.#group,\n        pinnedUser: incomingUserState,\n      });\n    }\n\n    const validatedConnection = this.#storeConnection({\n      ...connection,\n      state: 'validated',\n      revalidateAt: this.#nextRevalidateAt(),\n    });\n    this.#refreshBackgroundConnectionContext(validatedConnection);\n    this.#updateBackgroundRetransformDeadline(false);\n\n    return {\n      connection: validatedConnection,\n      group: this.getGroupState(),\n    };\n  }\n\n  /** Removes one connection due to failed auth and updates all derived background/deadline state. */\n  failConnection(\n    selector: ConnectionSelector,\n    revision: number,\n  ): ConnectionContext | undefined {\n    return this.#removeConnection(selector, revision);\n  }\n\n  /** Removes one disconnected connection and updates all derived background/deadline state. */\n  closeConnection(selector: ConnectionSelector): ConnectionContext | undefined {\n    return this.#removeConnection(selector);\n  }\n\n  /**\n   * Records a successful background retransform. This starts a fresh interval\n   * from the manager clock when shared retransform is schedulable, or\n   * clears the deadline if it is not.\n   */\n  markBackgroundRetransformSuccess(\n    selector: ConnectionSelector,\n    revision: number,\n  ): void {\n    const backgroundConnection = this.#getBackgroundConnectionContext();\n    if (!backgroundConnection) {\n      return;\n    }\n    if (\n      backgroundConnection.clientID !== selector.clientID ||\n      backgroundConnection.wsID !== selector.wsID ||\n      backgroundConnection.revision !== revision\n    ) {\n      return;\n    }\n    this.#updateBackgroundRetransformDeadline(true);\n  }\n\n  setSharedRetransformReady(ready: boolean): void {\n    if (this.#sharedRetransformReady === ready) {\n      return;\n    }\n    this.#sharedRetransformReady = ready;\n    this.#updateBackgroundRetransformDeadline(true);\n  }\n\n  deferMaintenance(kind: 'revalidate' | 'retransform'): void {\n    const intervalMs =\n      kind === 'revalidate'\n        ? this.#revalidateIntervalMs\n        : this.#retransformIntervalMs;\n    if (intervalMs === undefined) {\n      return;\n    }\n    this.#setGroup({\n      ...this.#group,\n      maintenanceNotBeforeAt: Math.max(\n        this.#group.maintenanceNotBeforeAt ?? 0,\n        this.#now() + intervalMs,\n      ),\n    });\n  }\n\n  /** Returns the current live record for a client slot, if any. */\n  getConnectionContext(\n    selector: ConnectionSelector,\n  ): Readonly<ConnectionContext> | undefined {\n    return this.#getConnectionContext(selector);\n  }\n\n  /** Returns the live record for one websocket or throws if it is unavailable. */\n  mustGetConnectionContext(\n    selector: ConnectionSelector,\n  ): Readonly<ConnectionContext> {\n    return this.#mustGetConnectionContext(selector);\n  }\n\n  /** Returns the current background connection, if one exists. */\n  getBackgroundConnectionContext(): Readonly<ConnectionContext> | undefined {\n    return this.#getBackgroundConnectionContext();\n  }\n\n  mustGetBackgroundConnectionContext(): Readonly<ConnectionContext> {\n    const backgroundConnection = this.#getBackgroundConnectionContext();\n    if (!backgroundConnection) {\n      throw new ProtocolErrorWithLevel(\n        {\n          kind: ErrorKind.InvalidConnectionRequest,\n          message:\n            'No validated connection is available for shared query work.',\n          origin: ErrorOrigin.ZeroCache,\n        },\n        'warn',\n      );\n    }\n    return backgroundConnection;\n  }\n\n  /** Returns the shared group auth state. */\n  getGroupState(): Readonly<GroupAuthState> {\n    return this.#group;\n  }\n\n  /**\n   * Reports which maintenance work is currently due.\n   *\n   * The result is a pure snapshot: callers decide which actions to run and\n   * when to wake up next. `earliestDeadlineAt` is the earliest outstanding\n   * maintenance deadline, including overdue work, unless a transient failure\n   * has deferred all scheduled maintenance until `maintenanceNotBeforeAt`.\n   */\n  planMaintenance(): {\n    dueRevalidations: Readonly<ConnectionContext>[];\n    dueRetransform: boolean;\n    earliestDeadlineAt: number | undefined;\n  } {\n    const dueRevalidations: Readonly<ConnectionContext>[] = [];\n    const now = this.#now();\n    let earliestDeadlineAt = this.#group.retransformAt;\n\n    for (const connection of this.#connections.values()) {\n      if (\n        connection.state !== 'validated' ||\n        connection.revalidateAt === undefined\n      ) {\n        continue;\n      }\n      if (connection.revalidateAt <= now) {\n        dueRevalidations.push(connection);\n      }\n      earliestDeadlineAt = minDefined(\n        earliestDeadlineAt,\n        connection.revalidateAt,\n      );\n    }\n\n    const dueRetransform =\n      this.#group.retransformAt !== undefined &&\n      this.#group.retransformAt <= now;\n    const maintenanceNotBeforeAt = this.#group.maintenanceNotBeforeAt;\n\n    if (\n      maintenanceNotBeforeAt !== undefined &&\n      maintenanceNotBeforeAt > now &&\n      earliestDeadlineAt !== undefined\n    ) {\n      return {\n        dueRevalidations: [],\n        dueRetransform: false,\n        earliestDeadlineAt: Math.max(\n          earliestDeadlineAt,\n          maintenanceNotBeforeAt,\n        ),\n      };\n    }\n\n    return {\n      dueRevalidations: dueRevalidations.sort(compareByInsertionOrder),\n      dueRetransform,\n      earliestDeadlineAt,\n    };\n  }\n\n  #removeConnection(\n    selector: ConnectionSelector,\n    revision?: number,\n  ): Readonly<ConnectionContext> | undefined {\n    const connection = this.#getConnectionContext(selector);\n\n    if (!connection) {\n      return undefined;\n    }\n\n    // If the revision has changed, we should not remove the connection\n    if (revision !== undefined && connection.revision !== revision) {\n      this.#lc.debug?.('Ignoring failConnection for stale revision', {\n        clientID: selector.clientID,\n        wsID: selector.wsID,\n        attemptedRevision: revision,\n        currentRevision: connection.revision,\n      });\n      return undefined;\n    }\n\n    this.#connections.delete(connection.clientID);\n    this.#refreshBackgroundConnectionContext();\n    this.#updateBackgroundRetransformDeadline(false);\n\n    return connection;\n  }\n\n  #demoteConnection(connection: ConnectionContext): ConnectionContext {\n    const demotedConnection = this.#storeConnection({\n      ...connection,\n      state: 'provisional',\n      revalidateAt: undefined,\n    });\n    this.#refreshBackgroundConnectionContext();\n    this.#updateBackgroundRetransformDeadline(false);\n    return demotedConnection;\n  }\n\n  /**\n   * Keeps the background connection sticky while it remains validated.\n   *\n   * When a newly validated `preferred` connection is provided, it is promoted\n   * only if there is no current validated background connection. Otherwise the\n   * existing background connection stays in place until it disappears or is\n   * demoted, at which point the newest validated connection is selected.\n   */\n  #refreshBackgroundConnectionContext(preferred?: ConnectionContext): void {\n    if (preferred?.state === 'validated') {\n      const currentBackgroundConnection =\n        this.#getBackgroundConnectionContext();\n      if (\n        currentBackgroundConnection?.clientID === preferred.clientID &&\n        currentBackgroundConnection.wsID === preferred.wsID\n      ) {\n        return;\n      }\n      if (currentBackgroundConnection !== undefined) {\n        return;\n      }\n      this.#setBackgroundConnection({\n        clientID: preferred.clientID,\n        wsID: preferred.wsID,\n      });\n      this.#lc.debug?.('Selected background connection for shared auth work', {\n        clientID: preferred.clientID,\n        wsID: preferred.wsID,\n        revision: preferred.revision,\n        reason: 'preferred-validated',\n      });\n      return;\n    }\n\n    const currentBackgroundConnection = this.#getBackgroundConnectionContext();\n    if (currentBackgroundConnection?.state === 'validated') {\n      return;\n    }\n\n    const nextBackgroundConnection = [...this.#connections.values()]\n      .filter(connection => connection.state === 'validated')\n      .sort(comparePreferredValidatedConnection)\n      .at(0);\n    this.#setBackgroundConnection(\n      nextBackgroundConnection\n        ? {\n            clientID: nextBackgroundConnection.clientID,\n            wsID: nextBackgroundConnection.wsID,\n          }\n        : undefined,\n    );\n    if (nextBackgroundConnection) {\n      this.#lc.debug?.('Selected background connection for shared auth work', {\n        clientID: nextBackgroundConnection.clientID,\n        wsID: nextBackgroundConnection.wsID,\n        revision: nextBackgroundConnection.revision,\n        reason: 'fallback-validated',\n      });\n    }\n  }\n\n  #getBackgroundConnectionContext(): ConnectionContext | undefined {\n    const backgroundConnection = this.#group.backgroundConnection;\n    if (!backgroundConnection) {\n      return undefined;\n    }\n    return this.#getConnectionContext(backgroundConnection);\n  }\n\n  #getConnectionContext(\n    selector: ConnectionSelector,\n  ): ConnectionContext | undefined {\n    const connection = this.#connections.get(selector.clientID);\n    if (!connection) {\n      return undefined;\n    }\n    if (connection.wsID !== selector.wsID) {\n      return undefined;\n    }\n    return connection;\n  }\n\n  #mustGetConnectionContext(selector: ConnectionSelector): ConnectionContext {\n    const connection = this.#getConnectionContext(selector);\n\n    if (!connection) {\n      throw new ProtocolErrorWithLevel(\n        {\n          kind: ErrorKind.InvalidConnectionRequest,\n          message:\n            'Connection auth state was not available for this websocket.',\n          origin: ErrorOrigin.ZeroCache,\n        },\n        'warn',\n      );\n    }\n\n    return connection;\n  }\n\n  #storeConnection(connection: ConnectionContext): ConnectionContext {\n    this.#connections.set(connection.clientID, connection);\n    return connection;\n  }\n\n  #setGroup(group: GroupAuthState): GroupAuthState {\n    this.#group = group;\n    return group;\n  }\n\n  #setBackgroundConnection(\n    backgroundConnection: ConnectionSelector | undefined,\n  ) {\n    if (\n      sameConnectionSelector(\n        this.#group.backgroundConnection,\n        backgroundConnection,\n      )\n    ) {\n      return;\n    }\n    this.#setGroup({\n      ...this.#group,\n      backgroundConnection: backgroundConnection\n        ? {...backgroundConnection}\n        : undefined,\n    });\n  }\n\n  /**\n   * Keeps the group background retransform deadline coherent with current\n   * schedulability.\n   *\n   * When `reset` is false, this seeds a deadline only when shared retransform\n   * is now possible and no deadline exists yet, preserving any existing\n   * cadence. When `reset` is true, it starts a fresh interval from `#now()` if\n   * retransform is schedulable for the current ready ViewSyncer instance, or\n   * clears the deadline if it is not.\n   */\n  #updateBackgroundRetransformDeadline(reset: boolean) {\n    const backgroundConnection = this.#getBackgroundConnectionContext();\n    if (\n      !backgroundConnection ||\n      this.#retransformIntervalMs === undefined ||\n      !this.#sharedRetransformReady\n    ) {\n      if (this.#group.retransformAt !== undefined) {\n        this.#setGroup({\n          ...this.#group,\n          retransformAt: undefined,\n        });\n      }\n      return;\n    }\n\n    if (reset || this.#group.retransformAt === undefined) {\n      this.#setGroup({\n        ...this.#group,\n        retransformAt: this.#now() + this.#retransformIntervalMs,\n      });\n    }\n  }\n\n  #nextRevalidateAt() {\n    return this.#revalidateIntervalMs === undefined\n      ? undefined\n      : this.#now() + this.#revalidateIntervalMs;\n  }\n}\n\nfunction compareByInsertionOrder(\n  a: Pick<ConnectionContext, 'insertionOrder' | 'wsID'>,\n  b: Pick<ConnectionContext, 'insertionOrder' | 'wsID'>,\n) {\n  return a.insertionOrder - b.insertionOrder || a.wsID.localeCompare(b.wsID);\n}\n\nfunction comparePreferredValidatedConnection(\n  a: Pick<ConnectionContext, 'insertionOrder' | 'wsID'>,\n  b: Pick<ConnectionContext, 'insertionOrder' | 'wsID'>,\n) {\n  return b.insertionOrder - a.insertionOrder || b.wsID.localeCompare(a.wsID);\n}\n\nfunction minDefined(a: number | undefined, b: number | undefined) {\n  if (a === undefined) {\n    return b;\n  }\n  if (b === undefined) {\n    return a;\n  }\n  return Math.min(a, b);\n}\n\nfunction sameConnectionSelector(\n  a: ConnectionSelector | undefined,\n  b: ConnectionSelector | undefined,\n) {\n  return a?.clientID === b?.clientID && a?.wsID === b?.wsID;\n}\n\nfunction filterHeaders(\n  headers: Readonly<Record<string, string>> | undefined,\n  allowedHeaders: readonly string[] | undefined,\n) {\n  if (!headers || !allowedHeaders || allowedHeaders.length === 0) {\n    return undefined;\n  }\n\n  const allowed = new Set(allowedHeaders.map(header => header.toLowerCase()));\n  let filtered: Record<string, string> | undefined;\n  for (const [key, value] of Object.entries(headers)) {\n    if (allowed.has(key.toLowerCase())) {\n      filtered ??= {};\n      filtered[key] = value;\n    }\n  }\n  return filtered;\n}\n"],"mappings":";;;;;;;;;;;;;;AA+KA,IAAa,+BAAb,MAA8E;CAC5E;CAGA,+BAAwB,IAAI,IAA+B;CAC3D,SAAyB;EACvB,YAAY,KAAA;EACZ,sBAAsB,KAAA;EACtB,eAAe,KAAA;EACf,wBAAwB,KAAA;CAC1B;CAEA;CAEA;CACA;CACA;CACA;CACA;CACA,0BAA0B;CAC1B,sBAAsB;CAEtB,YACE,IACA,2BACA,4BACA,aACA,YACA,mBACA,KACA;EACA,KAAK,MAAM;EACX,KAAK,OAAO,OAAO,KAAK;EACxB,KAAK,wBACH,8BAA8B,KAAA,IAC1B,KAAA,IACA,4BAA4B;EAClC,KAAK,yBACH,+BAA+B,KAAA,IAC3B,KAAA,IACA,6BAA6B;EACnC,KAAK,eAAe;EACpB,KAAK,cAAc;EACnB,KAAK,qBAAqB;CAC5B;;;;;;;CAQA,mBACE,UACA,eACA,MAC6B;EAC7B,KAAK,kBAAkB,QAAQ;EAE/B,MAAM,cAAc,SAAqD;GACvE,MAAM,SAAS,SAAS,UAAU,KAAK,eAAe,KAAK;GAE3D,OAAO;IACL,KAAK,QAAQ,MAAM;IACnB,oBAAoB,QAAQ,KAAK,IAAI,iBAAiB;IACtD,eAAe;KACb,eAAe,KAAA;KACf,gBAAgB,cACd,cAAc,gBACd,QAAQ,qBACV;KACA,QAAQ,cAAc;KACtB,QAAQ,QAAQ;KAChB,QAAQ,QAAQ,iBAAiB,cAAc,aAAa,KAAA;IAC9D;GACF;EACF;EAEA,MAAM,aAAgC;GACpC,OAAO;GAEP,UAAU,cAAc;GACxB,MAAM,cAAc;GACpB,UAAU;GACV,MAAM,EAAC,IAAI,cAAc,UAAU,KAAI;GACvC;GAEA,WAAW,cAAc;GACzB,YAAY,cAAc;GAC1B,iBAAiB,cAAc;GAE/B,cAAc,KAAA;GAEd,cAAc,WAAW,OAAO;GAChC,eAAe,WAAW,QAAQ;GAElC,gBAAgB,EAAE,KAAK;EACzB;EACA,KAAK,iBAAiB,UAAU;EAChC,KAAK,oCAAoC;EACzC,KAAK,qCAAqC,KAAK;EAC/C,OAAO;CACT;;;;;;;CAQA,eACE,UACA,MAC6B;EAC7B,MAAM,aAAa,KAAK,0BAA0B,QAAQ;EAE1D,IAAI,eAAe,WAAW;EAC9B,IAAI,gBAAgB,WAAW;EAE/B,IAAI,KAAK,cACP,eAAe;GACb,GAAG;GACH,KAAK,KAAK;EACZ;EAEF,IAAI,KAAK,kBACP,eAAe;GACb,GAAG;GACH,eAAe;IACb,GAAG,aAAa;IAChB,eAAe,cACb,KAAK,kBACL,KAAK,cAAc,oBACrB;GACF;EACF;EAEF,IAAI,KAAK,aACP,gBAAgB;GACd,GAAG;GACH,KAAK,KAAK;EACZ;EAEF,IAAI,KAAK,iBACP,gBAAgB;GACd,GAAG;GACH,eAAe;IACb,GAAG,cAAc;IACjB,eAAe,cACb,KAAK,iBACL,KAAK,aAAa,oBACpB;GACF;EACF;EAGF,OAAO,KAAK,kBAAkB;GAC5B,GAAG;GACH,UAAU,WAAW,WAAW;GAChC;GACA;EACF,CAAC;CACH;;;;;CAMA,MAAM,WACJ,UACA,MACsC;EACtC,MAAM,aAAa,KAAK,0BAA0B,QAAQ;EAE1D,MAAM,WAAW,MAAM,YACrB,KAAK,KACL,WAAW,MACX,WAAW,KAAK,IAChB,KAAK,MACL,KAAK,kBACP;EAGA,IAAI,CADiB,WAAW,WAAW,MAAM,QAAQ,GAEvD,OAAO,KAAK,kBAAkB;GAC5B,GAAG;GACH,MAAM;GACN,UAAU,WAAW,WAAW;EAClC,CAAC;EAGH,IAAI,aAAa,WAAW,MAC1B,OAAO;EAGT,OAAO,KAAK,iBAAiB;GAC3B,GAAG;GACH,MAAM;EACR,CAAC;CACH;;;;;;;;;;CAWA,mBACE,UACA,UACA,YAMY;EACZ,MAAM,aAAa,KAAK,sBAAsB,QAAQ;EACtD,IAAI,CAAC,YACH;EAGF,IAAI,WAAW,aAAa,UAAU;GACpC,KAAK,IAAI,QAAQ,kDAAkD;IACjE,UAAU,SAAS;IACnB,mBAAmB;IACnB,iBAAiB,WAAW;GAC9B,CAAC;GACD;EACF;EAEA,IAAI;EAIJ,IAAI,WAAW,SAAS,oBAAoB;GAC1C,qBAAqB,EAAC,IAAI,WAAW,gBAAe;GAIpD,IAAI,WAAW,KAAK,OAAO,mBAAmB,IAC5C,MAAM,IAAI,uBACR;IACE,MAAMA;IACN,SACE;IACF,QAAQC;GACV,GACA,MACF;EAEJ;EAIA,MAAM,oBAAoB,sBAAsB,WAAW;EAI3D,IACE,KAAK,OAAO,eAAe,KAAA,KAC3B,KAAK,OAAO,WAAW,OAAO,kBAAkB,IAEhD,MAAM,IAAI,uBACR;GACE,MAAMD;GACN,SACE;GACF,QAAQC;EACV,GACA,MACF;EAGF,IAAI,KAAK,OAAO,eAAe,KAAA,GAC7B,KAAK,UAAU;GACb,GAAG,KAAK;GACR,YAAY;EACd,CAAC;EAGH,MAAM,sBAAsB,KAAK,iBAAiB;GAChD,GAAG;GACH,OAAO;GACP,cAAc,KAAK,kBAAkB;EACvC,CAAC;EACD,KAAK,oCAAoC,mBAAmB;EAC5D,KAAK,qCAAqC,KAAK;EAE/C,OAAO;GACL,YAAY;GACZ,OAAO,KAAK,cAAc;EAC5B;CACF;;CAGA,eACE,UACA,UAC+B;EAC/B,OAAO,KAAK,kBAAkB,UAAU,QAAQ;CAClD;;CAGA,gBAAgB,UAA6D;EAC3E,OAAO,KAAK,kBAAkB,QAAQ;CACxC;;;;;;CAOA,iCACE,UACA,UACM;EACN,MAAM,uBAAuB,KAAK,gCAAgC;EAClE,IAAI,CAAC,sBACH;EAEF,IACE,qBAAqB,aAAa,SAAS,YAC3C,qBAAqB,SAAS,SAAS,QACvC,qBAAqB,aAAa,UAElC;EAEF,KAAK,qCAAqC,IAAI;CAChD;CAEA,0BAA0B,OAAsB;EAC9C,IAAI,KAAK,4BAA4B,OACnC;EAEF,KAAK,0BAA0B;EAC/B,KAAK,qCAAqC,IAAI;CAChD;CAEA,iBAAiB,MAA0C;EACzD,MAAM,aACJ,SAAS,eACL,KAAK,wBACL,KAAK;EACX,IAAI,eAAe,KAAA,GACjB;EAEF,KAAK,UAAU;GACb,GAAG,KAAK;GACR,wBAAwB,KAAK,IAC3B,KAAK,OAAO,0BAA0B,GACtC,KAAK,KAAK,IAAI,UAChB;EACF,CAAC;CACH;;CAGA,qBACE,UACyC;EACzC,OAAO,KAAK,sBAAsB,QAAQ;CAC5C;;CAGA,yBACE,UAC6B;EAC7B,OAAO,KAAK,0BAA0B,QAAQ;CAChD;;CAGA,iCAA0E;EACxE,OAAO,KAAK,gCAAgC;CAC9C;CAEA,qCAAkE;EAChE,MAAM,uBAAuB,KAAK,gCAAgC;EAClE,IAAI,CAAC,sBACH,MAAM,IAAI,uBACR;GACE,MAAMC;GACN,SACE;GACF,QAAQD;EACV,GACA,MACF;EAEF,OAAO;CACT;;CAGA,gBAA0C;EACxC,OAAO,KAAK;CACd;;;;;;;;;CAUA,kBAIE;EACA,MAAM,mBAAkD,CAAC;EACzD,MAAM,MAAM,KAAK,KAAK;EACtB,IAAI,qBAAqB,KAAK,OAAO;EAErC,KAAK,MAAM,cAAc,KAAK,aAAa,OAAO,GAAG;GACnD,IACE,WAAW,UAAU,eACrB,WAAW,iBAAiB,KAAA,GAE5B;GAEF,IAAI,WAAW,gBAAgB,KAC7B,iBAAiB,KAAK,UAAU;GAElC,qBAAqB,WACnB,oBACA,WAAW,YACb;EACF;EAEA,MAAM,iBACJ,KAAK,OAAO,kBAAkB,KAAA,KAC9B,KAAK,OAAO,iBAAiB;EAC/B,MAAM,yBAAyB,KAAK,OAAO;EAE3C,IACE,2BAA2B,KAAA,KAC3B,yBAAyB,OACzB,uBAAuB,KAAA,GAEvB,OAAO;GACL,kBAAkB,CAAC;GACnB,gBAAgB;GAChB,oBAAoB,KAAK,IACvB,oBACA,sBACF;EACF;EAGF,OAAO;GACL,kBAAkB,iBAAiB,KAAK,uBAAuB;GAC/D;GACA;EACF;CACF;CAEA,kBACE,UACA,UACyC;EACzC,MAAM,aAAa,KAAK,sBAAsB,QAAQ;EAEtD,IAAI,CAAC,YACH;EAIF,IAAI,aAAa,KAAA,KAAa,WAAW,aAAa,UAAU;GAC9D,KAAK,IAAI,QAAQ,8CAA8C;IAC7D,UAAU,SAAS;IACnB,MAAM,SAAS;IACf,mBAAmB;IACnB,iBAAiB,WAAW;GAC9B,CAAC;GACD;EACF;EAEA,KAAK,aAAa,OAAO,WAAW,QAAQ;EAC5C,KAAK,oCAAoC;EACzC,KAAK,qCAAqC,KAAK;EAE/C,OAAO;CACT;CAEA,kBAAkB,YAAkD;EAClE,MAAM,oBAAoB,KAAK,iBAAiB;GAC9C,GAAG;GACH,OAAO;GACP,cAAc,KAAA;EAChB,CAAC;EACD,KAAK,oCAAoC;EACzC,KAAK,qCAAqC,KAAK;EAC/C,OAAO;CACT;;;;;;;;;CAUA,oCAAoC,WAAqC;EACvE,IAAI,WAAW,UAAU,aAAa;GACpC,MAAM,8BACJ,KAAK,gCAAgC;GACvC,IACE,6BAA6B,aAAa,UAAU,YACpD,4BAA4B,SAAS,UAAU,MAE/C;GAEF,IAAI,gCAAgC,KAAA,GAClC;GAEF,KAAK,yBAAyB;IAC5B,UAAU,UAAU;IACpB,MAAM,UAAU;GAClB,CAAC;GACD,KAAK,IAAI,QAAQ,uDAAuD;IACtE,UAAU,UAAU;IACpB,MAAM,UAAU;IAChB,UAAU,UAAU;IACpB,QAAQ;GACV,CAAC;GACD;EACF;EAGA,IADoC,KAAK,gCACrC,CAAA,EAA6B,UAAU,aACzC;EAGF,MAAM,2BAA2B,CAAC,GAAG,KAAK,aAAa,OAAO,CAAC,CAAC,CAC7D,QAAO,eAAc,WAAW,UAAU,WAAW,CAAC,CACtD,KAAK,mCAAmC,CAAC,CACzC,GAAG,CAAC;EACP,KAAK,yBACH,2BACI;GACE,UAAU,yBAAyB;GACnC,MAAM,yBAAyB;EACjC,IACA,KAAA,CACN;EACA,IAAI,0BACF,KAAK,IAAI,QAAQ,uDAAuD;GACtE,UAAU,yBAAyB;GACnC,MAAM,yBAAyB;GAC/B,UAAU,yBAAyB;GACnC,QAAQ;EACV,CAAC;CAEL;CAEA,kCAAiE;EAC/D,MAAM,uBAAuB,KAAK,OAAO;EACzC,IAAI,CAAC,sBACH;EAEF,OAAO,KAAK,sBAAsB,oBAAoB;CACxD;CAEA,sBACE,UAC+B;EAC/B,MAAM,aAAa,KAAK,aAAa,IAAI,SAAS,QAAQ;EAC1D,IAAI,CAAC,YACH;EAEF,IAAI,WAAW,SAAS,SAAS,MAC/B;EAEF,OAAO;CACT;CAEA,0BAA0B,UAAiD;EACzE,MAAM,aAAa,KAAK,sBAAsB,QAAQ;EAEtD,IAAI,CAAC,YACH,MAAM,IAAI,uBACR;GACE,MAAMC;GACN,SACE;GACF,QAAQD;EACV,GACA,MACF;EAGF,OAAO;CACT;CAEA,iBAAiB,YAAkD;EACjE,KAAK,aAAa,IAAI,WAAW,UAAU,UAAU;EACrD,OAAO;CACT;CAEA,UAAU,OAAuC;EAC/C,KAAK,SAAS;EACd,OAAO;CACT;CAEA,yBACE,sBACA;EACA,IACE,uBACE,KAAK,OAAO,sBACZ,oBACF,GAEA;EAEF,KAAK,UAAU;GACb,GAAG,KAAK;GACR,sBAAsB,uBAClB,EAAC,GAAG,qBAAoB,IACxB,KAAA;EACN,CAAC;CACH;;;;;;;;;;;CAYA,qCAAqC,OAAgB;EAEnD,IACE,CAF2B,KAAK,gCAE/B,KACD,KAAK,2BAA2B,KAAA,KAChC,CAAC,KAAK,yBACN;GACA,IAAI,KAAK,OAAO,kBAAkB,KAAA,GAChC,KAAK,UAAU;IACb,GAAG,KAAK;IACR,eAAe,KAAA;GACjB,CAAC;GAEH;EACF;EAEA,IAAI,SAAS,KAAK,OAAO,kBAAkB,KAAA,GACzC,KAAK,UAAU;GACb,GAAG,KAAK;GACR,eAAe,KAAK,KAAK,IAAI,KAAK;EACpC,CAAC;CAEL;CAEA,oBAAoB;EAClB,OAAO,KAAK,0BAA0B,KAAA,IAClC,KAAA,IACA,KAAK,KAAK,IAAI,KAAK;CACzB;AACF;AAEA,SAAS,wBACP,GACA,GACA;CACA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,cAAc,EAAE,IAAI;AAC3E;AAEA,SAAS,oCACP,GACA,GACA;CACA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,cAAc,EAAE,IAAI;AAC3E;AAEA,SAAS,WAAW,GAAuB,GAAuB;CAChE,IAAI,MAAM,KAAA,GACR,OAAO;CAET,IAAI,MAAM,KAAA,GACR,OAAO;CAET,OAAO,KAAK,IAAI,GAAG,CAAC;AACtB;AAEA,SAAS,uBACP,GACA,GACA;CACA,OAAO,GAAG,aAAa,GAAG,YAAY,GAAG,SAAS,GAAG;AACvD;AAEA,SAAS,cACP,SACA,gBACA;CACA,IAAI,CAAC,WAAW,CAAC,kBAAkB,eAAe,WAAW,GAC3D;CAGF,MAAM,UAAU,IAAI,IAAI,eAAe,KAAI,WAAU,OAAO,YAAY,CAAC,CAAC;CAC1E,IAAI;CACJ,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAC/C,IAAI,QAAQ,IAAI,IAAI,YAAY,CAAC,GAAG;EAClC,aAAa,CAAC;EACd,SAAS,OAAO;CAClB;CAEF,OAAO;AACT"}
+{"version":3,"file":"connection-context-manager.js","names":["ErrorKind.Unauthorized","ErrorOrigin.ZeroCache","ErrorKind.Rehome","ErrorKind.InvalidConnectionRequest"],"sources":["../../../../../../zero-cache/src/services/view-syncer/connection-context-manager.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {InitConnectionBody} from '../../../../zero-protocol/src/connect.ts';\nimport {ErrorKind} from '../../../../zero-protocol/src/error-kind.ts';\nimport {ErrorOrigin} from '../../../../zero-protocol/src/error-origin.ts';\nimport type {UpdateAuthBody} from '../../../../zero-protocol/src/update-auth.ts';\nimport {\n  authEquals,\n  resolveAuth,\n  type Auth,\n  type ValidateLegacyJWT,\n} from '../../auth/auth.ts';\nimport type {ZeroConfig} from '../../config/zero-config.ts';\nimport {compileUrlPattern} from '../../custom/fetch.ts';\nimport {ProtocolErrorWithLevel} from '../../types/error-with-level.ts';\nimport type {ConnectParams} from '../../workers/connect-params.ts';\n\nexport type ConnectionState = 'provisional' | 'validated';\n\n/**\n * Normalized user identity shared by live connection state and group auth state.\n * `id: null` means logged out.\n */\nexport type UserState = {readonly id: string | null};\n\n/**\n * How a connection's `userID` was established:\n *\n * - `server-validated`: the API server returned the authoritative userID\n *   (`null` for a logged-out caller). The connection's claimed userID must\n *   match it.\n * - `server-unverified`: the API server answered without a userID, so it did\n *   not vouch for the caller. With `requireServerUserID`, only a logged-out\n *   connection, or a userID that a legacy JWT has already verified, is\n *   accepted. Without it, the claimed userID is trusted and a warning is\n *   logged.\n * - `client-fallback`: no API server is involved, so the userID provided by\n *   the client in the connection params is trusted as-is (a legacy JWT, when\n *   configured, has verified it).\n */\nexport type ConnectionValidation =\n  | {kind: 'client-fallback'}\n  | {kind: 'server-unverified'}\n  | {kind: 'server-validated'; validatedUserID: string | null};\n\n/**\n * Identifies one live websocket for a client slot.\n */\nexport type ConnectionSelector = {\n  readonly clientID: string;\n  readonly wsID: string;\n};\n\ntype FetchConfig = ZeroConfig['query'];\n\nexport type HeaderOptions = {\n  readonly apiKey?: string | undefined;\n  /** Allowlisted headers provided in the client options. */\n  readonly customHeaders?: Readonly<Record<string, string>> | undefined;\n  /** Allowlisted headers from the incoming HTTP request. */\n  readonly requestHeaders?: Readonly<Record<string, string>> | undefined;\n  readonly cookie?: string | undefined;\n  readonly origin?: string | undefined;\n};\n\nexport type ConnectionFetchContext = {\n  readonly url: string | undefined;\n  readonly allowedUrlPatterns: readonly URLPattern[] | undefined;\n  readonly headerOptions: HeaderOptions;\n};\n\n/**\n * A snapshot of one live connection tracked by the manager.\n *\n * `revalidateAt` is only populated while the connection is `validated`.\n */\nexport type ConnectionContext = {\n  readonly state: ConnectionState;\n\n  readonly clientID: string;\n  readonly wsID: string;\n  readonly user: UserState;\n\n  readonly auth: Auth | undefined;\n\n  readonly profileID: string | null;\n  readonly baseCookie: string | null;\n  readonly protocolVersion: number;\n\n  readonly revision: number;\n\n  readonly revalidateAt: number | undefined;\n\n  readonly insertionOrder: number;\n\n  readonly queryContext: ConnectionFetchContext;\n  readonly mutateContext: ConnectionFetchContext;\n};\n\n/**\n * Group-scoped auth state shared across the live connections.\n *\n * The background connection is the validated connection currently used for\n * shared background work. Retransform happens on a group level, and uses\n * the background connection's credential to refetch the latest queries.\n */\nexport type GroupAuthState = {\n  readonly pinnedUser: UserState | undefined;\n\n  readonly backgroundConnection: ConnectionSelector | undefined;\n  readonly retransformAt: number | undefined;\n  // Defer all maintenance in case a transient failure occurs.\n  readonly maintenanceNotBeforeAt: number | undefined;\n};\n\nexport type ConnectionContextManager = {\n  registerConnection(\n    selector: ConnectionSelector,\n    connectParams: ConnectParams,\n    auth?: Auth,\n  ): Readonly<ConnectionContext>;\n\n  initConnection(\n    selector: ConnectionSelector,\n    body: InitConnectionBody,\n  ): Readonly<ConnectionContext>;\n\n  updateAuth(\n    selector: ConnectionSelector,\n    body: UpdateAuthBody,\n  ): Promise<Readonly<ConnectionContext>>;\n\n  validateConnection(\n    selector: ConnectionSelector,\n    revision: number,\n    validation: ConnectionValidation,\n  ):\n    | Readonly<{\n        connection: ConnectionContext;\n        group: GroupAuthState;\n      }>\n    | undefined;\n\n  restorePinnedUser(pinnedUser: UserState): void;\n\n  failConnection(\n    selector: ConnectionSelector,\n    revision: number,\n  ): Readonly<ConnectionContext> | undefined;\n  closeConnection(\n    selector: ConnectionSelector,\n  ): Readonly<ConnectionContext> | undefined;\n\n  markBackgroundRetransformSuccess(\n    selector: ConnectionSelector,\n    revision: number,\n  ): void;\n\n  setSharedRetransformReady(ready: boolean): void;\n\n  deferMaintenance(kind: 'revalidate' | 'retransform'): void;\n\n  getConnectionContext(\n    selector: ConnectionSelector,\n  ): Readonly<ConnectionContext> | undefined;\n  mustGetConnectionContext(\n    selector: ConnectionSelector,\n  ): Readonly<ConnectionContext>;\n\n  getBackgroundConnectionContext(): Readonly<ConnectionContext> | undefined;\n  mustGetBackgroundConnectionContext(): Readonly<ConnectionContext>;\n\n  getGroupState(): Readonly<GroupAuthState>;\n\n  planMaintenance(): {\n    dueRevalidations: Readonly<ConnectionContext>[];\n    dueRetransform: boolean;\n    earliestDeadlineAt: number | undefined;\n  };\n};\n\n/**\n * State machine for the auth state of a single `ViewSyncerService`.\n *\n * Connections are registered as `provisional`, optionally backfilled with\n * `initConnection` metadata, and then promoted to `validated` once their\n * effective `userID` is confirmed as valid. The manager also tracks which\n * validated connection currently serves as the group's background connection.\n */\nexport class ConnectionContextManagerImpl implements ConnectionContextManager {\n  readonly #lc: LogContext;\n\n  // The live connection records, keyed by clientID\n  readonly #connections = new Map<string, ConnectionContext>();\n  #group: GroupAuthState = {\n    pinnedUser: undefined,\n    backgroundConnection: undefined,\n    retransformAt: undefined,\n    maintenanceNotBeforeAt: undefined,\n  };\n\n  readonly #validateLegacyJWT: ValidateLegacyJWT | undefined;\n\n  readonly #now: () => number;\n  readonly #revalidateIntervalMs: number | undefined;\n  readonly #retransformIntervalMs: number | undefined;\n  readonly #queryConfig: FetchConfig | undefined;\n  readonly #pushConfig: FetchConfig | undefined;\n  readonly #requireServerUserID: boolean;\n  #warnedUnverifiedUser = false;\n  #sharedRetransformReady = false;\n  #nextInsertionOrder = 0;\n\n  constructor(\n    lc: LogContext,\n    revalidateIntervalSeconds?: number,\n    retransformIntervalSeconds?: number,\n    queryConfig?: FetchConfig,\n    pushConfig?: FetchConfig,\n    validateLegacyJWT?: ValidateLegacyJWT,\n    now?: () => number,\n    requireServerUserID = false,\n  ) {\n    this.#lc = lc;\n    this.#now = now ?? Date.now;\n    this.#revalidateIntervalMs =\n      revalidateIntervalSeconds === undefined\n        ? undefined\n        : revalidateIntervalSeconds * 1000;\n    this.#retransformIntervalMs =\n      retransformIntervalSeconds === undefined\n        ? undefined\n        : retransformIntervalSeconds * 1000;\n    this.#queryConfig = queryConfig;\n    this.#pushConfig = pushConfig;\n    this.#validateLegacyJWT = validateLegacyJWT;\n    this.#requireServerUserID = requireServerUserID;\n  }\n\n  /**\n   * Creates or replaces the live record for a websocket connection.\n   *\n   * Re-registering the same `clientID` drops the old socket record and starts\n   * the replacement back in `provisional` state.\n   */\n  registerConnection(\n    selector: ConnectionSelector,\n    connectParams: ConnectParams,\n    auth?: Auth,\n  ): Readonly<ConnectionContext> {\n    this.#removeConnection(selector);\n\n    const getContext = (type: 'query' | 'mutate'): ConnectionFetchContext => {\n      const config = type === 'query' ? this.#queryConfig : this.#pushConfig;\n\n      return {\n        url: config?.url?.[0],\n        allowedUrlPatterns: config?.url?.map(compileUrlPattern),\n        headerOptions: {\n          customHeaders: undefined,\n          requestHeaders: filterHeaders(\n            connectParams.requestHeaders,\n            config?.allowedRequestHeaders,\n          ),\n          origin: connectParams.origin,\n          apiKey: config?.apiKey,\n          cookie: config?.forwardCookies ? connectParams.httpCookie : undefined,\n        },\n      };\n    };\n\n    const connection: ConnectionContext = {\n      state: 'provisional',\n\n      clientID: connectParams.clientID,\n      wsID: connectParams.wsID,\n      revision: 0,\n      user: {id: connectParams.userID ?? null},\n      auth,\n\n      profileID: connectParams.profileID,\n      baseCookie: connectParams.baseCookie,\n      protocolVersion: connectParams.protocolVersion,\n\n      revalidateAt: undefined,\n\n      queryContext: getContext('query'),\n      mutateContext: getContext('mutate'),\n\n      insertionOrder: ++this.#nextInsertionOrder,\n    };\n    this.#storeConnection(connection);\n    this.#refreshBackgroundConnectionContext();\n    this.#updateBackgroundRetransformDeadline(false);\n    return connection;\n  }\n\n  /**\n   * Backfills `initConnection` data for sockets that were registered before the\n   * client could send its full init payload.\n   *\n   * This updates metadata only; it does not validate the connection.\n   */\n  initConnection(\n    selector: ConnectionSelector,\n    body: InitConnectionBody,\n  ): Readonly<ConnectionContext> {\n    const connection = this.#mustGetConnectionContext(selector);\n\n    let queryContext = connection.queryContext;\n    let mutateContext = connection.mutateContext;\n\n    if (body.userQueryURL) {\n      queryContext = {\n        ...queryContext,\n        url: body.userQueryURL,\n      };\n    }\n    if (body.userQueryHeaders) {\n      queryContext = {\n        ...queryContext,\n        headerOptions: {\n          ...queryContext.headerOptions,\n          customHeaders: filterHeaders(\n            body.userQueryHeaders,\n            this.#queryConfig?.allowedClientHeaders,\n          ),\n        },\n      };\n    }\n    if (body.userPushURL) {\n      mutateContext = {\n        ...mutateContext,\n        url: body.userPushURL,\n      };\n    }\n    if (body.userPushHeaders) {\n      mutateContext = {\n        ...mutateContext,\n        headerOptions: {\n          ...mutateContext.headerOptions,\n          customHeaders: filterHeaders(\n            body.userPushHeaders,\n            this.#pushConfig?.allowedClientHeaders,\n          ),\n        },\n      };\n    }\n\n    return this.#demoteConnection({\n      ...connection,\n      revision: connection.revision + 1,\n      queryContext,\n      mutateContext,\n    });\n  }\n\n  /**\n   * A material auth change demotes the connection back to provisional until it\n   * is validated again.\n   */\n  async updateAuth(\n    selector: ConnectionSelector,\n    body: UpdateAuthBody,\n  ): Promise<Readonly<ConnectionContext>> {\n    const connection = this.#mustGetConnectionContext(selector);\n\n    const nextAuth = await resolveAuth(\n      this.#lc,\n      connection.auth,\n      connection.user.id,\n      body.auth,\n      this.#validateLegacyJWT,\n    );\n\n    const authChanged = !authEquals(connection.auth, nextAuth);\n    if (authChanged) {\n      return this.#demoteConnection({\n        ...connection,\n        auth: nextAuth,\n        revision: connection.revision + 1,\n      });\n    }\n\n    if (nextAuth === connection.auth) {\n      return connection;\n    }\n\n    return this.#storeConnection({\n      ...connection,\n      auth: nextAuth,\n    });\n  }\n\n  /**\n   * Validates one connection against the group's pinned `userID`.\n   *\n   * The first successful validation binds the group `userID`. Later\n   * validations must match it. Validation also refreshes the connection's\n   * revalidation deadline and may pick the connection as the group\n   * background connection if none is currently available. If the websocket is\n   * gone by the time async validation finishes, this becomes a no-op.\n   */\n  validateConnection(\n    selector: ConnectionSelector,\n    revision: number,\n    validation: ConnectionValidation,\n  ):\n    | Readonly<{\n        connection: ConnectionContext;\n        group: GroupAuthState;\n      }>\n    | undefined {\n    const connection = this.#getConnectionContext(selector);\n    if (!connection) {\n      return undefined;\n    }\n\n    if (connection.revision !== revision) {\n      this.#lc.debug?.('Skipping validateConnection for stale revision', {\n        clientID: selector.clientID,\n        attemptedRevision: revision,\n        currentRevision: connection.revision,\n      });\n      return undefined;\n    }\n\n    let validatedUserState: UserState | undefined;\n\n    // If the API server has validated the user's identity, we ensure that\n    // the connection's claimed userID matches it.\n    if (validation.kind === 'server-validated') {\n      validatedUserState = {id: validation.validatedUserID};\n\n      // Check that the ws connection userID provided by the client\n      // matches the validated userID from the API server.\n      if (connection.user.id !== validatedUserState.id) {\n        throw new ProtocolErrorWithLevel(\n          {\n            kind: ErrorKind.Unauthorized,\n            message:\n              'Connection userID does not match validated server userID.',\n            origin: ErrorOrigin.ZeroCache,\n          },\n          'warn',\n        );\n      }\n    } else if (\n      validation.kind === 'server-unverified' &&\n      connection.user.id !== null &&\n      connection.auth?.type !== 'jwt'\n    ) {\n      // The API server did not name the user, so nothing backs the claimed\n      // userID. Trusting it would let a connection pin the client group to a\n      // userID it does not own.\n      if (this.#requireServerUserID) {\n        throw new ProtocolErrorWithLevel(\n          {\n            kind: ErrorKind.Unauthorized,\n            message:\n              'Connection userID was not validated by the API server. The API server must return a userID for authenticated connections.',\n            origin: ErrorOrigin.ZeroCache,\n          },\n          'warn',\n        );\n      }\n      if (!this.#warnedUnverifiedUser) {\n        this.#warnedUnverifiedUser = true;\n        this.#lc.warn?.(\n          'The API server answered without a userID, so the userID claimed by the client was not verified. ' +\n            'Return the userID from your query and mutate endpoints (zero-server does this when you pass userID to handleQueryRequest and handleMutateRequest), ' +\n            'then set ZERO_AUTH_REQUIRE_SERVER_USER_ID=true to refuse unverified userIDs.',\n        );\n      }\n    }\n\n    // The incoming user state is either the validated user state from the server\n    // or the WS client's claimed user state if no server validation occurred.\n    const incomingUserState = validatedUserState ?? connection.user;\n\n    // Once a client group is validated, every later validated connection must\n    // agree with that pinned identity.\n    if (\n      this.#group.pinnedUser !== undefined &&\n      this.#group.pinnedUser.id !== incomingUserState.id\n    ) {\n      throw new ProtocolErrorWithLevel(\n        {\n          kind: ErrorKind.Unauthorized,\n          message:\n            'Client groups are pinned to a single userID. Connection userID does not match existing client group userID.',\n          origin: ErrorOrigin.ZeroCache,\n        },\n        'warn',\n      );\n    }\n\n    if (this.#group.pinnedUser === undefined) {\n      this.#setGroup({\n        ...this.#group,\n        pinnedUser: incomingUserState,\n      });\n    }\n\n    const validatedConnection = this.#storeConnection({\n      ...connection,\n      state: 'validated',\n      revalidateAt: this.#nextRevalidateAt(),\n    });\n    this.#refreshBackgroundConnectionContext(validatedConnection);\n    this.#updateBackgroundRetransformDeadline(false);\n\n    return {\n      connection: validatedConnection,\n      group: this.getGroupState(),\n    };\n  }\n\n  /**\n   * Pins the group to the user persisted with its CVR, as bound by a validated\n   * connection to an earlier instance of the group's view-syncer. Later\n   * validations by this instance must match it, as they would had the group\n   * been pinned here.\n   *\n   * Throws a `Rehome` error if the group is already pinned to another user:\n   * the stored pin wins, so the connections validated here can no longer be\n   * trusted and the view-syncer should stop, leaving its clients to reconnect\n   * to a fresh instance that validates them against the stored pin.\n   */\n  restorePinnedUser(pinnedUser: UserState): void {\n    if (this.#group.pinnedUser === undefined) {\n      this.#setGroup({...this.#group, pinnedUser: {id: pinnedUser.id}});\n      return;\n    }\n    if (this.#group.pinnedUser.id !== pinnedUser.id) {\n      throw new ProtocolErrorWithLevel(\n        {\n          kind: ErrorKind.Rehome,\n          message:\n            'Client group is pinned to a different userID than the one persisted with its CVR. Reconnect required.',\n          origin: ErrorOrigin.ZeroCache,\n        },\n        'warn',\n      );\n    }\n  }\n\n  /** Removes one connection due to failed auth and updates all derived background/deadline state. */\n  failConnection(\n    selector: ConnectionSelector,\n    revision: number,\n  ): ConnectionContext | undefined {\n    return this.#removeConnection(selector, revision);\n  }\n\n  /** Removes one disconnected connection and updates all derived background/deadline state. */\n  closeConnection(selector: ConnectionSelector): ConnectionContext | undefined {\n    return this.#removeConnection(selector);\n  }\n\n  /**\n   * Records a successful background retransform. This starts a fresh interval\n   * from the manager clock when shared retransform is schedulable, or\n   * clears the deadline if it is not.\n   */\n  markBackgroundRetransformSuccess(\n    selector: ConnectionSelector,\n    revision: number,\n  ): void {\n    const backgroundConnection = this.#getBackgroundConnectionContext();\n    if (!backgroundConnection) {\n      return;\n    }\n    if (\n      backgroundConnection.clientID !== selector.clientID ||\n      backgroundConnection.wsID !== selector.wsID ||\n      backgroundConnection.revision !== revision\n    ) {\n      return;\n    }\n    this.#updateBackgroundRetransformDeadline(true);\n  }\n\n  setSharedRetransformReady(ready: boolean): void {\n    if (this.#sharedRetransformReady === ready) {\n      return;\n    }\n    this.#sharedRetransformReady = ready;\n    this.#updateBackgroundRetransformDeadline(true);\n  }\n\n  deferMaintenance(kind: 'revalidate' | 'retransform'): void {\n    const intervalMs =\n      kind === 'revalidate'\n        ? this.#revalidateIntervalMs\n        : this.#retransformIntervalMs;\n    if (intervalMs === undefined) {\n      return;\n    }\n    this.#setGroup({\n      ...this.#group,\n      maintenanceNotBeforeAt: Math.max(\n        this.#group.maintenanceNotBeforeAt ?? 0,\n        this.#now() + intervalMs,\n      ),\n    });\n  }\n\n  /** Returns the current live record for a client slot, if any. */\n  getConnectionContext(\n    selector: ConnectionSelector,\n  ): Readonly<ConnectionContext> | undefined {\n    return this.#getConnectionContext(selector);\n  }\n\n  /** Returns the live record for one websocket or throws if it is unavailable. */\n  mustGetConnectionContext(\n    selector: ConnectionSelector,\n  ): Readonly<ConnectionContext> {\n    return this.#mustGetConnectionContext(selector);\n  }\n\n  /** Returns the current background connection, if one exists. */\n  getBackgroundConnectionContext(): Readonly<ConnectionContext> | undefined {\n    return this.#getBackgroundConnectionContext();\n  }\n\n  mustGetBackgroundConnectionContext(): Readonly<ConnectionContext> {\n    const backgroundConnection = this.#getBackgroundConnectionContext();\n    if (!backgroundConnection) {\n      throw new ProtocolErrorWithLevel(\n        {\n          kind: ErrorKind.InvalidConnectionRequest,\n          message:\n            'No validated connection is available for shared query work.',\n          origin: ErrorOrigin.ZeroCache,\n        },\n        'warn',\n      );\n    }\n    return backgroundConnection;\n  }\n\n  /** Returns the shared group auth state. */\n  getGroupState(): Readonly<GroupAuthState> {\n    return this.#group;\n  }\n\n  /**\n   * Reports which maintenance work is currently due.\n   *\n   * The result is a pure snapshot: callers decide which actions to run and\n   * when to wake up next. `earliestDeadlineAt` is the earliest outstanding\n   * maintenance deadline, including overdue work, unless a transient failure\n   * has deferred all scheduled maintenance until `maintenanceNotBeforeAt`.\n   */\n  planMaintenance(): {\n    dueRevalidations: Readonly<ConnectionContext>[];\n    dueRetransform: boolean;\n    earliestDeadlineAt: number | undefined;\n  } {\n    const dueRevalidations: Readonly<ConnectionContext>[] = [];\n    const now = this.#now();\n    let earliestDeadlineAt = this.#group.retransformAt;\n\n    for (const connection of this.#connections.values()) {\n      if (\n        connection.state !== 'validated' ||\n        connection.revalidateAt === undefined\n      ) {\n        continue;\n      }\n      if (connection.revalidateAt <= now) {\n        dueRevalidations.push(connection);\n      }\n      earliestDeadlineAt = minDefined(\n        earliestDeadlineAt,\n        connection.revalidateAt,\n      );\n    }\n\n    const dueRetransform =\n      this.#group.retransformAt !== undefined &&\n      this.#group.retransformAt <= now;\n    const maintenanceNotBeforeAt = this.#group.maintenanceNotBeforeAt;\n\n    if (\n      maintenanceNotBeforeAt !== undefined &&\n      maintenanceNotBeforeAt > now &&\n      earliestDeadlineAt !== undefined\n    ) {\n      return {\n        dueRevalidations: [],\n        dueRetransform: false,\n        earliestDeadlineAt: Math.max(\n          earliestDeadlineAt,\n          maintenanceNotBeforeAt,\n        ),\n      };\n    }\n\n    return {\n      dueRevalidations: dueRevalidations.sort(compareByInsertionOrder),\n      dueRetransform,\n      earliestDeadlineAt,\n    };\n  }\n\n  #removeConnection(\n    selector: ConnectionSelector,\n    revision?: number,\n  ): Readonly<ConnectionContext> | undefined {\n    const connection = this.#getConnectionContext(selector);\n\n    if (!connection) {\n      return undefined;\n    }\n\n    // If the revision has changed, we should not remove the connection\n    if (revision !== undefined && connection.revision !== revision) {\n      this.#lc.debug?.('Ignoring failConnection for stale revision', {\n        clientID: selector.clientID,\n        wsID: selector.wsID,\n        attemptedRevision: revision,\n        currentRevision: connection.revision,\n      });\n      return undefined;\n    }\n\n    this.#connections.delete(connection.clientID);\n    this.#refreshBackgroundConnectionContext();\n    this.#updateBackgroundRetransformDeadline(false);\n\n    return connection;\n  }\n\n  #demoteConnection(connection: ConnectionContext): ConnectionContext {\n    const demotedConnection = this.#storeConnection({\n      ...connection,\n      state: 'provisional',\n      revalidateAt: undefined,\n    });\n    this.#refreshBackgroundConnectionContext();\n    this.#updateBackgroundRetransformDeadline(false);\n    return demotedConnection;\n  }\n\n  /**\n   * Keeps the background connection sticky while it remains validated.\n   *\n   * When a newly validated `preferred` connection is provided, it is promoted\n   * only if there is no current validated background connection. Otherwise the\n   * existing background connection stays in place until it disappears or is\n   * demoted, at which point the newest validated connection is selected.\n   */\n  #refreshBackgroundConnectionContext(preferred?: ConnectionContext): void {\n    if (preferred?.state === 'validated') {\n      const currentBackgroundConnection =\n        this.#getBackgroundConnectionContext();\n      if (\n        currentBackgroundConnection?.clientID === preferred.clientID &&\n        currentBackgroundConnection.wsID === preferred.wsID\n      ) {\n        return;\n      }\n      if (currentBackgroundConnection !== undefined) {\n        return;\n      }\n      this.#setBackgroundConnection({\n        clientID: preferred.clientID,\n        wsID: preferred.wsID,\n      });\n      this.#lc.debug?.('Selected background connection for shared auth work', {\n        clientID: preferred.clientID,\n        wsID: preferred.wsID,\n        revision: preferred.revision,\n        reason: 'preferred-validated',\n      });\n      return;\n    }\n\n    const currentBackgroundConnection = this.#getBackgroundConnectionContext();\n    if (currentBackgroundConnection?.state === 'validated') {\n      return;\n    }\n\n    const nextBackgroundConnection = [...this.#connections.values()]\n      .filter(connection => connection.state === 'validated')\n      .sort(comparePreferredValidatedConnection)\n      .at(0);\n    this.#setBackgroundConnection(\n      nextBackgroundConnection\n        ? {\n            clientID: nextBackgroundConnection.clientID,\n            wsID: nextBackgroundConnection.wsID,\n          }\n        : undefined,\n    );\n    if (nextBackgroundConnection) {\n      this.#lc.debug?.('Selected background connection for shared auth work', {\n        clientID: nextBackgroundConnection.clientID,\n        wsID: nextBackgroundConnection.wsID,\n        revision: nextBackgroundConnection.revision,\n        reason: 'fallback-validated',\n      });\n    }\n  }\n\n  #getBackgroundConnectionContext(): ConnectionContext | undefined {\n    const backgroundConnection = this.#group.backgroundConnection;\n    if (!backgroundConnection) {\n      return undefined;\n    }\n    return this.#getConnectionContext(backgroundConnection);\n  }\n\n  #getConnectionContext(\n    selector: ConnectionSelector,\n  ): ConnectionContext | undefined {\n    const connection = this.#connections.get(selector.clientID);\n    if (!connection) {\n      return undefined;\n    }\n    if (connection.wsID !== selector.wsID) {\n      return undefined;\n    }\n    return connection;\n  }\n\n  #mustGetConnectionContext(selector: ConnectionSelector): ConnectionContext {\n    const connection = this.#getConnectionContext(selector);\n\n    if (!connection) {\n      throw new ProtocolErrorWithLevel(\n        {\n          kind: ErrorKind.InvalidConnectionRequest,\n          message:\n            'Connection auth state was not available for this websocket.',\n          origin: ErrorOrigin.ZeroCache,\n        },\n        'warn',\n      );\n    }\n\n    return connection;\n  }\n\n  #storeConnection(connection: ConnectionContext): ConnectionContext {\n    this.#connections.set(connection.clientID, connection);\n    return connection;\n  }\n\n  #setGroup(group: GroupAuthState): GroupAuthState {\n    this.#group = group;\n    return group;\n  }\n\n  #setBackgroundConnection(\n    backgroundConnection: ConnectionSelector | undefined,\n  ) {\n    if (\n      sameConnectionSelector(\n        this.#group.backgroundConnection,\n        backgroundConnection,\n      )\n    ) {\n      return;\n    }\n    this.#setGroup({\n      ...this.#group,\n      backgroundConnection: backgroundConnection\n        ? {...backgroundConnection}\n        : undefined,\n    });\n  }\n\n  /**\n   * Keeps the group background retransform deadline coherent with current\n   * schedulability.\n   *\n   * When `reset` is false, this seeds a deadline only when shared retransform\n   * is now possible and no deadline exists yet, preserving any existing\n   * cadence. When `reset` is true, it starts a fresh interval from `#now()` if\n   * retransform is schedulable for the current ready ViewSyncer instance, or\n   * clears the deadline if it is not.\n   */\n  #updateBackgroundRetransformDeadline(reset: boolean) {\n    const backgroundConnection = this.#getBackgroundConnectionContext();\n    if (\n      !backgroundConnection ||\n      this.#retransformIntervalMs === undefined ||\n      !this.#sharedRetransformReady\n    ) {\n      if (this.#group.retransformAt !== undefined) {\n        this.#setGroup({\n          ...this.#group,\n          retransformAt: undefined,\n        });\n      }\n      return;\n    }\n\n    if (reset || this.#group.retransformAt === undefined) {\n      this.#setGroup({\n        ...this.#group,\n        retransformAt: this.#now() + this.#retransformIntervalMs,\n      });\n    }\n  }\n\n  #nextRevalidateAt() {\n    return this.#revalidateIntervalMs === undefined\n      ? undefined\n      : this.#now() + this.#revalidateIntervalMs;\n  }\n}\n\nfunction compareByInsertionOrder(\n  a: Pick<ConnectionContext, 'insertionOrder' | 'wsID'>,\n  b: Pick<ConnectionContext, 'insertionOrder' | 'wsID'>,\n) {\n  return a.insertionOrder - b.insertionOrder || a.wsID.localeCompare(b.wsID);\n}\n\nfunction comparePreferredValidatedConnection(\n  a: Pick<ConnectionContext, 'insertionOrder' | 'wsID'>,\n  b: Pick<ConnectionContext, 'insertionOrder' | 'wsID'>,\n) {\n  return b.insertionOrder - a.insertionOrder || b.wsID.localeCompare(a.wsID);\n}\n\nfunction minDefined(a: number | undefined, b: number | undefined) {\n  if (a === undefined) {\n    return b;\n  }\n  if (b === undefined) {\n    return a;\n  }\n  return Math.min(a, b);\n}\n\nfunction sameConnectionSelector(\n  a: ConnectionSelector | undefined,\n  b: ConnectionSelector | undefined,\n) {\n  return a?.clientID === b?.clientID && a?.wsID === b?.wsID;\n}\n\nfunction filterHeaders(\n  headers: Readonly<Record<string, string>> | undefined,\n  allowedHeaders: readonly string[] | undefined,\n) {\n  if (!headers || !allowedHeaders || allowedHeaders.length === 0) {\n    return undefined;\n  }\n\n  const allowed = new Set(allowedHeaders.map(header => header.toLowerCase()));\n  let filtered: Record<string, string> | undefined;\n  for (const [key, value] of Object.entries(headers)) {\n    if (allowed.has(key.toLowerCase())) {\n      filtered ??= {};\n      filtered[key] = value;\n    }\n  }\n  return filtered;\n}\n"],"mappings":";;;;;;;;;;;;;;AA4LA,IAAa,+BAAb,MAA8E;CAC5E;CAGA,+BAAwB,IAAI,IAA+B;CAC3D,SAAyB;EACvB,YAAY,KAAA;EACZ,sBAAsB,KAAA;EACtB,eAAe,KAAA;EACf,wBAAwB,KAAA;CAC1B;CAEA;CAEA;CACA;CACA;CACA;CACA;CACA;CACA,wBAAwB;CACxB,0BAA0B;CAC1B,sBAAsB;CAEtB,YACE,IACA,2BACA,4BACA,aACA,YACA,mBACA,KACA,sBAAsB,OACtB;EACA,KAAK,MAAM;EACX,KAAK,OAAO,OAAO,KAAK;EACxB,KAAK,wBACH,8BAA8B,KAAA,IAC1B,KAAA,IACA,4BAA4B;EAClC,KAAK,yBACH,+BAA+B,KAAA,IAC3B,KAAA,IACA,6BAA6B;EACnC,KAAK,eAAe;EACpB,KAAK,cAAc;EACnB,KAAK,qBAAqB;EAC1B,KAAK,uBAAuB;CAC9B;;;;;;;CAQA,mBACE,UACA,eACA,MAC6B;EAC7B,KAAK,kBAAkB,QAAQ;EAE/B,MAAM,cAAc,SAAqD;GACvE,MAAM,SAAS,SAAS,UAAU,KAAK,eAAe,KAAK;GAE3D,OAAO;IACL,KAAK,QAAQ,MAAM;IACnB,oBAAoB,QAAQ,KAAK,IAAI,iBAAiB;IACtD,eAAe;KACb,eAAe,KAAA;KACf,gBAAgB,cACd,cAAc,gBACd,QAAQ,qBACV;KACA,QAAQ,cAAc;KACtB,QAAQ,QAAQ;KAChB,QAAQ,QAAQ,iBAAiB,cAAc,aAAa,KAAA;IAC9D;GACF;EACF;EAEA,MAAM,aAAgC;GACpC,OAAO;GAEP,UAAU,cAAc;GACxB,MAAM,cAAc;GACpB,UAAU;GACV,MAAM,EAAC,IAAI,cAAc,UAAU,KAAI;GACvC;GAEA,WAAW,cAAc;GACzB,YAAY,cAAc;GAC1B,iBAAiB,cAAc;GAE/B,cAAc,KAAA;GAEd,cAAc,WAAW,OAAO;GAChC,eAAe,WAAW,QAAQ;GAElC,gBAAgB,EAAE,KAAK;EACzB;EACA,KAAK,iBAAiB,UAAU;EAChC,KAAK,oCAAoC;EACzC,KAAK,qCAAqC,KAAK;EAC/C,OAAO;CACT;;;;;;;CAQA,eACE,UACA,MAC6B;EAC7B,MAAM,aAAa,KAAK,0BAA0B,QAAQ;EAE1D,IAAI,eAAe,WAAW;EAC9B,IAAI,gBAAgB,WAAW;EAE/B,IAAI,KAAK,cACP,eAAe;GACb,GAAG;GACH,KAAK,KAAK;EACZ;EAEF,IAAI,KAAK,kBACP,eAAe;GACb,GAAG;GACH,eAAe;IACb,GAAG,aAAa;IAChB,eAAe,cACb,KAAK,kBACL,KAAK,cAAc,oBACrB;GACF;EACF;EAEF,IAAI,KAAK,aACP,gBAAgB;GACd,GAAG;GACH,KAAK,KAAK;EACZ;EAEF,IAAI,KAAK,iBACP,gBAAgB;GACd,GAAG;GACH,eAAe;IACb,GAAG,cAAc;IACjB,eAAe,cACb,KAAK,iBACL,KAAK,aAAa,oBACpB;GACF;EACF;EAGF,OAAO,KAAK,kBAAkB;GAC5B,GAAG;GACH,UAAU,WAAW,WAAW;GAChC;GACA;EACF,CAAC;CACH;;;;;CAMA,MAAM,WACJ,UACA,MACsC;EACtC,MAAM,aAAa,KAAK,0BAA0B,QAAQ;EAE1D,MAAM,WAAW,MAAM,YACrB,KAAK,KACL,WAAW,MACX,WAAW,KAAK,IAChB,KAAK,MACL,KAAK,kBACP;EAGA,IAAI,CADiB,WAAW,WAAW,MAAM,QAAQ,GAEvD,OAAO,KAAK,kBAAkB;GAC5B,GAAG;GACH,MAAM;GACN,UAAU,WAAW,WAAW;EAClC,CAAC;EAGH,IAAI,aAAa,WAAW,MAC1B,OAAO;EAGT,OAAO,KAAK,iBAAiB;GAC3B,GAAG;GACH,MAAM;EACR,CAAC;CACH;;;;;;;;;;CAWA,mBACE,UACA,UACA,YAMY;EACZ,MAAM,aAAa,KAAK,sBAAsB,QAAQ;EACtD,IAAI,CAAC,YACH;EAGF,IAAI,WAAW,aAAa,UAAU;GACpC,KAAK,IAAI,QAAQ,kDAAkD;IACjE,UAAU,SAAS;IACnB,mBAAmB;IACnB,iBAAiB,WAAW;GAC9B,CAAC;GACD;EACF;EAEA,IAAI;EAIJ,IAAI,WAAW,SAAS,oBAAoB;GAC1C,qBAAqB,EAAC,IAAI,WAAW,gBAAe;GAIpD,IAAI,WAAW,KAAK,OAAO,mBAAmB,IAC5C,MAAM,IAAI,uBACR;IACE,MAAMA;IACN,SACE;IACF,QAAQC;GACV,GACA,MACF;EAEJ,OAAO,IACL,WAAW,SAAS,uBACpB,WAAW,KAAK,OAAO,QACvB,WAAW,MAAM,SAAS,OAC1B;GAIA,IAAI,KAAK,sBACP,MAAM,IAAI,uBACR;IACE,MAAMD;IACN,SACE;IACF,QAAQC;GACV,GACA,MACF;GAEF,IAAI,CAAC,KAAK,uBAAuB;IAC/B,KAAK,wBAAwB;IAC7B,KAAK,IAAI,OACP,iUAGF;GACF;EACF;EAIA,MAAM,oBAAoB,sBAAsB,WAAW;EAI3D,IACE,KAAK,OAAO,eAAe,KAAA,KAC3B,KAAK,OAAO,WAAW,OAAO,kBAAkB,IAEhD,MAAM,IAAI,uBACR;GACE,MAAMD;GACN,SACE;GACF,QAAQC;EACV,GACA,MACF;EAGF,IAAI,KAAK,OAAO,eAAe,KAAA,GAC7B,KAAK,UAAU;GACb,GAAG,KAAK;GACR,YAAY;EACd,CAAC;EAGH,MAAM,sBAAsB,KAAK,iBAAiB;GAChD,GAAG;GACH,OAAO;GACP,cAAc,KAAK,kBAAkB;EACvC,CAAC;EACD,KAAK,oCAAoC,mBAAmB;EAC5D,KAAK,qCAAqC,KAAK;EAE/C,OAAO;GACL,YAAY;GACZ,OAAO,KAAK,cAAc;EAC5B;CACF;;;;;;;;;;;;CAaA,kBAAkB,YAA6B;EAC7C,IAAI,KAAK,OAAO,eAAe,KAAA,GAAW;GACxC,KAAK,UAAU;IAAC,GAAG,KAAK;IAAQ,YAAY,EAAC,IAAI,WAAW,GAAE;GAAC,CAAC;GAChE;EACF;EACA,IAAI,KAAK,OAAO,WAAW,OAAO,WAAW,IAC3C,MAAM,IAAI,uBACR;GACE,MAAMC;GACN,SACE;GACF,QAAQD;EACV,GACA,MACF;CAEJ;;CAGA,eACE,UACA,UAC+B;EAC/B,OAAO,KAAK,kBAAkB,UAAU,QAAQ;CAClD;;CAGA,gBAAgB,UAA6D;EAC3E,OAAO,KAAK,kBAAkB,QAAQ;CACxC;;;;;;CAOA,iCACE,UACA,UACM;EACN,MAAM,uBAAuB,KAAK,gCAAgC;EAClE,IAAI,CAAC,sBACH;EAEF,IACE,qBAAqB,aAAa,SAAS,YAC3C,qBAAqB,SAAS,SAAS,QACvC,qBAAqB,aAAa,UAElC;EAEF,KAAK,qCAAqC,IAAI;CAChD;CAEA,0BAA0B,OAAsB;EAC9C,IAAI,KAAK,4BAA4B,OACnC;EAEF,KAAK,0BAA0B;EAC/B,KAAK,qCAAqC,IAAI;CAChD;CAEA,iBAAiB,MAA0C;EACzD,MAAM,aACJ,SAAS,eACL,KAAK,wBACL,KAAK;EACX,IAAI,eAAe,KAAA,GACjB;EAEF,KAAK,UAAU;GACb,GAAG,KAAK;GACR,wBAAwB,KAAK,IAC3B,KAAK,OAAO,0BAA0B,GACtC,KAAK,KAAK,IAAI,UAChB;EACF,CAAC;CACH;;CAGA,qBACE,UACyC;EACzC,OAAO,KAAK,sBAAsB,QAAQ;CAC5C;;CAGA,yBACE,UAC6B;EAC7B,OAAO,KAAK,0BAA0B,QAAQ;CAChD;;CAGA,iCAA0E;EACxE,OAAO,KAAK,gCAAgC;CAC9C;CAEA,qCAAkE;EAChE,MAAM,uBAAuB,KAAK,gCAAgC;EAClE,IAAI,CAAC,sBACH,MAAM,IAAI,uBACR;GACE,MAAME;GACN,SACE;GACF,QAAQF;EACV,GACA,MACF;EAEF,OAAO;CACT;;CAGA,gBAA0C;EACxC,OAAO,KAAK;CACd;;;;;;;;;CAUA,kBAIE;EACA,MAAM,mBAAkD,CAAC;EACzD,MAAM,MAAM,KAAK,KAAK;EACtB,IAAI,qBAAqB,KAAK,OAAO;EAErC,KAAK,MAAM,cAAc,KAAK,aAAa,OAAO,GAAG;GACnD,IACE,WAAW,UAAU,eACrB,WAAW,iBAAiB,KAAA,GAE5B;GAEF,IAAI,WAAW,gBAAgB,KAC7B,iBAAiB,KAAK,UAAU;GAElC,qBAAqB,WACnB,oBACA,WAAW,YACb;EACF;EAEA,MAAM,iBACJ,KAAK,OAAO,kBAAkB,KAAA,KAC9B,KAAK,OAAO,iBAAiB;EAC/B,MAAM,yBAAyB,KAAK,OAAO;EAE3C,IACE,2BAA2B,KAAA,KAC3B,yBAAyB,OACzB,uBAAuB,KAAA,GAEvB,OAAO;GACL,kBAAkB,CAAC;GACnB,gBAAgB;GAChB,oBAAoB,KAAK,IACvB,oBACA,sBACF;EACF;EAGF,OAAO;GACL,kBAAkB,iBAAiB,KAAK,uBAAuB;GAC/D;GACA;EACF;CACF;CAEA,kBACE,UACA,UACyC;EACzC,MAAM,aAAa,KAAK,sBAAsB,QAAQ;EAEtD,IAAI,CAAC,YACH;EAIF,IAAI,aAAa,KAAA,KAAa,WAAW,aAAa,UAAU;GAC9D,KAAK,IAAI,QAAQ,8CAA8C;IAC7D,UAAU,SAAS;IACnB,MAAM,SAAS;IACf,mBAAmB;IACnB,iBAAiB,WAAW;GAC9B,CAAC;GACD;EACF;EAEA,KAAK,aAAa,OAAO,WAAW,QAAQ;EAC5C,KAAK,oCAAoC;EACzC,KAAK,qCAAqC,KAAK;EAE/C,OAAO;CACT;CAEA,kBAAkB,YAAkD;EAClE,MAAM,oBAAoB,KAAK,iBAAiB;GAC9C,GAAG;GACH,OAAO;GACP,cAAc,KAAA;EAChB,CAAC;EACD,KAAK,oCAAoC;EACzC,KAAK,qCAAqC,KAAK;EAC/C,OAAO;CACT;;;;;;;;;CAUA,oCAAoC,WAAqC;EACvE,IAAI,WAAW,UAAU,aAAa;GACpC,MAAM,8BACJ,KAAK,gCAAgC;GACvC,IACE,6BAA6B,aAAa,UAAU,YACpD,4BAA4B,SAAS,UAAU,MAE/C;GAEF,IAAI,gCAAgC,KAAA,GAClC;GAEF,KAAK,yBAAyB;IAC5B,UAAU,UAAU;IACpB,MAAM,UAAU;GAClB,CAAC;GACD,KAAK,IAAI,QAAQ,uDAAuD;IACtE,UAAU,UAAU;IACpB,MAAM,UAAU;IAChB,UAAU,UAAU;IACpB,QAAQ;GACV,CAAC;GACD;EACF;EAGA,IADoC,KAAK,gCACrC,CAAA,EAA6B,UAAU,aACzC;EAGF,MAAM,2BAA2B,CAAC,GAAG,KAAK,aAAa,OAAO,CAAC,CAAC,CAC7D,QAAO,eAAc,WAAW,UAAU,WAAW,CAAC,CACtD,KAAK,mCAAmC,CAAC,CACzC,GAAG,CAAC;EACP,KAAK,yBACH,2BACI;GACE,UAAU,yBAAyB;GACnC,MAAM,yBAAyB;EACjC,IACA,KAAA,CACN;EACA,IAAI,0BACF,KAAK,IAAI,QAAQ,uDAAuD;GACtE,UAAU,yBAAyB;GACnC,MAAM,yBAAyB;GAC/B,UAAU,yBAAyB;GACnC,QAAQ;EACV,CAAC;CAEL;CAEA,kCAAiE;EAC/D,MAAM,uBAAuB,KAAK,OAAO;EACzC,IAAI,CAAC,sBACH;EAEF,OAAO,KAAK,sBAAsB,oBAAoB;CACxD;CAEA,sBACE,UAC+B;EAC/B,MAAM,aAAa,KAAK,aAAa,IAAI,SAAS,QAAQ;EAC1D,IAAI,CAAC,YACH;EAEF,IAAI,WAAW,SAAS,SAAS,MAC/B;EAEF,OAAO;CACT;CAEA,0BAA0B,UAAiD;EACzE,MAAM,aAAa,KAAK,sBAAsB,QAAQ;EAEtD,IAAI,CAAC,YACH,MAAM,IAAI,uBACR;GACE,MAAME;GACN,SACE;GACF,QAAQF;EACV,GACA,MACF;EAGF,OAAO;CACT;CAEA,iBAAiB,YAAkD;EACjE,KAAK,aAAa,IAAI,WAAW,UAAU,UAAU;EACrD,OAAO;CACT;CAEA,UAAU,OAAuC;EAC/C,KAAK,SAAS;EACd,OAAO;CACT;CAEA,yBACE,sBACA;EACA,IACE,uBACE,KAAK,OAAO,sBACZ,oBACF,GAEA;EAEF,KAAK,UAAU;GACb,GAAG,KAAK;GACR,sBAAsB,uBAClB,EAAC,GAAG,qBAAoB,IACxB,KAAA;EACN,CAAC;CACH;;;;;;;;;;;CAYA,qCAAqC,OAAgB;EAEnD,IACE,CAF2B,KAAK,gCAE/B,KACD,KAAK,2BAA2B,KAAA,KAChC,CAAC,KAAK,yBACN;GACA,IAAI,KAAK,OAAO,kBAAkB,KAAA,GAChC,KAAK,UAAU;IACb,GAAG,KAAK;IACR,eAAe,KAAA;GACjB,CAAC;GAEH;EACF;EAEA,IAAI,SAAS,KAAK,OAAO,kBAAkB,KAAA,GACzC,KAAK,UAAU;GACb,GAAG,KAAK;GACR,eAAe,KAAK,KAAK,IAAI,KAAK;EACpC,CAAC;CAEL;CAEA,oBAAoB;EAClB,OAAO,KAAK,0BAA0B,KAAA,IAClC,KAAA,IACA,KAAK,KAAK,IAAI,KAAK;CACzB;AACF;AAEA,SAAS,wBACP,GACA,GACA;CACA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,cAAc,EAAE,IAAI;AAC3E;AAEA,SAAS,oCACP,GACA,GACA;CACA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,cAAc,EAAE,IAAI;AAC3E;AAEA,SAAS,WAAW,GAAuB,GAAuB;CAChE,IAAI,MAAM,KAAA,GACR,OAAO;CAET,IAAI,MAAM,KAAA,GACR,OAAO;CAET,OAAO,KAAK,IAAI,GAAG,CAAC;AACtB;AAEA,SAAS,uBACP,GACA,GACA;CACA,OAAO,GAAG,aAAa,GAAG,YAAY,GAAG,SAAS,GAAG;AACvD;AAEA,SAAS,cACP,SACA,gBACA;CACA,IAAI,CAAC,WAAW,CAAC,kBAAkB,eAAe,WAAW,GAC3D;CAGF,MAAM,UAAU,IAAI,IAAI,eAAe,KAAI,WAAU,OAAO,YAAY,CAAC,CAAC;CAC1E,IAAI;CACJ,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAC/C,IAAI,QAAQ,IAAI,IAAI,YAAY,CAAC,GAAG;EAClC,aAAa,CAAC;EACd,SAAS,OAAO;CAClB;CAEF,OAAO;AACT"}

package/out/zero-cache/src/services/view-syncer/cvr-store.d.ts

@@ -52,7 +52,7 @@ export declare class CVRStore {
      *          `undefined`.
      */
     getTTLClock(): Promise<TTLClock | undefined>;
-    putInstance({ version, replicaVersion, lastActive, clientSchema, profileID, ttlClock, }: Pick<CVRSnapshot, 'version' | 'replicaVersion' | 'lastActive' | 'clientSchema' | 'profileID' | 'ttlClock'>): void;
+    putInstance({ version, replicaVersion, lastActive, clientSchema, profileID, pinnedUser, ttlClock, }: Pick<CVRSnapshot, 'version' | 'replicaVersion' | 'lastActive' | 'clientSchema' | 'profileID' | 'pinnedUser' | 'ttlClock'>): void;
     markQueryAsDeleted(version: CVRVersion, queryPatch: QueryPatch): void;
     putQuery(query: QueryRecord): void;
     updateQuery(query: QueryRecord): void;
@@ -109,7 +109,15 @@ export declare class ClientNotFoundError extends ProtocolErrorWithLevel {
 }
 export declare class ConcurrentModificationException extends ProtocolErrorWithLevel {
     readonly name = "ConcurrentModificationException";
-    constructor(expectedVersion: string, actualVersion: string);
+    constructor(detail: string);
+}
+/**
+ * The CVR was pinned to a different user than the one the flushing
+ * view-syncer validated, so that view-syncer's connections can no longer be
+ * trusted: it should stop and let its clients reconnect.
+ */
+export declare class PinnedUserMismatchError extends ConcurrentModificationException {
+    constructor();
 }
 export declare class OwnershipError extends ProtocolErrorWithLevel {
     readonly name = "OwnershipError";

package/out/zero-cache/src/services/view-syncer/cvr-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cvr-store.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/view-syncer/cvr-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAkBjD,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,+CAA+C,CAAC;AAUnF,OAAO,EAAC,sBAAsB,EAAC,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAC,UAAU,EAAE,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAEvE,OAAO,EAAY,KAAK,OAAO,EAAC,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAQ,cAAc,EAAC,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAC,GAAG,EAAE,WAAW,EAAC,MAAM,UAAU,CAAC;AAG/C,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,YAAY,EAGjB,KAAK,UAAU,EAGf,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,WAAW,EAEhB,KAAK,KAAK,EACV,KAAK,SAAS,EAGf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,QAAQ,EAGd,MAAM,gBAAgB,CAAC;AAExB,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAkHF,qBAAa,QAAQ;;IAqEnB,YACE,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,EACjC,qBAAqB,SAA2B,EAChD,eAAe,SAAoB,EACnC,yBAAyB,SAAM,EAAE,qBAAqB;IACtD,YAAY,oBAAa,EAkB1B;IAiBD,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAgC1D;IA+ND,aAAa,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAEtD;IAED,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,CAEjC;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,EAAE,KAAK,GAAG,IAAI,CAE5B;IAED;;;;OAIG;IACH,YAAY,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,QAI3B;IAED;;;;OAIG;IACG,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK1E;IAED;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAajD;IAED,WAAW,CAAC,EACV,OAAO,EACP,cAAc,EACd,UAAU,EACV,YAAY,EACZ,SAAS,EACT,QAAQ,GACT,EAAE,IAAI,CACL,WAAW,EACT,SAAS,GACT,gBAAgB,GAChB,YAAY,GACZ,cAAc,GACd,WAAW,GACX,UAAU,CACb,GAAG,IAAI,CAmBP;IAED,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG,IAAI,CASpE;IAED,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAqBjC;IAED,WAAW,CAAC,KAAK,EAAE,WAAW,QAY7B;IAED;;;;;OAKG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErD;IAED,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAKhE;IAED,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAUvC;IAED,YAAY,CAAC,QAAQ,EAAE,MAAM,QAQ5B;IAED,eAAe,CACb,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,EACnB,MAAM,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,EACpB,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,QAAQ,GAAG,SAAS,EACnC,GAAG,EAAE,MAAM,GACV,IAAI,CAgBN;IAED,iBAAiB,CACf,EAAE,EAAE,UAAU,EACd,YAAY,EAAE,kBAAkB,EAChC,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,UAAU,EACnB,kBAAkB,GAAE,MAAM,EAAO,GAChC,cAAc,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAQ5C;IAEK,oBAAoB,CACxB,EAAE,EAAE,UAAU,EACd,YAAY,EAAE,kBAAkB,EAChC,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,cAAc,EAAE,CAAC,CAiE3B;IAwdD,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;;;;;OAMG;IACG,KAAK,CACT,EAAE,EAAE,UAAU,EACd,sBAAsB,EAAE,UAAU,EAClC,GAAG,EAAE,WAAW,EAChB,eAAe,EAAE,MAAM,EACvB,UAAU,UAAQ,GACjB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAwC/B;IAED;;;;;;;;;OASG;IACH,cAAc,IAAI,IAAI,CASrB;IAED,iBAAiB,IAAI,OAAO,CAE3B;IAED,qDAAqD;IACrD,OAAO,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAErC;IAEK,cAAc,CAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,QAAQ,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,EAAE,CAAC,CAqC5B;CACF;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,mBAAmB,EACvB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,sBAAsB,EAAE,UAAU,GACjC,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,qBAAa,mBAAoB,SAAQ,sBAAsB;IAC7D,YAAY,OAAO,EAAE,MAAM,EAS1B;CACF;AAED,qBAAa,+BAAgC,SAAQ,sBAAsB;IACzE,QAAQ,CAAC,IAAI,qCAAqC;IAElD,YAAY,eAAe,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EASzD;CACF;AAED,qBAAa,cAAe,SAAQ,sBAAsB;IACxD,QAAQ,CAAC,IAAI,oBAAoB;IAEjC,YACE,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,eAAe,EAAE,MAAM,EAcxB;CACF;AAED,qBAAa,wBAAyB,SAAQ,sBAAsB;IAClE,QAAQ,CAAC,IAAI,8BAA8B;IAE3C,YAAY,KAAK,EAAE,OAAO,EAUzB;CACF;AAkBD,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,4BAA4B;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpC,YAAY,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,EAIzD;CACF"}
+{"version":3,"file":"cvr-store.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/view-syncer/cvr-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAkBjD,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,+CAA+C,CAAC;AAUnF,OAAO,EAAC,sBAAsB,EAAC,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAC,UAAU,EAAE,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAEvE,OAAO,EAAY,KAAK,OAAO,EAAC,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAQ,cAAc,EAAC,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAC,GAAG,EAAE,WAAW,EAAC,MAAM,UAAU,CAAC;AAG/C,OAAO,EAML,KAAK,OAAO,EACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,YAAY,EAGjB,KAAK,UAAU,EAGf,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,WAAW,EAEhB,KAAK,KAAK,EACV,KAAK,SAAS,EAGf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,QAAQ,EAGd,MAAM,gBAAgB,CAAC;AAIxB,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AA2HF,qBAAa,QAAQ;;IAqEnB,YACE,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,EACjC,qBAAqB,SAA2B,EAChD,eAAe,SAAoB,EACnC,yBAAyB,SAAM,EAAE,qBAAqB;IACtD,YAAY,oBAAa,EAkB1B;IAiBD,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAgC1D;IAsOD,aAAa,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAEtD;IAED,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,CAEjC;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,EAAE,KAAK,GAAG,IAAI,CAE5B;IAED;;;;OAIG;IACH,YAAY,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,QAI3B;IAED;;;;OAIG;IACG,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK1E;IAED;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAajD;IAED,WAAW,CAAC,EACV,OAAO,EACP,cAAc,EACd,UAAU,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,QAAQ,GACT,EAAE,IAAI,CACL,WAAW,EACT,SAAS,GACT,gBAAgB,GAChB,YAAY,GACZ,cAAc,GACd,WAAW,GACX,YAAY,GACZ,UAAU,CACb,GAAG,IAAI,CAoBP;IAED,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG,IAAI,CASpE;IAED,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAqBjC;IAED,WAAW,CAAC,KAAK,EAAE,WAAW,QAY7B;IAED;;;;;OAKG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErD;IAED,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAKhE;IAED,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAUvC;IAED,YAAY,CAAC,QAAQ,EAAE,MAAM,QAQ5B;IAED,eAAe,CACb,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,EACnB,MAAM,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,EACpB,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,QAAQ,GAAG,SAAS,EACnC,GAAG,EAAE,MAAM,GACV,IAAI,CAgBN;IAED,iBAAiB,CACf,EAAE,EAAE,UAAU,EACd,YAAY,EAAE,kBAAkB,EAChC,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,UAAU,EACnB,kBAAkB,GAAE,MAAM,EAAO,GAChC,cAAc,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAQ5C;IAEK,oBAAoB,CACxB,EAAE,EAAE,UAAU,EACd,YAAY,EAAE,kBAAkB,EAChC,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,cAAc,EAAE,CAAC,CAiE3B;IA6eD,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;;;;;OAMG;IACG,KAAK,CACT,EAAE,EAAE,UAAU,EACd,sBAAsB,EAAE,UAAU,EAClC,GAAG,EAAE,WAAW,EAChB,eAAe,EAAE,MAAM,EACvB,UAAU,UAAQ,GACjB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAwC/B;IAED;;;;;;;;;OASG;IACH,cAAc,IAAI,IAAI,CASrB;IAED,iBAAiB,IAAI,OAAO,CAE3B;IAED,qDAAqD;IACrD,OAAO,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAErC;IAEK,cAAc,CAClB,EAAE,EAAE,UAAU,EACd,QAAQ,EAAE,QAAQ,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,EAAE,CAAC,CAqC5B;CACF;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,mBAAmB,EACvB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,sBAAsB,EAAE,UAAU,GACjC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,qBAAa,mBAAoB,SAAQ,sBAAsB;IAC7D,YAAY,OAAO,EAAE,MAAM,EAS1B;CACF;AAED,qBAAa,+BAAgC,SAAQ,sBAAsB;IACzE,QAAQ,CAAC,IAAI,qCAAqC;IAElD,YAAY,MAAM,EAAE,MAAM,EASzB;CACF;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,+BAA+B;IAC1E,cAEC;CACF;AAED,qBAAa,cAAe,SAAQ,sBAAsB;IACxD,QAAQ,CAAC,IAAI,oBAAoB;IAEjC,YACE,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,eAAe,EAAE,MAAM,EAcxB;CACF;AAiBD,qBAAa,wBAAyB,SAAQ,sBAAsB;IAClE,QAAQ,CAAC,IAAI,8BAA8B;IAE3C,YAAY,KAAK,EAAE,OAAO,EAUzB;CACF;AAqBD,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,4BAA4B;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpC,YAAY,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,EAIzD;CACF"}

package/out/zero-cache/src/services/view-syncer/cvr-store.js

@@ -1,7 +1,7 @@
 import { assert } from "../../../../shared/src/asserts.js";
 import { deepEqual } from "../../../../shared/src/json.js";
 import { sleep } from "../../../../shared/src/sleep.js";
-import { parse } from "../../../../shared/src/valita.js";
+import { parse, test, valita_exports } from "../../../../shared/src/valita.js";
 import { some } from "../../../../shared/src/iterables.js";
 import { astSchema } from "../../../../zero-protocol/src/ast.js";
 import { ClientNotFound, Rehome, SchemaVersionNotSupported } from "../../../../zero-protocol/src/error-kind-enum.js";
@@ -27,6 +27,7 @@ import { CustomKeySet } from "../../../../shared/src/custom-key-set.js";
 import { RowRecordCache } from "./row-record-cache.js";
 import { trace } from "@opentelemetry/api";
 //#region ../zero-cache/src/services/view-syncer/cvr-store.ts
+var pinnedUserSchema = valita_exports.object({ id: valita_exports.string().nullable() });
 var flushCounter = 0;
 var RESULT_ATTRIBUTE = "result";
 var ERROR_KIND_ATTRIBUTE = "error.kind";
@@ -70,7 +71,9 @@ function asQuery(row) {
 			transformationVersion: maybeVersion(row.transformationVersion)
 		};
 	}
-	const ast = astSchema.parse(row.clientAST);
+	const parsed = test(row.clientAST, astSchema);
+	if (!parsed.ok) throw new InvalidClientASTError(row.queryHash, parsed.error);
+	const ast = parsed.value;
 	return row.internal ? {
 		type: "internal",
 		id: row.queryHash,
@@ -191,7 +194,8 @@ var CVRStore = class {
 			clients: {},
 			queries: {},
 			clientSchema: null,
-			profileID: null
+			profileID: null,
+			pinnedUser: null
 		};
 		const [instance, clientsRows, queryRows, desiresRows] = await runTx(this.#db, (tx) => {
 			lc.debug?.(`CVR tx started after ${Date.now() - start} ms`);
@@ -204,6 +208,7 @@ var CVRStore = class {
                  "grantedAt",
                  "clientSchema",
                  "profileID",
+                 "pinnedUser",
                  "deleted",
                  rows."version" as "rowsVersion"
             FROM ${this.#cvr("instances")} AS cvr
@@ -245,11 +250,12 @@ var CVRStore = class {
 			ttlClock: ttlClockFromNumber(0),
 			replicaVersion: null,
 			clientSchema: null,
-			profileID: null
+			profileID: null,
+			pinnedUser: null
 		});
 		else {
 			assert(instance.length === 1, () => `Expected exactly one CVR instance, got ${instance.length}`);
-			const { version, lastActive, ttlClock, replicaVersion, owner, grantedAt, rowsVersion, clientSchema, profileID, deleted } = instance[0];
+			const { version, lastActive, ttlClock, replicaVersion, owner, grantedAt, rowsVersion, clientSchema, profileID, pinnedUser, deleted } = instance[0];
 			if (deleted) throw new ClientNotFoundError("Client has been purged due to inactivity");
 			if (owner !== this.#taskID) {
 				if ((grantedAt ?? 0) > lastConnectTime) throw new OwnershipError(owner, grantedAt, lastConnectTime);
@@ -268,6 +274,7 @@ var CVRStore = class {
 			cvr.ttlClock = ttlClock;
 			cvr.replicaVersion = replicaVersion;
 			cvr.profileID = profileID;
+			cvr.pinnedUser = pinnedUser === null ? null : parse(pinnedUser, pinnedUserSchema);
 			try {
 				cvr.clientSchema = clientSchema === null ? null : parse(clientSchema, clientSchemaSchema, "strip");
 			} catch (e) {
@@ -350,7 +357,7 @@ var CVRStore = class {
 		assert(result.length === 1, () => `Expected exactly one rowsVersion result, got ${result.length}`);
 		return result[0][0];
 	}
-	putInstance({ version, replicaVersion, lastActive, clientSchema, profileID, ttlClock }) {
+	putInstance({ version, replicaVersion, lastActive, clientSchema, profileID, pinnedUser, ttlClock }) {
 		this.#pendingInstanceWrite = (tx, lastConnectTime) => {
 			const change = {
 				clientGroupID: this.#id,
@@ -361,7 +368,8 @@ var CVRStore = class {
 				owner: this.#taskID,
 				grantedAt: lastConnectTime,
 				clientSchema,
-				profileID
+				profileID,
+				pinnedUser
 			};
 			return tx`
         INSERT INTO ${this.#cvr("instances")} ${tx(change)} 
@@ -706,7 +714,13 @@ var CVRStore = class {
         "inactivatedAtMs" = excluded."inactivatedAtMs"
       `;
 	}
-	async #checkVersionAndOwnership(lc, tx, expectedCurrentVersion, lastConnectTime) {
+	/**
+	* Also checks that the CVR has not been pinned to a user other than
+	* `pinnedUser` since it was loaded: the first pin does not change the CVR
+	* version, so the version check alone would let two view-syncers that both
+	* loaded an unpinned CVR pin it to different users in turn.
+	*/
+	async #checkVersionAndOwnership(lc, tx, expectedCurrentVersion, lastConnectTime, pinnedUser) {
 		const start = Date.now();
 		lc.debug?.("checking cvr version and ownership");
 		const expected = versionString(expectedCurrentVersion);
@@ -723,17 +737,19 @@ var CVRStore = class {
         )
         ON CONFLICT ("clientGroupID") DO NOTHING
       `;
-		const result = await tx`SELECT "version", "owner", "grantedAt" FROM ${this.#cvr("instances")}
+		const result = await tx`SELECT "version", "owner", "grantedAt", "pinnedUser"
+        FROM ${this.#cvr("instances")}
         WHERE "clientGroupID" = ${this.#id}
         FOR UPDATE`;
-		const { version, owner, grantedAt } = result.length > 0 ? result[0] : {
+		const { version, owner, grantedAt, pinnedUser: storedPinnedUser = null } = result.length > 0 ? result[0] : {
 			version: EMPTY_CVR_VERSION.stateVersion,
 			owner: null,
 			grantedAt: null
 		};
 		lc.debug?.("checked cvr version and ownership in " + (Date.now() - start) + " ms");
 		if (owner !== this.#taskID && (grantedAt ?? 0) > lastConnectTime) throw new OwnershipError(owner, grantedAt, lastConnectTime);
-		if (version !== expected) throw new ConcurrentModificationException(expected, version);
+		if (storedPinnedUser !== null && storedPinnedUser.id !== pinnedUser?.id) throw new PinnedUserMismatchError();
+		if (version !== expected) throw new ConcurrentModificationException(`Expected ${expected}, got ${version}`);
 	}
 	async #flush(lc, expectedCurrentVersion, cvr, lastConnectTime, verifyNoop) {
 		const stats = {
@@ -755,7 +771,7 @@ var CVRStore = class {
 			}
 		}
 		if (this.#pendingRowRecordUpdates.size === 0 && this.#writes.size === 0 && this.#pendingInstanceWrite === void 0 && this.#pendingQueryUpdates.size === 0 && this.#pendingQueryPartialUpdates.size === 0 && this.#pendingDesireUpdates.size === 0) {
-			if (verifyNoop) await runTx(this.#db, (tx) => this.#checkVersionAndOwnership(lc, tx, expectedCurrentVersion, lastConnectTime), { mode: READ_COMMITTED });
+			if (verifyNoop) await runTx(this.#db, (tx) => this.#checkVersionAndOwnership(lc, tx, expectedCurrentVersion, lastConnectTime, cvr.pinnedUser), { mode: READ_COMMITTED });
 			return null;
 		}
 		this.putInstance(cvr);
@@ -763,7 +779,7 @@ var CVRStore = class {
 		lc.debug?.("flush tx beginning");
 		const results = await runTx(this.#db, async (tx) => {
 			lc.debug?.(`flush tx begun after ${Date.now() - start} ms`);
-			await this.#checkVersionAndOwnership(lc, tx, expectedCurrentVersion, lastConnectTime);
+			await this.#checkVersionAndOwnership(lc, tx, expectedCurrentVersion, lastConnectTime, cvr.pinnedUser);
 			const writeQueries = [];
 			if (this.#pendingInstanceWrite) {
 				writeQueries.push(this.#pendingInstanceWrite(tx, lastConnectTime));
@@ -924,7 +940,7 @@ async function checkVersion(tx, schema, clientGroupID, expectedCurrentVersion) {
     SELECT version FROM ${tx(schema)}.instances 
       WHERE "clientGroupID" = ${clientGroupID}`;
 	const { version } = result.length > 0 ? result[0] : { version: EMPTY_CVR_VERSION.stateVersion };
-	if (version !== expected) throw new ConcurrentModificationException(expected, version);
+	if (version !== expected) throw new ConcurrentModificationException(`Expected ${expected}, got ${version}`);
 }
 var ClientNotFoundError = class extends ProtocolErrorWithLevel {
 	constructor(message) {
@@ -937,14 +953,24 @@ var ClientNotFoundError = class extends ProtocolErrorWithLevel {
 };
 var ConcurrentModificationException = class extends ProtocolErrorWithLevel {
 	name = "ConcurrentModificationException";
-	constructor(expectedVersion, actualVersion) {
+	constructor(detail) {
 		super({
 			kind: Rehome,
-			message: `CVR has been concurrently modified. Expected ${expectedVersion}, got ${actualVersion}`,
+			message: `CVR has been concurrently modified. ${detail}`,
 			origin: ZeroCache
 		}, "warn");
 	}
 };
+/**
+* The CVR was pinned to a different user than the one the flushing
+* view-syncer validated, so that view-syncer's connections can no longer be
+* trusted: it should stop and let its clients reconnect.
+*/
+var PinnedUserMismatchError = class extends ConcurrentModificationException {
+	constructor() {
+		super("Client group was pinned to a different user");
+	}
+};
 var OwnershipError = class extends ProtocolErrorWithLevel {
 	name = "OwnershipError";
 	constructor(owner, grantedAt, lastConnectTime) {
@@ -956,6 +982,16 @@ var OwnershipError = class extends ProtocolErrorWithLevel {
 		}, "info");
 	}
 };
+var InvalidClientASTError = class extends ProtocolErrorWithLevel {
+	name = "InvalidClientASTError";
+	constructor(queryHash, error) {
+		super({
+			kind: SchemaVersionNotSupported,
+			message: `Could not parse AST of query ${queryHash} stored in CVR: ${error}`,
+			origin: ZeroCache
+		}, "warn");
+	}
+};
 var InvalidClientSchemaError = class extends ProtocolErrorWithLevel {
 	name = "InvalidClientSchemaError";
 	constructor(cause) {
@@ -971,6 +1007,7 @@ function cvrErrorKind(e) {
 	if (e instanceof ConcurrentModificationException) return "concurrent_modification";
 	if (e instanceof OwnershipError) return "ownership";
 	if (e instanceof InvalidClientSchemaError) return "invalid_client_schema";
+	if (e instanceof InvalidClientASTError) return "invalid_client_ast";
 	return "error";
 }
 var RowsVersionBehindError = class extends Error {
@@ -984,6 +1021,6 @@ var RowsVersionBehindError = class extends Error {
 	}
 };
 //#endregion
-export { CVRStore, ClientNotFoundError, ConcurrentModificationException, InvalidClientSchemaError, OwnershipError, RowsVersionBehindError, checkVersion };
+export { CVRStore, ClientNotFoundError, ConcurrentModificationException, InvalidClientSchemaError, OwnershipError, PinnedUserMismatchError, RowsVersionBehindError, checkVersion };
 
 //# sourceMappingURL=cvr-store.js.map