@volter/world-core 3.0.38 → 3.0.40

package/dist/network-policy.cjs

@@ -1,6 +1,13 @@
 'use strict';
 
 const WORLD_NETWORK_POLICY_ENV = 'VOLTER_WORLD_NETWORK_POLICY';
+/** Reads only: an `egress` grant admits these; any other method needs `writes`. */
+const READ_METHODS = Object.freeze(['GET', 'HEAD', 'OPTIONS']);
+/** The public build-artifact origins a build-phase World reads without listing them (architecture, "Reads are granted generously"). */
+const PUBLIC_BUILD_READS = Object.freeze([
+  'https://binaries.prisma.sh', 'https://fonts.googleapis.com', 'https://fonts.gstatic.com',
+  'https://index.crates.io', 'https://registry.npmjs.org', 'https://static.crates.io',
+]);
 
 function object(value, keys, label) {
   if (!value || typeof value !== 'object' || Array.isArray(value)
@@ -10,17 +17,37 @@ function object(value, keys, label) {
   return value;
 }
 
+// Decode once, then resolve dot segments. Separators must have been literal on the wire.
+function normalizedPath(path) {
+  if (/\\|%2f|%5c/i.test(path)) return null;
+  let decoded;
+  try { decoded = decodeURIComponent(path); } catch { return null; }
+  if (/[\\\x00-\x1f\x7f]/.test(decoded) || /%[0-9a-f]{2}/i.test(decoded)) return null;
+  const parts = [];
+  for (const segment of decoded.split('/')) {
+    if (segment === '.') continue;
+    if (segment === '..') { if (parts.length > 1) parts.pop(); }
+    else parts.push(segment);
+  }
+  let result = parts.join('/');
+  if (!result.startsWith('/')) result = '/' + result;
+  if ((decoded.endsWith('/.') || decoded.endsWith('/..')) && !result.endsWith('/')) result += '/';
+  return result;
+}
+
 function origins(value) {
-  if (!Array.isArray(value) || value.length > 256) throw new Error('World network egress must be an array of at most 256 exact HTTPS origins');
+  if (!Array.isArray(value) || value.length > 256) throw new Error('World network egress must be an array of at most 256 exact HTTPS origins, exact paths or trailing-slash subtrees');
   const normalized = value.map(origin => {
     if (typeof origin !== 'string' || origin.length > 2048) throw new Error('World network egress origins must be strings');
     let url;
     try { url = new URL(origin); } catch { throw new Error(`Invalid World network origin: ${origin}`); }
-    if (url.protocol !== 'https:' || url.origin !== origin || url.username || url.password
+    const canonical = url.pathname === '/' ? url.origin : url.origin + url.pathname;
+    if (url.protocol !== 'https:' || url.port === '0' || canonical !== origin || url.username || url.password || url.search || url.hash
+        || /[\\*]/.test(origin) || normalizedPath(url.pathname) === null
         || !/^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/.test(url.hostname)
         || url.hostname.split('.').some(label => !label || label.length > 63 || label.startsWith('-') || label.endsWith('-'))
         || /^[\d.]+$/.test(url.hostname) || url.hostname === 'localhost' || url.hostname.endsWith('.localhost')) {
-      throw new Error(`World network requires an exact canonical HTTPS origin: ${origin}`);
+      throw new Error(`World network requires an exact canonical HTTPS origin, path or subtree: ${origin}`);
     }
     return origin;
   });
@@ -28,19 +55,32 @@ function origins(value) {
 }
 
 function normalizeWorldNetwork(value) {
-  const network = object(value, ['egress'], 'World network');
-  return Object.freeze({ egress: origins(network.egress) });
+  const network = object(value, ['egress', 'writes', 'phase', 'passthrough', 'publicReads'], 'World network');
+  const egress = origins(network.egress);
+  const writes = origins(network.writes ?? []);
+  const phase = network.phase ?? 'runtime';
+  if (phase !== 'build' && phase !== 'runtime') throw new Error('World network phase must be build or runtime');
+  if (network.publicReads !== undefined && typeof network.publicReads !== 'boolean') throw new Error('World network publicReads must be a boolean');
+  const publicReads = phase === 'build' && network.publicReads !== false;
+  const passthrough = origins(network.passthrough ?? []);
+  if (passthrough.length && phase !== 'build') throw new Error('World TLS passthrough requires phase: build');
+  for (const origin of passthrough) {
+    if (origin !== new URL(origin).origin || !egress.includes(origin)) throw new Error(`TLS passthrough requires an exact-origin egress grant: ${origin}`);
+    // an opaque tunnel cannot show its method, so it cannot carry a write
+    if (writes.some(grant => new URL(grant).origin === origin)) throw new Error(`TLS passthrough cannot carry a write grant: ${origin}`);
+  }
+  return Object.freeze({ egress, writes, phase, passthrough, publicReads });
 }
 
 function createWorldNetworkPolicy(world, network) {
   if (typeof world !== 'string' || !world || world.length > 256) throw new Error('World network policy requires its World identity');
-  return Object.freeze({ version: 1, world, egress: normalizeWorldNetwork(network).egress });
+  return Object.freeze({ version: 1, world, ...normalizeWorldNetwork(network) });
 }
 
 function parseWorldNetworkPolicy(value) {
-  const policy = object(value, ['version', 'world', 'egress'], 'World network policy');
+  const policy = object(value, ['version', 'world', 'egress', 'writes', 'phase', 'passthrough', 'publicReads'], 'World network policy');
   if (policy.version !== 1) throw new Error('Unsupported World network policy version');
-  return createWorldNetworkPolicy(policy.world, { egress: policy.egress });
+  return createWorldNetworkPolicy(policy.world, { egress: policy.egress, writes: policy.writes, phase: policy.phase, passthrough: policy.passthrough, publicReads: policy.publicReads });
 }
 
 function worldNetworkPolicyFromEnv(env) {
@@ -52,10 +92,67 @@ function worldNetworkPolicyFromEnv(env) {
   return policy;
 }
 
-function allowsWorldNetworkEgress(policy, value) {
+function destination(value, originOnly = false) {
+  if (/\\/.test(String(value).split(/[?#]/, 1)[0])) return null;
+  let url;
+  try { url = new URL(String(value)); } catch { return null; }
+  const path = normalizedPath(url.pathname);
+  return url.protocol === 'https:' && url.port !== '0' && !url.username && !url.password && (path !== null || originOnly) ? { url, path } : null;
+}
+
+function containsGrant(broad, narrow) {
+  const a = destination(broad); const b = destination(narrow);
+  if (!a || !b || a.url.origin !== b.url.origin) return false;
+  if (broad === a.url.origin) return true;
+  if (narrow === b.url.origin) return false;
+  return a.path.endsWith('/') ? b.path.startsWith(a.path) : !b.path.endsWith('/') && b.path === a.path;
+}
+
+function granted(grants, to) {
+  return grants.some(grant => {
+    const allowed = destination(grant);
+    return allowed && to.url.origin === allowed.url.origin && (grant === allowed.url.origin
+      || (to.path !== null && (allowed.path.endsWith('/') ? to.path.startsWith(allowed.path) : to.path === allowed.path)));
+  });
+}
+
+/** Whether `method` to `value` is allowed: reads by `egress`, `writes` or the build phase's public reads; writes only by `writes`. */
+function allowsWorldNetworkEgress(policy, value, method = 'GET') {
+  const to = destination(value, true);
+  if (!to) return false;
+  if (granted(policy.writes ?? [], to)) return true;
+  if (!READ_METHODS.includes(String(method).toUpperCase())) return false;
+  return granted(policy.egress, to) || (policy.phase === 'build' && policy.publicReads === true && PUBLIC_BUILD_READS.includes(to.url.origin));
+}
+
+function worldNetworkUsesPassthrough(policy, value) {
+  const to = destination(value, true);
+  if (!to || policy.phase !== 'build') return false;
+  // public build artifacts tunnel unopened: native clients (Turbopack's next/font on macOS) trust only the OS store
+  if (policy.publicReads === true && PUBLIC_BUILD_READS.includes(to.url.origin) && !granted(policy.writes ?? [], to)) return true;
+  return policy.passthrough?.includes(to.url.origin) === true && policy.egress.includes(to.url.origin);
+}
+
+/** This authority must be mediated per request; CONNECT is only a path to the inspector. */
+function worldNetworkNeedsPathInspection(policy, value) {
   let url;
   try { url = new URL(String(value)); } catch { return false; }
-  return url.protocol === 'https:' && !url.username && !url.password && policy.egress.includes(url.origin);
+  return url.protocol === 'https:' && !worldNetworkUsesPassthrough(policy, url)
+    && ([...policy.egress, ...(policy.writes ?? [])].some(grant => new URL(grant).origin === url.origin)
+      || (policy.phase === 'build' && policy.publicReads === true && PUBLIC_BUILD_READS.includes(url.origin)));
+}
+
+/** Parent ceilings keep the narrower path and cannot create opaque transport permission. */
+function intersectWorldNetwork(own, ceiling) {
+  const left = normalizeWorldNetwork(own); const right = normalizeWorldNetwork(ceiling);
+  const meet = (a, b) => [...new Set(a.flatMap(x => b.flatMap(y => containsGrant(y, x) ? [x] : containsGrant(x, y) ? [y] : [])))].sort();
+  const egress = meet(left.egress, right.egress);
+  const writes = meet(left.writes, right.writes);
+  const passthrough = left.phase === 'build' && right.phase === 'build'
+    ? left.passthrough.filter(origin => right.passthrough.includes(origin) && egress.includes(origin)) : [];
+  // public reads are permission too: only a build ceiling that reads them passes them on
+  const publicReads = left.publicReads && right.publicReads;
+  return normalizeWorldNetwork({ egress, writes, phase: left.phase, passthrough, publicReads });
 }
 
 /** Loopback and private addresses stay inside the machine a World runs on: never refused. */
@@ -80,15 +177,15 @@ function isWorldInternalHost(hostname) {
  * injector does not attach to. Internal addresses pass; strict egress refuses everything else; a
  * published network policy refuses what it does not list. An unreadable policy refuses.
  */
-function worldEgressRefusal(value, env = process.env) {
+function worldEgressRefusal(value, env = process.env, method = 'GET') {
   let url;
   try { url = new URL(String(value)); } catch { return `unparseable destination ${String(value)}`; }
   if (isWorldInternalHost(url.hostname)) return null;
   if (env.VOLTER_TWIN_STRICT_EGRESS === '1' || env.VOLTER_TWIN_STRICT_EGRESS === 'true') return `sealed World refuses untwinned host ${url.hostname}`;
   let policy;
   try { policy = worldNetworkPolicyFromEnv(env); } catch (error) { return `World network policy unreadable (${error.message}); refusing ${url.hostname}`; }
-  if (policy !== undefined && !allowsWorldNetworkEgress(policy, url)) return `World network policy does not allow ${url.origin}`;
+  if (policy !== undefined && !allowsWorldNetworkEgress(policy, url, method)) return `World network policy does not allow ${String(method).toUpperCase()} ${url.origin}`;
   return null;
 }
 
-module.exports = { isWorldInternalHost, worldEgressRefusal, WORLD_NETWORK_POLICY_ENV, normalizeWorldNetwork, createWorldNetworkPolicy, parseWorldNetworkPolicy, worldNetworkPolicyFromEnv, allowsWorldNetworkEgress };
+module.exports = { PUBLIC_BUILD_READS, READ_METHODS, intersectWorldNetwork, worldNetworkNeedsPathInspection, worldNetworkUsesPassthrough, isWorldInternalHost, worldEgressRefusal, WORLD_NETWORK_POLICY_ENV, normalizeWorldNetwork, createWorldNetworkPolicy, parseWorldNetworkPolicy, worldNetworkPolicyFromEnv, allowsWorldNetworkEgress };

package/dist/network-policy.d.cts

@@ -1,10 +1,15 @@
-export interface WorldNetwork { readonly egress: readonly string[] }
+export interface WorldNetwork { readonly egress: readonly string[]; readonly writes?: readonly string[]; readonly phase?: 'build' | 'runtime'; readonly passthrough?: readonly string[]; readonly publicReads?: boolean }
 export interface WorldNetworkPolicy extends WorldNetwork { readonly version: 1; readonly world: string }
 export const WORLD_NETWORK_POLICY_ENV: 'VOLTER_WORLD_NETWORK_POLICY';
 export function normalizeWorldNetwork(value: unknown): WorldNetwork;
 export function createWorldNetworkPolicy(world: string, network: WorldNetwork): WorldNetworkPolicy;
 export function parseWorldNetworkPolicy(value: unknown): WorldNetworkPolicy;
 export function worldNetworkPolicyFromEnv(env: Readonly<Record<string, string | undefined>>): WorldNetworkPolicy | undefined;
-export function allowsWorldNetworkEgress(policy: WorldNetworkPolicy, value: string | URL): boolean;
+export const READ_METHODS: readonly string[];
+export const PUBLIC_BUILD_READS: readonly string[];
+export function allowsWorldNetworkEgress(policy: WorldNetworkPolicy, value: string | URL, method?: string): boolean;
 export function isWorldInternalHost(hostname: string): boolean;
-export function worldEgressRefusal(value: string | URL, env?: Readonly<Record<string, string | undefined>>): string | null;
+export function worldEgressRefusal(value: string | URL, env?: Readonly<Record<string, string | undefined>>, method?: string): string | null;
+export function worldNetworkNeedsPathInspection(policy: WorldNetworkPolicy, value: string | URL): boolean;
+export function worldNetworkUsesPassthrough(policy: WorldNetworkPolicy, value: string | URL): boolean;
+export function intersectWorldNetwork(own: WorldNetwork, ceiling: WorldNetwork): WorldNetwork;

package/dist/src/actions.js

@@ -1,3 +1,4 @@
+import { parseExactJson } from "./exact-json.js";
 // Transaction/action log (scorecard R18) — the semantic correction that separates
 // OBSERVED facts from LOCAL transaction commits.
 //
@@ -297,7 +298,7 @@ export function listActions(service, root) {
     return getActiveWorldStore()
         .readLines(path)
         .filter((line) => line.trim())
-        .map((line) => JSON.parse(line));
+        .map((line) => parseExactJson(line));
 }
 const META = new Set(['id', 'type', 'updatedAt']);
 function projectedField(resource, field) {

package/dist/src/anthropic-wire.d.ts

@@ -36,4 +36,6 @@ export declare function messageSSE(m: Row, extra?: Row, options?: {
     ping?: boolean;
     completeToolInput?: boolean;
 }): string;
+/** An admitted Messages generation failure is an error SSE event, or the native JSON envelope. */
+export declare function messageFailure(error: Row, stream: boolean, requestId?: string): Row | string;
 export {};

package/dist/src/anthropic-wire.js

@@ -134,3 +134,8 @@ export function messageSSE(m, extra = {}, options = {}) {
     send('message_stop', { ...extra });
     return events.join('');
 }
+/** An admitted Messages generation failure is an error SSE event, or the native JSON envelope. */
+export function messageFailure(error, stream, requestId) {
+    const data = { type: 'error', error, ...(stream ? {} : { request_id: requestId ?? null }) };
+    return stream ? `event: error\ndata: ${JSON.stringify(data)}\n\n` : data;
+}

package/dist/src/attestation.d.ts

@@ -0,0 +1,6 @@
+/** Verify simulated keyless attestations using the World's certificate and transparency roots.
+ * World certificate authorities do not run CT; signing time must still be authenticated by a log witness. */
+export declare function verifyAttestationBundle(bundle: unknown, trust: {
+    certificates: readonly string[];
+    logKeys: readonly string[];
+}): Promise<void>;

package/dist/src/attestation.js

@@ -0,0 +1,27 @@
+// Offline bundle verification against explicit World trust anchors. No network or persistent TUF state.
+import { certificateOf, digest, publicKeyOf } from "./signing.js";
+/** Verify simulated keyless attestations using the World's certificate and transparency roots.
+ * World certificate authorities do not run CT; signing time must still be authenticated by a log witness. */
+export async function verifyAttestationBundle(bundle, trust) {
+    if (!trust.certificates.length || !trust.logKeys.length)
+        throw new Error('Attestation trust anchors are required');
+    // B1: protocol libraries are supplied by the pack and load only when the wire is used.
+    const [{ bundleFromJSON }, { TrustedRoot }, { toSignedEntity, toTrustMaterial, Verifier }] = await Promise.all([import('@sigstore/bundle'), import('@sigstore/protobuf-specs'), import('@sigstore/verify')]);
+    const root = TrustedRoot.fromJSON({ mediaType: 'application/vnd.dev.sigstore.trustedroot+json;version=0.1',
+        certificateAuthorities: trust.certificates.map((pem) => {
+            const cert = certificateOf(pem);
+            if (!cert)
+                throw new Error('Invalid attestation certificate root');
+            return { certChain: { certificates: [{ rawBytes: Buffer.from(cert.der).toString('base64') }] }, validFor: { start: cert.notBefore, end: cert.notAfter } };
+        }),
+        tlogs: trust.logKeys.map((pem) => {
+            const key = publicKeyOf(pem);
+            return {
+                hashAlgorithm: 'SHA2_256', logId: { keyId: Buffer.from(digest('sha256', key.der), 'hex').toString('base64') },
+                publicKey: { rawBytes: Buffer.from(key.der).toString('base64'), keyDetails: 'PUBLIC_KEY_DETAILS_UNSPECIFIED' },
+            };
+        }), ctlogs: [], timestampAuthorities: [],
+    });
+    const entity = toSignedEntity(bundleFromJSON(bundle));
+    new Verifier(toTrustMaterial(root), { tlogThreshold: 1, ctlogThreshold: 0 }).verify(entity);
+}

package/dist/src/bytes.d.ts

@@ -1,5 +1,8 @@
 /** The bytes of a gzip member (a SARIF upload, a tarball's contents, a gzipped request body). */
 export declare function gunzip(bytes: Uint8Array): Promise<Uint8Array>;
+/** Compressed HTTP REQUESTS only: async decoding stops at maxOutputLength during inflation.
+ * Return the decoder's own buffer; the request consumes it as a stream without copying it again. */
+export declare function decompress(bytes: Uint8Array, coding: 'gzip' | 'deflate' | 'br' | 'zstd', limit?: number): Promise<Uint8Array>;
 /** Bytes as a gzip member. */
 export declare function gzip(bytes: Uint8Array): Promise<Uint8Array>;
 /** Bytes as a zlib (deflate) member: git's object and pack framing. Reading one back is git/inflate.ts, which also

package/dist/src/bytes.js

@@ -4,6 +4,7 @@
 // `bun -e "typeof CompressionStream"` prints `undefined`), and a local World is served by Bun, so there the builtin is
 // reached the way the kernel reaches every builtin: `process.getBuiltinModule`, at call time, never at import (the seam
 // serve-http.ts's `nodeBuiltin` uses).
+import { DEFAULT_MAX_DECODED_REQUEST_BODY_SIZE, RequestBodyTooLargeError } from "./request-body.js";
 function zlib(what) {
     const get = globalThis.process?.getBuiltinModule;
     if (typeof get !== 'function')
@@ -20,6 +21,22 @@ export async function gunzip(bytes) {
         return streamed(bytes, new DecompressionStream('gzip'));
     return new Uint8Array(zlib('gunzip').gunzipSync(bytes));
 }
+/** Compressed HTTP REQUESTS only: async decoding stops at maxOutputLength during inflation.
+ * Return the decoder's own buffer; the request consumes it as a stream without copying it again. */
+export async function decompress(bytes, coding, limit = DEFAULT_MAX_DECODED_REQUEST_BODY_SIZE) {
+    const builtin = zlib('decompress');
+    const decode = { gzip: builtin.gunzip, deflate: builtin.inflate, br: builtin.brotliDecompress, zstd: builtin.zstdDecompress }[coding];
+    return new Promise((resolve, reject) => {
+        decode(bytes, { maxOutputLength: limit }, (error, body) => {
+            if (error)
+                reject(error.code === 'ERR_BUFFER_TOO_LARGE' ? new RequestBodyTooLargeError() : error);
+            else if (body.byteLength > limit)
+                reject(new RequestBodyTooLargeError());
+            else
+                resolve(body);
+        });
+    });
+}
 /** Bytes as a gzip member. */
 export async function gzip(bytes) {
     if (typeof CompressionStream === 'function')

package/dist/src/changeset.js

@@ -1,3 +1,4 @@
+import { parseExactJson } from "./exact-json.js";
 import { resolveReferences } from "./references.js";
 import { withHistoryLocks } from "./ancestry.js";
 import { captureParentHistory, historyChanges, historyEntries, historyPrefix, readHistoryView } from "./history.js";
@@ -268,7 +269,7 @@ export function parseVerifierExpression(expression, id) {
     let value;
     if (raw) {
         try {
-            value = JSON.parse(raw);
+            value = parseExactJson(raw);
         }
         catch {
             value = raw;

package/dist/src/clickhouse/sql.js

@@ -1,3 +1,4 @@
+import { parseExactJson } from "../exact-json.js";
 // The kernel's ClickHouse® SQL engine — deterministic, over rows a pack supplies (Tinybird's Data Sources and pipe nodes,
 // PostHog's events and persons).
 //
@@ -1442,6 +1443,7 @@ function fnType(e, scope, seen, lambdaTypes) {
         case 'decodeurlformcomponent':
         case 'encodeurlcomponent':
         case 'decodeurlcomponent':
+        case 'extract':
         case 'extracturlparameter':
         case 'jsonextractstring':
         case 'jsonextractraw':
@@ -1543,10 +1545,14 @@ function fnType(e, scope, seen, lambdaTypes) {
         case 'tosecond':
         case 'todayofweek': return 'UInt8';
         case 'todatetime64':
-        case 'todatetime64orzero': {
+        case 'todatetime64orzero':
+        case 'parsedatetime64besteffort':
+        case 'parsedatetime64besteffortornull':
+        case 'parsedatetime64besteffortorzero': {
             const scale = e.args[1]?.k === 'lit' ? Number(e.args[1].v) : 3;
             const tz = e.args[2]?.k === 'lit' ? String(e.args[2].v) : undefined;
-            return tz ? `DateTime64(${scale}, '${tz}')` : `DateTime64(${scale})`;
+            const type = tz ? `DateTime64(${scale}, '${tz}')` : `DateTime64(${scale})`;
+            return name.endsWith('ornull') ? `Nullable(${type})` : type;
         }
         case 'todatetime':
         case 'now':
@@ -1560,7 +1566,8 @@ function fnType(e, scope, seen, lambdaTypes) {
         case 'parsedatetimebesteffortornull': {
             const tzArg = name === 'now' ? a0 : e.args[1];
             const tz = tzArg?.k === 'lit' ? String(tzArg.v) : undefined;
-            return tz ? `DateTime('${tz}')` : 'DateTime';
+            const type = tz ? `DateTime('${tz}')` : 'DateTime';
+            return name.endsWith('ornull') ? `Nullable(${type})` : type;
         }
         case 'now64': return 'DateTime64(3)';
         case 'todate':
@@ -2167,7 +2174,7 @@ function jsonPathValue(json, keys) {
     let cur;
     if (typeof json === 'string') {
         try {
-            cur = JSON.parse(json);
+            cur = parseExactJson(json, (digits) => BigInt(digits));
         }
         catch {
             return undefined;
@@ -2518,6 +2525,23 @@ function evalFunction(e, env) {
             const pad = fill.repeat(Math.ceil((n - s.length) / Math.max(1, fill.length))).slice(0, n - s.length);
             return name === 'leftpad' ? pad + s : s + pad;
         }
+        // ClickHouse string-search-functions#extract: first capturing group, otherwise the whole first match.
+        case 'extract': {
+            argc(2);
+            const haystack = A(0), pattern = A(1);
+            if (haystack === null || pattern === null)
+                return null;
+            if (typeof haystack !== 'string' || typeof pattern !== 'string')
+                return fail('Illegal type of argument of function extract: expected String');
+            let match;
+            try {
+                match = new RegExp(valueToText(pattern)).exec(valueToText(haystack));
+            }
+            catch {
+                return fail('Cannot compile re2: ' + valueToText(pattern));
+            }
+            return match ? (match.length > 1 ? match[1] ?? '' : match[0]) : '';
+        }
         case 'match': {
             argc(2);
             const s = A(0);
@@ -2667,15 +2691,17 @@ function evalFunction(e, env) {
             if (j === null)
                 return null;
             const keys = e.args.slice(1).map((_, i) => A(i + 1));
-            const v = jsonPathValue(typeof j === 'string' ? j : JSON.stringify(j), keys);
+            const v = jsonPathValue(typeof j === 'string' ? j : stringifyJson(j), keys);
             if (name === 'jsonhas')
                 return v === undefined ? 0 : 1;
             if (name === 'jsonextractstring')
                 return typeof v === 'string' ? v : '';
             if (name === 'jsonextractraw')
-                return v === undefined ? '' : JSON.stringify(v);
+                return v === undefined ? '' : stringifyJson(v);
             if (name === 'jsonextractbool')
                 return v === true ? 1 : 0;
+            if (typeof v === 'bigint')
+                return name === 'jsonextractint' ? normInt(v) : Number(v);
             if (typeof v === 'number')
                 return name === 'jsonextractint' ? Math.trunc(v) : v;
             if (typeof v === 'boolean')
@@ -2739,7 +2765,7 @@ function evalFunction(e, env) {
         case 'abs': {
             argc(1);
             const v = A(0);
-            return v === null ? null : Math.abs(asNumber(v));
+            return v === null ? null : typeof v === 'bigint' ? normInt(v < 0n ? -v : v) : Math.abs(asNumber(v));
         }
         case 'intdiv': {
             argc(2);
@@ -2747,6 +2773,12 @@ function evalFunction(e, env) {
             const b = A(1);
             if (a === null || b === null)
                 return null;
+            if (isExactInt(a) && isExactInt(b)) {
+                const divisor = toBigInt(b);
+                if (divisor === 0n)
+                    fail('Division by zero');
+                return normInt(toBigInt(a) / divisor);
+            }
             if (asNumber(b) === 0)
                 fail('Division by zero');
             return Math.trunc(asNumber(a) / asNumber(b));
@@ -2791,7 +2823,6 @@ function evalFunction(e, env) {
         }
         case 'todatetime':
         case 'parsedatetimebesteffort':
-        case 'parsedatetime64besteffort':
         case 'parsedatetimebesteffortornull': {
             argc(1, 2);
             const v = A(0);
@@ -2806,7 +2837,30 @@ function evalFunction(e, env) {
                     return null;
                 }
             }
-            return castDateTime(v, name === 'parsedatetime64besteffort' ? 3 : 0, tz);
+            return castDateTime(v, 0, tz);
+        }
+        // https://clickhouse.com/docs/en/sql-reference/functions/type-conversion-functions#parseDateTime64BestEffort
+        case 'parsedatetime64besteffort':
+        case 'parsedatetime64besteffortornull':
+        case 'parsedatetime64besteffortorzero': {
+            argc(1, 3);
+            const v = A(0);
+            if (v === null)
+                return null;
+            if (typeof v !== 'string')
+                fail('Illegal type of argument of function ' + e.name + ': expected String');
+            const scale = e.args.length > 1 ? asNumber(A(1)) : 3;
+            const tz = e.args.length > 2 ? tzArg(e, 2, env) : undefined;
+            try {
+                return castDateTime(v, scale, tz);
+            }
+            catch (error) {
+                if (name === 'parsedatetime64besteffortornull')
+                    return null;
+                if (name === 'parsedatetime64besteffortorzero')
+                    return new DT(0, scale, tz);
+                throw error;
+            }
         }
         case 'todatetime64':
         case 'todatetime64orzero': {
@@ -3214,7 +3268,7 @@ function evalFunction(e, env) {
                     const arr = A(0);
                     if (arr === null)
                         return null;
-                    return name === 'arraysum' ? arr.reduce((s, x) => s + (asNumber(x) ?? 0), 0) : arr.filter((x) => truth(x) === true).length;
+                    return name === 'arraysum' ? sumArray(arr) : arr.filter((x) => truth(x) === true).length;
                 }
                 return fail(`${e.name}: first argument must be a lambda`);
             }
@@ -3232,7 +3286,7 @@ function evalFunction(e, env) {
             if (name === 'arrayall')
                 return results.every((r) => truth(r) === true) ? 1 : 0;
             if (name === 'arraysum')
-                return results.reduce((s, x) => s + (asNumber(x) ?? 0), 0);
+                return sumArray(results);
             const i = results.findIndex((r) => truth(r) === true);
             return i < 0 ? arrayAt(arrays[0], 0) : arrays[0][i];
         }
@@ -3249,6 +3303,11 @@ function evalFunction(e, env) {
             return fail(`Unknown function ${e.name}`);
     }
 }
+function sumArray(values) {
+    const held = values.filter((value) => value !== null && value !== undefined);
+    return held.every(isExactInt) ? normInt(held.reduce((sum, value) => sum + toBigInt(value), 0n))
+        : held.reduce((sum, value) => sum + (asNumber(value) ?? 0), 0);
+}
 function roundHalfEven(x) {
     const r = Math.round(x);
     return Math.abs(x % 1) === 0.5 && r % 2 !== 0 ? r - 1 : r;
@@ -3498,13 +3557,13 @@ const SCALAR_FUNCTIONS = new Set([
     'arraypushback', 'arraypushfront', 'arrayreverse', 'arrayreversesort', 'arrayslice', 'arraysort', 'arraystringconcat', 'arraysum',
     'assumenotnull', 'base64decode', 'base64encode', 'ceil', 'ceiling', 'char_length', 'coalesce', 'concat', 'cutquerystring', 'date_bin',
     'date_diff', 'datediff', 'decodeurlcomponent', 'decodeurlformcomponent', 'divide', 'domain', 'domainwithoutwww', 'empty',
-    'encodeurlcomponent', 'encodeurlformcomponent', 'endswith', 'equals', 'extracturlparameter', 'extracturlparameternames', 'floor', 'formatdatetime',
+    'encodeurlcomponent', 'encodeurlformcomponent', 'endswith', 'equals', 'extract', 'extracturlparameter', 'extracturlparameternames', 'floor', 'formatdatetime',
     'mapcontains', 'mapcontainskey', 'mapfilter', 'mapkeys', 'mapvalues',
     'fromunixtimestamp', 'fromunixtimestamp64micro', 'fromunixtimestamp64milli', 'fromunixtimestamp64nano', 'greatest', 'has', 'hasall',
     'hasany', 'hex', 'identity', 'if', 'ifnull', 'indexof', 'intdiv', 'isnotnull', 'isnull', 'jsonextractbool', 'jsonextractfloat',
     'jsonextractint', 'jsonextractraw', 'jsonextractstring', 'jsonhas', 'lcase', 'least', 'leftpad', 'length', 'lengthutf8', 'locate',
     'lower', 'lowerutf8', 'ltrim', 'match', 'materialize', 'mid', 'minus', 'modulo', 'multiif', 'multiply', 'notempty', 'notequals', 'now',
-    'now64', 'nullif', 'parsedatetime64besteffort', 'parsedatetimebesteffort', 'parsedatetimebesteffortornull', 'path', 'plus',
+    'now64', 'nullif', 'parsedatetime64besteffort', 'parsedatetime64besteffortornull', 'parsedatetime64besteffortorzero', 'parsedatetimebesteffort', 'parsedatetimebesteffortornull', 'path', 'plus',
     'position', 'pow', 'power', 'range', 'replace', 'replaceall', 'replaceone', 'replaceregexpall', 'replaceregexpone', 'reverse',
     'rightpad', 'round', 'rtrim', 'splitbychar', 'splitbystring', 'sqrt', 'startswith', 'substr', 'substring', 'subtractdays',
     'subtracthours', 'subtractminutes', 'subtractmonths', 'subtractseconds', 'subtractweeks', 'subtractyears', 'time_bucket',
@@ -3521,7 +3580,7 @@ const INTERVAL_FUNCTIONS = new Set(['millisecond', 'second', 'minute', 'hour', '
 const STRING_FUNCTIONS = new Set([
     'tostring', 'concat', 'replace', 'replaceall', 'replaceone', 'replaceregexpall', 'replaceregexpone', 'lower', 'upper', 'lowerutf8',
     'upperutf8', 'substring', 'substr', 'trim', 'trimboth', 'trimleft', 'trimright', 'encodeurlformcomponent', 'decodeurlformcomponent',
-    'encodeurlcomponent', 'decodeurlcomponent', 'extracturlparameter', 'jsonextractstring', 'jsonextractraw', 'formatdatetime', 'domain',
+    'encodeurlcomponent', 'decodeurlcomponent', 'extract', 'extracturlparameter', 'jsonextractstring', 'jsonextractraw', 'formatdatetime', 'domain',
     'domainwithoutwww', 'path', 'cutquerystring', 'leftpad', 'rightpad', 'base64encode', 'base64decode', 'hex', 'totypename',
 ]);
 export function isKnownFunction(name) {