orez-sync-cf-host 0.11.7 → 0.12.0

package/README.md

@@ -5,19 +5,27 @@ engine. The package exposes a consumer integration surface (`createSyncWorker`,
 `createSyncDurableObject`) and a harness deployment built
 from `src/harness-worker.ts`. Consumers provide a JSON Zero schema, application
 DDL/seed initializer, normalized-claims authenticator, an
-`orez-sync-executor` mutator registry, and an optional row-visibility hook.
-
-The Worker authenticates and authorizes at the consumer edge, then forwards normalized claims
-inside the binding request body, where request-header observability cannot record
-them. It never logs tokens, mutation arguments, or row contents. Pull runs
-`engine_handle_pull` inside `transactionSync`; local push delegates validation,
-replay, LMID advancement, CRUD, and committed effects to `orez-sync-executor`
-inside `ctx.storage.transaction`. Every SQL cursor is materialized before an
-await. Mutators may await only their application transaction operations;
-timers, fetches, and other external work belong in
+`orez-sync-executor` mutator registry or delegated push route, and the app's
+ordinary Zero `defineQueries` registry.
+
+The Worker authenticates and authorizes at the consumer edge, then forwards
+normalized claims inside the binding request body, where request-header
+observability cannot record them. It never logs tokens, mutation arguments, or
+row contents. Pull runs `engine_handle_query_pull` inside `transactionSync`;
+local push delegates validation, replay, LMID advancement, CRUD, and committed
+effects to `orez-sync-executor` inside `ctx.storage.transaction`. Every SQL
+cursor is materialized before an await. Mutators may await only their
+application transaction operations; timers, fetches, and other external work
+belong in
 `ctx.defer`, which runs only after commit. Application failures use the
 required second transaction to advance the LMID marker.
 
+Every pull is query-driven. Set `config.queries` to the same registry used by
+the client. The host resolves desired named queries in-process and passes
+authenticated claims as their context, so permission scoping remains inside the
+query definitions. Membership-driven puts and dels keep pull work proportional
+to query results without projecting the full namespace.
+
 Transaction-query `ILIKE` folding is ASCII-only on Durable Object SQLite;
 non-ASCII case pairs can diverge from PostgreSQL.
 
@@ -154,7 +162,7 @@ convergence.
 sockets, durable database size, engine watermark/floor, and aggregate counters.
 After the configured idle gap (5 seconds in the harness deployment), the local
 deterministic model resets in-memory state and changes boot ID while retaining
-SQLite state and sockets. This models the harness/cf idle-teardown pattern; it
+SQLite state and sockets. This models the harness idle-teardown pattern; it
 does not claim that a real platform eviction happens on a 5-second schedule.
 
 ## Authenticated operator controls
@@ -224,8 +232,8 @@ A successful delegated mutation response has a hard causality contract: its
 committed application effects must already be readable from the configured
 upstream `/changes` feed before the application worker returns. The sync host
 then ingests through those effects, journals the acknowledged LMID after them,
-and only then returns the push response. This keeps every capped change-log
-prefix ordered so an acknowledgement cannot reach a client before its effects.
+and only then returns the push response. This keeps change-log order intact so
+an acknowledgement cannot reach a client before its effects.
 Chat and Soot use an application-to-data service path that provides this
 ordering today. A future topology that cannot provide it must extend the
 delegated response with an upstream watermark receipt and make the host ingest

package/dist/config.d.ts

@@ -1,4 +1,3 @@
-import type { PullCaps, SyncHostConfig, SyncHostEnv } from './types.js';
+import type { SyncHostConfig, SyncHostEnv } from './types.js';
 import type { Schema } from '@rocicorp/zero';
-export declare function validatePullCaps(caps: PullCaps): PullCaps;
 export declare function validateSyncHostConfig<Env extends SyncHostEnv, S extends Schema = Schema>(config: SyncHostConfig<Env, S>): SyncHostConfig<Env, S>;

package/dist/config.js

@@ -1,9 +1,3 @@
-export function validatePullCaps(caps) {
-    if (!Number.isSafeInteger(caps.maxChangeRows) || caps.maxChangeRows < 1) {
-        throw new TypeError('caps.maxChangeRows must be a positive safe integer');
-    }
-    return caps;
-}
 export function validateSyncHostConfig(config) {
     if (typeof config.authorizeWake !== 'function') {
         throw new TypeError('sync host config authorizeWake is required');
@@ -14,6 +8,9 @@ export function validateSyncHostConfig(config) {
     if (typeof config.authorize !== 'function') {
         throw new TypeError('sync host config authorize is required');
     }
+    if (!config.queries || typeof config.queries !== 'object') {
+        throw new TypeError("sync host config queries is required: pass the app's Zero query registry (defineQueries result)");
+    }
     const hasMutators = config.mutators !== undefined;
     const hasDelegate = config.mutateUrl !== undefined;
     if (hasMutators === hasDelegate) {

package/dist/generated/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sync-wasm",
   "type": "module",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "license": "MIT",
   "files": [
     "sync_wasm_bg.wasm",

package/dist/generated/sync_wasm.d.ts

@@ -63,12 +63,7 @@ export function engine_finalize(db: any, client_group_id: string, client_id: str
 export function engine_finalize_snapshot_generation(db: any, schema: any, generation: string, watermark: string): any;
 
 /**
- * Production pull entry. The TypeScript host owns `transactionSync`.
- */
-export function engine_handle_pull(db: any, schema: any, visibility: any, caps: any, retain_changes: string, body: any, user_id: string): any;
-
-/**
- * Query-aware pull entry point. Desired-query ASTs are already resolved and
+ * Production pull entry point. Desired-query ASTs are already resolved and
  * validated by the consumer host before crossing this boundary.
  */
 export function engine_handle_query_pull(db: any, schema: any, retain_changes: string, body: any, user_id: string): any;
@@ -128,7 +123,6 @@ export interface InitOutput {
     readonly engine_compile_query: (a: any, b: any, c: any) => [number, number, number];
     readonly engine_finalize: (a: any, b: number, c: number, d: number, e: number, f: number, g: number) => [number, number];
     readonly engine_finalize_snapshot_generation: (a: any, b: any, c: number, d: number, e: number, f: number) => [number, number, number];
-    readonly engine_handle_pull: (a: any, b: any, c: any, d: any, e: number, f: number, g: any, h: number, i: number) => [number, number, number];
     readonly engine_handle_query_pull: (a: any, b: any, c: number, d: number, e: any, f: number, g: number) => [number, number, number];
     readonly engine_init_query_schema: (a: any) => [number, number];
     readonly engine_init_schema: (a: any, b: any) => [number, number];

package/dist/generated/sync_wasm.js

@@ -197,30 +197,7 @@ export function engine_finalize_snapshot_generation(db, schema, generation, wate
 }
 
 /**
- * Production pull entry. The TypeScript host owns `transactionSync`.
- * @param {any} db
- * @param {any} schema
- * @param {any} visibility
- * @param {any} caps
- * @param {string} retain_changes
- * @param {any} body
- * @param {string} user_id
- * @returns {any}
- */
-export function engine_handle_pull(db, schema, visibility, caps, retain_changes, body, user_id) {
-    const ptr0 = passStringToWasm0(retain_changes, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ptr1 = passStringToWasm0(user_id, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len1 = WASM_VECTOR_LEN;
-    const ret = wasm.engine_handle_pull(db, schema, visibility, caps, ptr0, len0, body, ptr1, len1);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
-    }
-    return takeFromExternrefTable0(ret[0]);
-}
-
-/**
- * Query-aware pull entry point. Desired-query ASTs are already resolved and
+ * Production pull entry point. Desired-query ASTs are already resolved and
  * validated by the consumer host before crossing this boundary.
  * @param {any} db
  * @param {any} schema
@@ -512,7 +489,7 @@ function __wbg_get_imports() {
             const ret = Object.entries(arg0);
             return ret;
         },
-        __wbg_exec_0b4e8f9e7a8c0e02: function() { return handleError(function (arg0, arg1, arg2, arg3) {
+        __wbg_exec_58f139058b7f1498: function() { return handleError(function (arg0, arg1, arg2, arg3) {
             arg0.exec(getStringFromWasm0(arg1, arg2), arg3);
         }, arguments); },
         __wbg_get_507a50627bffa49b: function(arg0, arg1) {
@@ -622,7 +599,7 @@ function __wbg_get_imports() {
         __wbg_prototypesetcall_4770620bbe4688a0: function(arg0, arg1, arg2) {
             Uint8Array.prototype.set.call(getArrayU8FromWasm0(arg0, arg1), arg2);
         },
-        __wbg_query_61b60d4aa0a8eccc: function() { return handleError(function (arg0, arg1, arg2, arg3) {
+        __wbg_query_03a8dbd1d5cf6385: function() { return handleError(function (arg0, arg1, arg2, arg3) {
             const ret = arg0.query(getStringFromWasm0(arg1, arg2), arg3);
             return ret;
         }, arguments); },

package/dist/generated/sync_wasm_bg.js

@@ -195,30 +195,7 @@ export function engine_finalize_snapshot_generation(db, schema, generation, wate
 }
 
 /**
- * Production pull entry. The TypeScript host owns `transactionSync`.
- * @param {any} db
- * @param {any} schema
- * @param {any} visibility
- * @param {any} caps
- * @param {string} retain_changes
- * @param {any} body
- * @param {string} user_id
- * @returns {any}
- */
-export function engine_handle_pull(db, schema, visibility, caps, retain_changes, body, user_id) {
-    const ptr0 = passStringToWasm0(retain_changes, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ptr1 = passStringToWasm0(user_id, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len1 = WASM_VECTOR_LEN;
-    const ret = wasm.engine_handle_pull(db, schema, visibility, caps, ptr0, len0, body, ptr1, len1);
-    if (ret[2]) {
-        throw takeFromExternrefTable0(ret[1]);
-    }
-    return takeFromExternrefTable0(ret[0]);
-}
-
-/**
- * Query-aware pull entry point. Desired-query ASTs are already resolved and
+ * Production pull entry point. Desired-query ASTs are already resolved and
  * validated by the consumer host before crossing this boundary.
  * @param {any} db
  * @param {any} schema
@@ -507,7 +484,7 @@ export function __wbg_entries_015dc610cd81ede0(arg0) {
     const ret = Object.entries(arg0);
     return ret;
 }
-export function __wbg_exec_0b4e8f9e7a8c0e02() { return handleError(function (arg0, arg1, arg2, arg3) {
+export function __wbg_exec_58f139058b7f1498() { return handleError(function (arg0, arg1, arg2, arg3) {
     arg0.exec(getStringFromWasm0(arg1, arg2), arg3);
 }, arguments); }
 export function __wbg_get_507a50627bffa49b(arg0, arg1) {
@@ -617,7 +594,7 @@ export function __wbg_next_71f2aa1cb3d1e37e() { return handleError(function (arg
 export function __wbg_prototypesetcall_4770620bbe4688a0(arg0, arg1, arg2) {
     Uint8Array.prototype.set.call(getArrayU8FromWasm0(arg0, arg1), arg2);
 }
-export function __wbg_query_61b60d4aa0a8eccc() { return handleError(function (arg0, arg1, arg2, arg3) {
+export function __wbg_query_03a8dbd1d5cf6385() { return handleError(function (arg0, arg1, arg2, arg3) {
     const ret = arg0.query(getStringFromWasm0(arg1, arg2), arg3);
     return ret;
 }, arguments); }

package/dist/host.js

@@ -1,11 +1,11 @@
 import { DurableObject } from 'cloudflare:workers';
 import { createSyncExecutor } from 'orez-sync-executor/core';
 import { createSocketHost } from 'orez-sync-executor/realtime';
-import { validatePullCaps, validateSyncHostConfig } from './config.js';
+import { validateSyncHostConfig } from './config.js';
 import { createQueryCompiler } from './query-compiler.js';
 import { resolveQueryPatch } from './query-patch.js';
 import { decodeSqlParams, SqlStorageDirect, SqlStorageMutatorTransaction, SqlStorageSyncDb, } from './sql-storage-adapter.js';
-import { engine_authorize_realtime_subscription, engine_apply_snapshot_changes, engine_apply_snapshot_page, engine_apply_upstream, engine_begin_snapshot_generation, engine_finalize, engine_finalize_snapshot_generation, engine_handle_pull, engine_handle_query_pull, engine_init_query_schema, engine_init_schema, engine_invalidate, engine_memory_bytes, engine_preflight, engine_prune, engine_push_validate, engine_read_snapshot_progress, engine_state, engine_version, } from './wasm.js';
+import { engine_authorize_realtime_subscription, engine_apply_snapshot_changes, engine_apply_snapshot_page, engine_apply_upstream, engine_begin_snapshot_generation, engine_finalize, engine_finalize_snapshot_generation, engine_handle_query_pull, engine_init_query_schema, engine_init_schema, engine_invalidate, engine_memory_bytes, engine_preflight, engine_prune, engine_push_validate, engine_read_snapshot_progress, engine_state, engine_version, } from './wasm.js';
 import { IngestBreakerError, IngestCircuitBreaker, retryDelayMs, shouldRetryDelegatedPush, } from './write-safeguards.js';
 const NAMESPACE_HEADER = 'x-orez-sync-namespace';
 const UPSTREAM_PATH_HEADER = 'x-orez-sync-upstream-path';
@@ -16,10 +16,6 @@ const UPSTREAM_PATH_HEADER = 'x-orez-sync-upstream-path';
 const IDENTITY_HEADER = 'x-orez-sync-identity';
 const DEFAULT_SNAPSHOT_PAGE_ROWS = 2_000;
 const MIN_SNAPSHOT_PAGE_ROWS = 100;
-const DEFAULT_CAPS = {
-    maxChangeRows: 10_000,
-    maxChangeBytes: 2_000_000,
-};
 function freshCounters() {
     return {
         pulls: 0,
@@ -90,28 +86,6 @@ async function requestObject(request) {
         throw requestError('request body must be a JSON object');
     return value;
 }
-// clients always ship their desired queries and treat the server's got ack as
-// authoritative. the query-aware engine acks through its own tracking; a
-// non-query-aware host syncs every visible row, so its ack is an echo of the
-// hash-level desired delta in the same response that carries the rows.
-function withGotQueriesAck(body, queryAware, response) {
-    if (queryAware)
-        return response;
-    const queries = body.queries;
-    if (!queries || typeof queries.version !== 'number' || !Array.isArray(queries.patch)) {
-        return response;
-    }
-    return {
-        ...response,
-        gotQueries: {
-            version: queries.version,
-            patch: queries.patch.map((op) => {
-                const entry = op;
-                return entry.op === 'put' ? { op: 'put', hash: entry.hash } : op;
-            }),
-        },
-    };
-}
 function routeAfterNamespace(pathname) {
     const [, , ...parts] = pathname.split('/');
     return `/${parts.join('/')}`;
@@ -269,7 +243,6 @@ export function createSyncDurableObject(config) {
     validateSyncHostConfig(config);
     const compileQuery = createQueryCompiler(config.schema);
     const defaultRetainChanges = String(config.retainChanges ?? 4_096);
-    const caps = validatePullCaps({ ...DEFAULT_CAPS, ...config.caps });
     const idleTeardownMs = config.idleTeardownMs ?? 5_000;
     // A CF fan-out wakes every client into an HTTP pull. Give concurrent writer
     // requests a real batching window so a storm burst creates one pull wave.
@@ -308,7 +281,6 @@ export function createSyncDurableObject(config) {
         // during the replay wait for it instead of racing past into an empty hub.
         #realtimeReady = null;
         #ingestPromise = null;
-        #queryPullLocks = new Map();
         #recordingIngestBillable = false;
         #ingestBreaker = new IngestCircuitBreaker({
             budgetRows: ingestBudgetRows,
@@ -384,8 +356,7 @@ export function createSyncDurableObject(config) {
                         this.#ingestBreaker.restore(ingestBreakerReason, Number(this.#controlGet('ingestBreakerRetryAt')), Number(this.#controlGet('ingestBreakerTrips')));
                     }
                     this.#wasm(() => engine_init_schema(this.#engineDb, config.schema));
-                    if (config.queryAware || config.resolveQueries)
-                        this.#wasm(() => engine_init_query_schema(this.#engineDb));
+                    this.#wasm(() => engine_init_query_schema(this.#engineDb));
                 });
             });
         }
@@ -402,22 +373,6 @@ export function createSyncDurableObject(config) {
             this.#counters.wasmBoundaryCalls++;
             return call();
         }
-        async #acquireQueryPullLock(clientGroupID) {
-            const previous = this.#queryPullLocks.get(clientGroupID);
-            let release;
-            const current = new Promise((resolve) => {
-                release = resolve;
-            });
-            this.#queryPullLocks.set(clientGroupID, current);
-            if (previous)
-                await previous;
-            return () => {
-                release();
-                if (this.#queryPullLocks.get(clientGroupID) === current) {
-                    this.#queryPullLocks.delete(clientGroupID);
-                }
-            };
-        }
         #simulateIdleTeardown(now) {
             if (this.#lastRequestAt > 0 && now - this.#lastRequestAt >= idleTeardownMs) {
                 this.#bootID = crypto.randomUUID();
@@ -438,37 +393,10 @@ export function createSyncDurableObject(config) {
             }
             this.#lastRequestAt = now;
         }
-        #visibility(claims) {
-            if (!config.visibility || !this.#visibilityEnabled())
-                return null;
-            return {
-                rowLocal: typeof config.visibility.rowLocal === 'function'
-                    ? config.visibility.rowLocal(claims)
-                    : config.visibility.rowLocal,
-                filters: Object.keys(config.schema.tables).flatMap((table) => {
-                    const filter = config.visibility?.filter(table, claims);
-                    return filter
-                        ? [
-                            filter.kind === 'expression'
-                                ? { kind: 'expression', table, expression: filter.expression }
-                                : {
-                                    kind: 'raw',
-                                    table,
-                                    sql: filter.sql,
-                                    params: [...(filter.params ?? [])],
-                                },
-                        ]
-                        : [];
-                }),
-            };
-        }
-        // the admin-set namespace knobs (writer, visibility, query-aware,
-        // retention) live in _zsync_host_control, NOT in instance fields: a real
-        // eviction recreates this instance, and an in-memory override silently
-        // reverting to the config default mid-run turns a query-aware namespace
-        // back into a baseline one — the client keeps re-sending its desired-query
-        // patch, the host ignores it, and every pull answers {unchanged:true}
-        // forever.
+        // the admin-set namespace knobs (writer, retention) live in
+        // _zsync_host_control, NOT in instance fields: a real eviction recreates
+        // this instance, and an in-memory override silently reverting to the
+        // config default mid-run changes namespace behavior under the client.
         #controlGet(key) {
             const row = this.#directSql.query('SELECT value FROM _zsync_host_control WHERE key = ?', [key])[0];
             return row?.value ?? null;
@@ -500,14 +428,6 @@ export function createSyncDurableObject(config) {
         #writerEnabled() {
             return this.#controlGet('writerEnabled') === '1';
         }
-        #visibilityEnabled() {
-            const value = this.#controlGet('visibilityEnabled');
-            return value === null ? (config.visibilityEnabled ?? false) : value === '1';
-        }
-        #queryAwareOverride() {
-            const value = this.#controlGet('queryAwareOverride');
-            return value === null ? null : value === '1';
-        }
         #retainChanges() {
             return this.#controlGet('retainChanges') ?? defaultRetainChanges;
         }
@@ -997,83 +917,47 @@ export function createSyncDurableObject(config) {
             let body;
             try {
                 body = await requestObject(request);
-                const queryAware = this.#queryAwareOverride() ??
-                    (typeof config.queryAware === 'function'
-                        ? config.queryAware(claims)
-                        : (config.queryAware ?? Boolean(config.resolveQueries)));
-                const transformVersion = queryAware
-                    ? typeof config.queryTransformVersion === 'function'
-                        ? config.queryTransformVersion(claims)
-                        : (config.queryTransformVersion ?? 0)
-                    : 0;
+                const transformVersion = typeof config.queryTransformVersion === 'function'
+                    ? config.queryTransformVersion(claims)
+                    : (config.queryTransformVersion ?? 0);
                 if (!Number.isSafeInteger(transformVersion) || transformVersion < 0) {
                     throw new TypeError('queryTransformVersion must be a non-negative safe integer');
                 }
-                // The group lock exists to keep two desired-query patches from being
-                // applied out of arrival order when one of them is slow to resolve.
-                // A pull carrying no patch applies nothing, and it reads membership
-                // inside transactionSync, which is already atomic against whichever
-                // patch commits around it. Holding the lock for those pulls only makes
-                // an unchanged warm pull wait out somebody else's query-resolution round
-                // trip to the application, which is the head-of-line blocking behind
-                // the pull tail: a client polls far more often than it changes what it
-                // wants, so almost every pull in flight is patch-free.
-                const releaseQueryPull = queryAware && config.resolveQueries && body.queries
-                    ? await this.#acquireQueryPullLock(typeof body.clientGroupID === 'string' ? body.clientGroupID : '')
-                    : null;
                 let response;
-                try {
-                    if (queryAware && body.queries) {
-                        const queries = body.queries;
-                        if (Array.isArray(queries.patch)) {
-                            // matches the browser host: a query-aware namespace with no
-                            // resolver refuses the patch (400) instead of crashing (500).
-                            // #queryAwareOverride can force queryAware on, so this is
-                            // reachable even though validateSyncHostConfig passes.
-                            if (!config.resolveQueries) {
-                                throw requestError('query put requires a server-resolved named query');
-                            }
-                            // resolveQueries may be async and needs `env` (a consumer can
-                            // delegate the transform to its app's real synced-queries
-                            // endpoint over an app service binding — authenticate runs in the
-                            // worker isolate, but the query loop runs here in the DO, so the
-                            // binding must come from the DO's own env, not a shared global).
-                            const patch = await resolveQueryPatch(queries.patch, (requests) => config.resolveQueries(requests, claims, this.env), transformVersion, requestError);
-                            body = { ...body, queries: { ...queries, patch } };
-                        }
-                    }
-                    if (queryAware) {
-                        body = { ...body, _serverQueryTransformVersion: transformVersion };
+                {
+                    const queries = body.queries;
+                    if (queries && Array.isArray(queries.patch)) {
+                        // named queries resolve in-process against the app's ordinary
+                        // Zero registry, synchronously: patch application order is
+                        // arrival order by construction, with no cross-request await
+                        // between resolution and the engine transaction.
+                        const patch = resolveQueryPatch(queries.patch, config.queries, claims, transformVersion, requestError);
+                        body = { ...body, queries: { ...queries, patch } };
                     }
+                    body = { ...body, _serverQueryTransformVersion: transformVersion };
                     const clientID = typeof body.clientID === 'string' ? body.clientID : '';
                     this.#pulling.add(clientID);
                     try {
                         const txStarted = performance.now();
                         const duringFault = this.#takeFault('pull_during_tx');
                         response = this.ctx.storage.transactionSync(() => {
-                            const result = this.#wasm(() => queryAware
-                                ? engine_handle_query_pull(this.#engineDb, config.schema, this.#retainChanges(), body, claims.userID)
-                                : engine_handle_pull(this.#engineDb, config.schema, this.#visibility(claims), caps, this.#retainChanges(), body, claims.userID));
+                            const result = this.#wasm(() => engine_handle_query_pull(this.#engineDb, config.schema, this.#retainChanges(), body, claims.userID));
                             if (duringFault)
                                 throw this.#faultError(duringFault, 'pull_during_tx');
                             return result;
                         });
                         transactionMs = performance.now() - txStarted;
-                        response = withGotQueriesAck(body, queryAware, response);
                     }
                     finally {
                         this.#pulling.delete(clientID);
                     }
                 }
-                finally {
-                    releaseQueryPull?.();
-                }
                 const afterPullFault = this.#takeFault('pull_after_commit');
                 if (afterPullFault)
                     throw this.#faultError(afterPullFault, 'pull_after_commit');
                 const patch = Array.isArray(response.rowsPatch) ? response.rowsPatch : [];
                 const queriesBody = body.queries;
-                const queryPuts = queryAware && Array.isArray(queriesBody?.patch)
+                const queryPuts = Array.isArray(queriesBody?.patch)
                     ? queriesBody.patch.filter((entry) => entry?.op === 'put').length
                     : 0;
                 this.#counters.queryRecompilations += queryPuts;
@@ -1519,20 +1403,6 @@ export function createSyncDurableObject(config) {
                 this.ctx.abort('admin requested durable object restart');
                 return json({ ok: true, bootID: this.#bootID });
             }
-            if (route === '/admin/visibility') {
-                return request.json().then((body) => {
-                    const enabled = Boolean(body.enabled);
-                    this.#controlSet('visibilityEnabled', enabled ? '1' : '0');
-                    return json({ ok: true, enabled });
-                });
-            }
-            if (route === '/admin/query-aware') {
-                return request.json().then((body) => {
-                    const enabled = Boolean(body.enabled);
-                    this.#controlSet('queryAwareOverride', enabled ? '1' : '0');
-                    return json({ ok: true, enabled });
-                });
-            }
             if (route === '/admin/retention') {
                 return request
                     .json()

package/dist/index.d.ts

@@ -1,9 +1,8 @@
 export { createSyncDurableObject, createSyncWorker } from './host.js';
 export { createQueryCompiler } from './query-compiler.js';
 export { resolveQueryPatch } from './query-patch.js';
-export { visibility } from './types.js';
 export { DEFAULT_TRANSACTION_QUERY_BUDGET, TransactionQueryBudgetError, executeTransactionQueryPlan, executeTransactionQueryPlanAsync, } from './transaction-query.js';
-export type { PullCaps, QueryResolution, QueryResolutionRequest, QueryResolver, SyncHostConfig, SyncHostEnv, ServiceBinding, SyncSql, UpstreamConfig, VisibilityConfig, VisibilityExpression, VisibilityFilter, VisibilityOperand, VisibilityValue, } from './types.js';
+export type { SyncHostConfig, SyncHostEnv, ServiceBinding, SyncSql, UpstreamConfig, } from './types.js';
 export type { SyncDurableObjectConstructor } from './host.js';
 export type { CompiledTransactionQueryNode, CompiledTransactionQueryPlan, CompiledTransactionQueryRelationship, TransactionQueryBinding, TransactionQueryBudget, TransactionQueryColumn, TransactionQueryColumnType, TransactionQueryExecutionOptions, TransactionQueryWireValue, } from './transaction-query.js';
 export type { TransactionQueryCompiler } from './query-compiler.js';

package/dist/index.js

@@ -1,5 +1,4 @@
 export { createSyncDurableObject, createSyncWorker } from './host.js';
 export { createQueryCompiler } from './query-compiler.js';
 export { resolveQueryPatch } from './query-patch.js';
-export { visibility } from './types.js';
 export { DEFAULT_TRANSACTION_QUERY_BUDGET, TransactionQueryBudgetError, executeTransactionQueryPlan, executeTransactionQueryPlanAsync, } from './transaction-query.js';

package/dist/query-patch.d.ts

@@ -1,30 +1,21 @@
-import type { JsonValue } from 'orez-sync-executor';
-export type QueryResolutionRequest = {
-    readonly name: string;
-    readonly args: readonly JsonValue[];
-};
-/**
- * One resolved query, positionally matched to the request at the same index.
- *
- * An `error` fails the whole patch (the pull is refused as one unit), but the
- * refusal names the query it came from and carries its resolver error, so a
- * client that registers one unknown query alongside nine good ones is told
- * which one is unknown.
- */
-export type QueryResolution = {
-    readonly ast: JsonValue;
-} | {
-    readonly error: string;
-};
+import type { AnyQueryRegistry } from '@rocicorp/zero';
 /**
  * Turn a client's desired-query patch into the resolved patch sync-core takes.
  *
- * Both hosts share this because both must agree on exactly one thing: how many
- * times a consumer's resolver is called for one patch. Resolving per query made
- * a pull cost one application round trip per registered query, each one
- * re-authenticating, so a screen mounting eleven views paid eleven of them in
- * series. Everything else here exists to make the single call safe: the patch
- * keeps its order, duplicate (name, args) pairs collapse to one request and fan
- * back out, and a resolver error names the query it came from.
+ * Every named query resolves in-process against the app's ordinary Zero query
+ * registry — the same object the client was built with. `CustomQuery.fn`
+ * validates the arguments and applies the query context, so this is exactly
+ * the transform zero-cache delegates to an app endpoint, minus the network.
+ * The context is the host's authenticated identity (claims on the CF host,
+ * authData on the browser host); a query definition scopes its rows from it.
+ *
+ * Resolution is structural on purpose: the registry is walked as a plain
+ * object and the built query's `ast` is read directly, never through Zero's
+ * `asQueryInternals`, whose instance-tag check fails whenever the app's
+ * registry and this host resolve different copies of the zero module.
+ *
+ * A resolution error fails the whole patch (the pull is refused as one unit),
+ * but the refusal names the query it came from, so a client that registers
+ * one unknown query alongside nine good ones is told which one is unknown.
  */
-export declare function resolveQueryPatch(patch: readonly unknown[], resolve: (requests: readonly QueryResolutionRequest[]) => readonly QueryResolution[] | Promise<readonly QueryResolution[]>, transformVersion: number, fail: (message: string) => Error): Promise<unknown[]>;
+export declare function resolveQueryPatch(patch: readonly unknown[], queries: AnyQueryRegistry, context: unknown, transformVersion: number, fail: (message: string) => Error): unknown[];

package/dist/query-patch.js

@@ -1,18 +1,26 @@
+// Zero separates registry path segments with '.' or '|' (its getValueAtPath).
+const NAME_SEPARATOR = /[.|]/;
 /**
  * Turn a client's desired-query patch into the resolved patch sync-core takes.
  *
- * Both hosts share this because both must agree on exactly one thing: how many
- * times a consumer's resolver is called for one patch. Resolving per query made
- * a pull cost one application round trip per registered query, each one
- * re-authenticating, so a screen mounting eleven views paid eleven of them in
- * series. Everything else here exists to make the single call safe: the patch
- * keeps its order, duplicate (name, args) pairs collapse to one request and fan
- * back out, and a resolver error names the query it came from.
+ * Every named query resolves in-process against the app's ordinary Zero query
+ * registry — the same object the client was built with. `CustomQuery.fn`
+ * validates the arguments and applies the query context, so this is exactly
+ * the transform zero-cache delegates to an app endpoint, minus the network.
+ * The context is the host's authenticated identity (claims on the CF host,
+ * authData on the browser host); a query definition scopes its rows from it.
+ *
+ * Resolution is structural on purpose: the registry is walked as a plain
+ * object and the built query's `ast` is read directly, never through Zero's
+ * `asQueryInternals`, whose instance-tag check fails whenever the app's
+ * registry and this host resolve different copies of the zero module.
+ *
+ * A resolution error fails the whole patch (the pull is refused as one unit),
+ * but the refusal names the query it came from, so a client that registers
+ * one unknown query alongside nine good ones is told which one is unknown.
  */
-export async function resolveQueryPatch(patch, resolve, transformVersion, fail) {
-    const puts = [];
-    const requests = [];
-    const requestByKey = new Map();
+export function resolveQueryPatch(patch, queries, context, transformVersion, fail) {
+    const result = [...patch];
     patch.forEach((operation, index) => {
         if (!operation || typeof operation !== 'object')
             return;
@@ -24,34 +32,38 @@ export async function resolveQueryPatch(patch, resolve, transformVersion, fail)
         }
         if (!Array.isArray(op.args))
             throw fail('named query args must be an array');
-        const key = JSON.stringify([op.name, op.args]);
-        if (!requestByKey.has(key)) {
-            requestByKey.set(key, requests.length);
-            requests.push({ name: op.name, args: op.args });
+        let node = queries;
+        for (const segment of op.name.split(NAME_SEPARATOR)) {
+            node =
+                node && typeof node === 'object'
+                    ? node[segment]
+                    : undefined;
         }
-        puts.push({ index, key, name: op.name, hash: op.hash });
-    });
-    if (puts.length === 0)
-        return [...patch];
-    const resolved = await resolve(requests);
-    // broken positional arity is a host-side resolver bug, not a client error,
-    // so it deliberately bypasses fail() and surfaces as a 500
-    if (resolved.length !== requests.length) {
-        throw new Error(`query resolver returned ${resolved.length} results for ${requests.length} queries`);
-    }
-    const result = [...patch];
-    for (const put of puts) {
-        const resolution = resolved[requestByKey.get(put.key)];
-        if (!resolution || 'error' in resolution) {
-            const detail = resolution && 'error' in resolution ? `: ${resolution.error}` : '';
-            throw fail(`unknown or unsupported named query: ${put.name}${detail}`);
+        const custom = node;
+        if (!custom || typeof custom.fn !== 'function') {
+            throw fail(`unknown or unsupported named query: ${op.name}`);
+        }
+        let ast;
+        try {
+            const built = custom.fn({
+                args: op.args[0],
+                ctx: context,
+            });
+            if (!built || typeof built !== 'object' || built.ast === undefined) {
+                throw new Error('query did not build to an AST-bearing Zero query');
+            }
+            ast = built.ast;
         }
-        result[put.index] = {
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            throw fail(`unknown or unsupported named query: ${op.name}: ${detail}`);
+        }
+        result[index] = {
             op: 'put',
-            hash: put.hash,
-            ast: resolution.ast,
+            hash: op.hash,
+            ast,
             transformVersion,
         };
-    }
+    });
     return result;
 }

package/dist/types.d.ts

@@ -1,33 +1,11 @@
-import type { QueryResolution, QueryResolutionRequest } from './query-patch.js';
 import type { TransactionQueryBudget } from './transaction-query.js';
-import type { Schema } from '@rocicorp/zero';
-import type { ExecResult, MutatorRegistry, NormalizedClaims, SqlStatementMetadata, VisibilityConfig } from 'orez-sync-executor';
+import type { AnyQueryRegistry, Schema } from '@rocicorp/zero';
+import type { ExecResult, MutatorRegistry, NormalizedClaims, SqlStatementMetadata } from 'orez-sync-executor';
 import type { StreamingManifest } from 'orez-sync-executor/realtime';
-export { visibility, type VisibilityExpression, type VisibilityFilter, type VisibilityOperand, type VisibilityValue, } from './visibility.js';
-export type { VisibilityConfig } from 'orez-sync-executor';
-export type { QueryResolution, QueryResolutionRequest } from './query-patch.js';
 export interface SyncSql {
     exec(sql: string, params?: readonly unknown[], metadata?: SqlStatementMetadata): ExecResult;
     query<Row extends Record<string, unknown> = Record<string, unknown>>(sql: string, params?: readonly unknown[]): Row[];
 }
-/**
- * Resolve a whole desired-query patch in one call.
- *
- * This is a batch contract because it is nearly always a network call: a
- * consumer delegates the transform to its application, which authenticates and
- * answers over a service binding. Resolving one query per call made a pull's
- * cost linear in the number of queries a screen registers, and each round trip
- * re-authenticated. Measured against production with a captured mobile client's
- * desired-query set: an 11-query pull took 23.3 s against 2.0 s for the same
- * pull carrying no queries.
- *
- * Implementations must return exactly one entry per request, in request order.
- */
-export type QueryResolver = (requests: readonly QueryResolutionRequest[], claims: NormalizedClaims, env: SyncHostEnv) => readonly QueryResolution[] | Promise<readonly QueryResolution[]>;
-export type PullCaps = {
-    maxChangeRows: number;
-    maxChangeBytes: number;
-};
 export interface SyncHostEnv {
     SYNC_DO: DurableObjectNamespace;
     ADMIN_KEY?: string;
@@ -109,12 +87,14 @@ export type SyncHostConfig<Env extends SyncHostEnv = SyncHostEnv, S extends Sche
     authorizeNotify(request: Request, env: Env): boolean | Promise<boolean>;
     /** Resolve the first path component or another consumer-defined namespace. */
     namespace(request: Request): string | null;
-    visibility?: VisibilityConfig;
-    /** Enable desired-query pulls for this namespace and resolve named queries
-     * into validated Zero ASTs before they reach sync-core. */
-    queryAware?: boolean | ((claims: NormalizedClaims) => boolean);
-    /** Resolve every named query in one desired-query patch, in one call. */
-    resolveQueries?: QueryResolver;
+    /**
+     * The app's ordinary Zero query registry (the `defineQueries` result the
+     * client is built with). The host resolves every desired named query
+     * in-process against it — argument validation and context scoping run in
+     * the query definitions themselves, with the authenticated claims as the
+     * query context. There is no app endpoint to call and nothing else to wire.
+     */
+    queries: AnyQueryRegistry;
     /**
      * Streaming fields for this namespace: which columns may carry a live,
      * uncommitted value, and their publish mode and rate bounds.
@@ -138,10 +118,7 @@ export type SyncHostConfig<Env extends SyncHostEnv = SyncHostEnv, S extends Sche
     authorizeProduce?: (request: Request, env: Env) => boolean | Promise<boolean>;
     /** Server-owned invalidation epoch for permission/schema transforms. */
     queryTransformVersion?: number | ((claims: NormalizedClaims) => number);
-    /** Enable consumer visibility from the first request. Defaults to false for harnesses. */
-    visibilityEnabled?: boolean;
     retainChanges?: number;
-    caps?: Partial<PullCaps>;
     idleTeardownMs?: number;
     wakeCoalesceMs?: number;
     /** per-query guard for recursive transaction query materialization. */

package/dist/types.js

@@ -1 +1 @@
-export { visibility, } from './visibility.js';
+export {};

package/dist/wasm.d.ts

@@ -8,7 +8,6 @@ export declare const engine_begin_snapshot_generation: (db: any, schema: any, st
 export declare const engine_compile_query: (schema: any, ast: any, format: any) => any;
 export declare const engine_finalize: (db: any, client_group_id: string, client_id: string, mutation_id: string) => void;
 export declare const engine_finalize_snapshot_generation: (db: any, schema: any, generation: string, watermark: string) => any;
-export declare const engine_handle_pull: (db: any, schema: any, visibility: any, caps: any, retain_changes: string, body: any, user_id: string) => any;
 export declare const engine_handle_query_pull: (db: any, schema: any, retain_changes: string, body: any, user_id: string) => any;
 export declare const engine_init_query_schema: (db: any) => void;
 export declare const engine_init_schema: (db: any, schema: any) => void;

package/dist/wasm.js

@@ -25,7 +25,6 @@ export const engine_begin_snapshot_generation = withWasm(generated.engine_begin_
 export const engine_compile_query = withWasm(generated.engine_compile_query);
 export const engine_finalize = withWasm(generated.engine_finalize);
 export const engine_finalize_snapshot_generation = withWasm(generated.engine_finalize_snapshot_generation);
-export const engine_handle_pull = withWasm(generated.engine_handle_pull);
 export const engine_handle_query_pull = withWasm(generated.engine_handle_query_pull);
 export const engine_init_query_schema = withWasm(generated.engine_init_query_schema);
 export const engine_init_schema = withWasm(generated.engine_init_schema);

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "orez-sync-cf-host",
-  "version": "0.11.7",
+  "version": "0.12.0",
+  "description": "Internal orez Cloudflare sync host. Do not import directly: consumers use orez-lite/cloudflare/sync.",
   "type": "module",
   "exports": {
     ".": {
@@ -27,10 +28,6 @@
       "types": "./dist/transaction-query.d.ts",
       "import": "./dist/transaction-query.js"
     },
-    "./visibility": {
-      "types": "./dist/visibility.d.ts",
-      "import": "./dist/visibility.js"
-    },
     "./vite-wasm-loader": {
       "types": "./dist/vite-wasm-loader.d.ts",
       "import": "./dist/vite-wasm-loader.js"
@@ -49,7 +46,7 @@
     "build:dist:platform": "bun run build:dependencies && bun run build:wasm:platform && bun run build:runtime",
     "bundle": "bun run build:dist && wrangler deploy --dry-run --outdir .wrangler/bundle",
     "measure": "bun run build:dist && bun measure.mjs",
-    "test": "bun run test:config && bun run test:query-compiler && bun run test:package && bun run test:platform && bun run test:integration && bun run test:ingest && bun run test:restart",
+    "test": "bun run test:config && bun run test:query-compiler && bun run test:package && bun run test:platform && bun run test:integration && bun run test:large-data && bun run test:ingest && bun run test:restart",
     "test:config": "bun test config.test.mjs write-safeguards.test.mjs transaction-query.test.mjs",
     "test:integration": "bun run build:dist && bun integration-test.mjs",
     "test:ingest": "bun run build:dist && bun ingest-test.mjs",
@@ -57,10 +54,11 @@
     "test:query-compiler": "bun run build:dist && bun test --preload orez-sync-cf-host/bun-wasm-loader query-compiler.test.mjs && node vite-ssr-query-compiler-test.mjs",
     "test:restart": "bun run build:dist && bun restart-test.mjs",
     "test:platform": "bun run build:dist:platform && bun platform-test.mjs",
-    "typecheck": "bun run build:dist:platform && tsc --noEmit"
+    "typecheck": "bun run build:dist:platform && tsc --noEmit",
+    "test:large-data": "bun run build:dist && bun large-data-test.mjs"
   },
   "dependencies": {
-    "orez-sync-executor": "0.11.7"
+    "orez-sync-executor": "0.12.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "4.20260617.1",

package/dist/visibility.d.ts

@@ -1,12 +0,0 @@
-import type { VisibilityExpression, VisibilityFilter, VisibilityOperand, VisibilityValue } from 'orez-sync-executor';
-export type { VisibilityExpression, VisibilityFilter, VisibilityOperand, VisibilityValue, } from 'orez-sync-executor';
-export declare const visibility: {
-    readonly column: (table: string, column: string, qualifier?: string) => VisibilityOperand;
-    readonly value: (value: VisibilityValue) => VisibilityOperand;
-    readonly comparison: (left: VisibilityOperand, operator: "=" | "!=" | "<" | ">" | "<=" | ">=" | "IS" | "IS NOT", right: VisibilityOperand) => VisibilityExpression;
-    readonly and: (...conditions: VisibilityExpression[]) => VisibilityExpression;
-    readonly or: (...conditions: VisibilityExpression[]) => VisibilityExpression;
-    readonly exists: (table: string, where: VisibilityExpression, qualifier?: string) => VisibilityExpression;
-    readonly filter: (expression: VisibilityExpression) => VisibilityFilter;
-    readonly raw: (sql: string, params?: readonly VisibilityValue[]) => VisibilityFilter;
-};

package/dist/visibility.js

@@ -1,30 +0,0 @@
-export const visibility = {
-    column(table, column, qualifier) {
-        return qualifier
-            ? { type: 'column', table, column, qualifier }
-            : { type: 'column', table, column };
-    },
-    value(value) {
-        return { type: 'value', value };
-    },
-    comparison(left, operator, right) {
-        return { type: 'comparison', operator, left, right };
-    },
-    and(...conditions) {
-        return { type: 'and', conditions };
-    },
-    or(...conditions) {
-        return { type: 'or', conditions };
-    },
-    exists(table, where, qualifier) {
-        return qualifier
-            ? { type: 'exists', table, qualifier, where }
-            : { type: 'exists', table, where };
-    },
-    filter(expression) {
-        return { kind: 'expression', expression };
-    },
-    raw(sql, params = []) {
-        return { kind: 'raw', sql, params };
-    },
-};