orez-sync-cf-host 0.5.30 → 0.5.34

package/README.md

@@ -2,26 +2,22 @@
 
 This is the production-shaped Cloudflare Durable Object host for the Rust sync
 engine. The package exposes a consumer integration surface (`createSyncWorker`,
-`createSyncDurableObject`, `registerMutators`) and a harness deployment built
+`createSyncDurableObject`) and a harness deployment built
 from `src/harness-worker.ts`. Consumers provide a JSON Zero schema, application
-DDL/seed initializer, normalized-claims authenticator, mutator registry, and an
-optional row-visibility hook.
+DDL/seed initializer, normalized-claims authenticator, an
+`orez-sync-executor` mutator registry, and an optional row-visibility hook.
 
-The Worker authenticates at the consumer edge and forwards normalized claims
+The Worker authenticates and authorizes at the consumer edge, then forwards normalized claims
 inside the binding request body, where request-header observability cannot record
 them. It never logs tokens, mutation arguments, or row contents. Pull runs
-`engine_handle_pull` inside `transactionSync`; push runs
-Rust `push_validate`/`preflight`/`finalize`/`record_app_error` steps around the
-registered asynchronous TypeScript mutator inside `ctx.storage.transaction`.
-Every SQL cursor is materialized before an await. Mutators may await only their
-`MutatorSql` operations; timers, fetches, and other external work belong in
-`context.defer`, which runs only after commit. Application failures use the
+`engine_handle_pull` inside `transactionSync`; local push delegates validation,
+replay, LMID advancement, CRUD, and committed effects to `orez-sync-executor`
+inside `ctx.storage.transaction`. Every SQL cursor is materialized before an
+await. Mutators may await only their application transaction operations;
+timers, fetches, and other external work belong in
+`ctx.defer`, which runs only after commit. Application failures use the
 required second transaction to advance the LMID marker.
 
-The root `orez/cf-do` executor and this host consume the same `post-commit`
-module, so transaction retries discard effects from abandoned attempts in both
-paths.
-
 Transaction-query `ILIKE` folding is ASCII-only on Durable Object SQLite;
 non-ASCII case pairs can diverge from PostgreSQL.
 

package/dist/config.d.ts

@@ -1,3 +1,4 @@
 import type { PullCaps, SyncHostConfig, SyncHostEnv } from './types.js';
+import type { Schema } from '@rocicorp/zero';
 export declare function validatePullCaps(caps: PullCaps): PullCaps;
-export declare function validateSyncHostConfig<Env extends SyncHostEnv>(config: SyncHostConfig<Env>): SyncHostConfig<Env>;
+export declare function validateSyncHostConfig<Env extends SyncHostEnv, S extends Schema = Schema>(config: SyncHostConfig<Env, S>): SyncHostConfig<Env, S>;

package/dist/config.js

@@ -11,6 +11,9 @@ export function validateSyncHostConfig(config) {
     if (typeof config.authorizeNotify !== 'function') {
         throw new TypeError('sync host config authorizeNotify is required');
     }
+    if (typeof config.authorize !== 'function') {
+        throw new TypeError('sync host config authorize is required');
+    }
     const hasMutators = config.mutators !== undefined;
     const hasDelegate = config.mutateUrl !== undefined;
     if (hasMutators === hasDelegate) {

package/dist/host.d.ts

@@ -1,13 +1,14 @@
 import { DurableObject } from 'cloudflare:workers';
 import type { SyncHostConfig, SyncHostEnv } from './types.js';
+import type { Schema } from '@rocicorp/zero';
 /**
  * Create the consumer-facing Worker router. Authentication happens here; the
  * Durable Object receives normalized claims inside the binding request body so
  * observability systems cannot record them as request-header metadata.
  */
-export declare function createSyncWorker<Env extends SyncHostEnv>(config: SyncHostConfig<Env>): ExportedHandler<Env>;
+export declare function createSyncWorker<Env extends SyncHostEnv, S extends Schema = Schema>(config: SyncHostConfig<Env, S>): ExportedHandler<Env>;
 export interface SyncDurableObjectConstructor<Env extends SyncHostEnv> {
     new (ctx: DurableObjectState, env: Env): DurableObject<Env>;
 }
 /** Create the namespace Durable Object class for one bundled consumer config. */
-export declare function createSyncDurableObject<Env extends SyncHostEnv>(config: SyncHostConfig<Env>): SyncDurableObjectConstructor<Env>;
+export declare function createSyncDurableObject<Env extends SyncHostEnv, S extends Schema = Schema>(config: SyncHostConfig<Env, S>): SyncDurableObjectConstructor<Env>;

package/dist/host.js

@@ -1,10 +1,9 @@
 import { DurableObject } from 'cloudflare:workers';
+import { createSyncExecutor } from 'orez-sync-executor/core';
 import { validatePullCaps, validateSyncHostConfig } from './config.js';
-import { createPostCommitEffects } from './post-commit.js';
 import { createQueryCompiler } from './query-compiler.js';
 import { decodeSqlParams, SqlStorageDirect, SqlStorageMutatorTransaction, SqlStorageSyncDb, } from './sql-storage-adapter.js';
-import { isMutationApplicationError } from './types.js';
-import { engine_apply_snapshot_changes, engine_apply_snapshot_page, engine_apply_upstream, engine_assemble_push_response, engine_begin_snapshot_generation, engine_finalize, engine_finalize_snapshot_generation, engine_handle_pull, engine_handle_query_pull, engine_init_query_schema, engine_init_schema, engine_invalidate, engine_memory_bytes, engine_preflight, engine_prune, engine_push_validate, engine_read_snapshot_progress, engine_record_app_error, engine_state, engine_version, } from './wasm.js';
+import { engine_apply_snapshot_changes, engine_apply_snapshot_page, engine_apply_upstream, engine_begin_snapshot_generation, engine_finalize, engine_finalize_snapshot_generation, engine_handle_pull, engine_handle_query_pull, engine_init_query_schema, engine_init_schema, engine_invalidate, engine_memory_bytes, engine_preflight, engine_prune, engine_push_validate, engine_read_snapshot_progress, engine_state, engine_version, } from './wasm.js';
 import { IngestBreakerError, IngestCircuitBreaker, retryDelayMs, shouldRetryDelegatedPush, } from './write-safeguards.js';
 const NAMESPACE_HEADER = 'x-orez-sync-namespace';
 const UPSTREAM_PATH_HEADER = 'x-orez-sync-upstream-path';
@@ -177,8 +176,12 @@ export function createSyncWorker(config) {
             let forwardedBody = null;
             if (!isAdmin && route !== '/wake' && route !== '/notify') {
                 const claims = await config.authenticate(request, env);
-                if (!claims)
+                if (!claims || typeof claims.userID !== 'string' || claims.userID.length === 0) {
                     return json({ error: 'missing authentication' }, 401);
+                }
+                if (!(await config.authorize(request, claims, namespace, env))) {
+                    return json({ error: 'forbidden' }, 403);
+                }
                 if ((route === '/pull' || route === '/push') && request.method === 'POST') {
                     try {
                         const body = await requestObject(request);
@@ -231,6 +234,8 @@ export function createSyncDurableObject(config) {
         #engineDb;
         #directSql;
         #mutatorSql;
+        #executor;
+        #executorBeforeCommitFault = null;
         #bootID = crypto.randomUUID();
         #lastRequestAt = 0;
         #hibernations = 0;
@@ -259,6 +264,50 @@ export function createSyncDurableObject(config) {
             this.#engineDb = new SqlStorageSyncDb(ctx.storage.sql, recordRowsWritten);
             this.#directSql = new SqlStorageDirect(ctx.storage.sql, recordRowsWritten);
             this.#mutatorSql = new SqlStorageMutatorTransaction(this.#directSql, (ast, format) => this.#wasm(() => compileQuery(ast, format)), config.transactionQueryBudget);
+            const database = {
+                dialect: 'sqlite',
+                transaction: async (work) => this.ctx.storage.transaction(async () => {
+                    let applicationWrite = false;
+                    const tx = {
+                        exec: async (sql, params, metadata) => {
+                            if (metadata !== undefined ||
+                                (!/^\s*CREATE\s+(?:SCHEMA|TABLE)\b/i.test(sql) &&
+                                    !/\b_zsync_[A-Za-z0-9_]+\b/.test(sql))) {
+                                applicationWrite = true;
+                            }
+                            return this.#mutatorSql.exec(sql, params, metadata);
+                        },
+                        query: (sql, params) => this.#mutatorSql.query(sql, params),
+                        queryAst: (ast, format, queryName) => this.#mutatorSql.queryAst(ast, format, queryName),
+                    };
+                    const value = await work(tx);
+                    if (applicationWrite && this.#executorBeforeCommitFault) {
+                        const fault = this.#executorBeforeCommitFault;
+                        this.#executorBeforeCommitFault = null;
+                        throw this.#faultError(fault, 'push_after_write_before_commit');
+                    }
+                    return value;
+                }),
+                query: (sql, params) => this.#mutatorSql.query(sql, params),
+            };
+            this.#executor = config.mutators
+                ? createSyncExecutor({
+                    database,
+                    effects: {
+                        runBackground: (promise) => this.ctx.waitUntil(promise),
+                        report: (error) => {
+                            this.#counters.externalEffectFailures++;
+                            console.error(JSON.stringify({
+                                event: 'sync_external_effect_error',
+                                hostVersion: config.hostVersion,
+                                error: errorMessage(error),
+                            }));
+                        },
+                    },
+                    mutators: config.mutators,
+                    schema: config.schema,
+                })
+                : null;
             ctx.blockConcurrencyWhile(async () => {
                 ctx.storage.transactionSync(() => {
                     config.initialize(this.#directSql);
@@ -329,7 +378,16 @@ export function createSyncDurableObject(config) {
                 filters: Object.keys(config.schema.tables).flatMap((table) => {
                     const filter = config.visibility?.filter(table, claims);
                     return filter
-                        ? [{ table, sql: filter.sql, params: [...(filter.params ?? [])] }]
+                        ? [
+                            filter.kind === 'expression'
+                                ? { kind: 'expression', table, expression: filter.expression }
+                                : {
+                                    kind: 'raw',
+                                    table,
+                                    sql: filter.sql,
+                                    params: [...(filter.params ?? [])],
+                                },
+                        ]
                         : [];
                 }),
             };
@@ -1117,99 +1175,34 @@ export function createSyncDurableObject(config) {
                 const beforeMutationFault = this.#takeFault('push_before_mutation');
                 if (beforeMutationFault)
                     throw this.#faultError(beforeMutationFault, 'push_before_mutation');
-                const plan = this.#wasm(() => engine_push_validate(body));
-                if (plan.kind === 'respond')
-                    return json(plan.response);
-                const results = [];
-                for (const mutation of plan.mutations) {
-                    const deferred = createPostCommitEffects();
-                    try {
-                        const txStarted = performance.now();
-                        // consume the before-commit fault OUTSIDE the transaction it is
-                        // about to abort: taken inside, the control-table delete rolls
-                        // back with the abort and the fault re-fires on every retry
-                        // instead of being one-shot.
-                        const beforeCommitFault = this.#takeFault('push_after_write_before_commit');
-                        const preflight = await this.ctx.storage.transaction(async () => {
-                            // Storage transactions may retry their closure. Never carry a
-                            // deferred effect from an abandoned attempt into the commit.
-                            deferred.beginAttempt();
-                            const decision = this.#wasm(() => engine_preflight(this.#engineDb, plan.clientGroupID, mutation.clientID, mutation.id, claims.userID));
-                            if (decision.kind === 'replay')
-                                return decision;
-                            const mutator = config.mutators?.[mutation.name];
-                            if (!mutator)
-                                throw new Error(`unknown mutator: ${mutation.name}`);
-                            await mutator(this.#mutatorSql, mutation.args[0] ?? null, {
-                                claims,
-                                clientID: mutation.clientID,
-                                mutationID: mutation.id,
-                                defer: deferred.defer,
-                            });
-                            if (beforeCommitFault)
-                                throw this.#faultError(beforeCommitFault, 'push_after_write_before_commit');
-                            this.#wasm(() => engine_finalize(this.#engineDb, plan.clientGroupID, mutation.clientID, mutation.id));
-                            return decision;
-                        });
-                        transactionMs += performance.now() - txStarted;
-                        if (preflight.kind === 'replay') {
-                            const expected = preflight
-                                .expected;
-                            results.push({
-                                clientID: mutation.clientID,
-                                id: mutation.id,
-                                result: {
-                                    error: 'alreadyProcessed',
-                                    details: `Ignoring mutation from ${mutation.clientID} with ID ${mutation.id} as it was already processed. Expected: ${expected}`,
-                                },
-                            });
-                            continue;
-                        }
-                        lmidAdvances++;
-                        results.push({
-                            clientID: mutation.clientID,
-                            id: mutation.id,
-                            result: {},
-                        });
-                        // Keep the advisory fan-out off the push response's critical path.
-                        // waitUntil anchors the coalescing timer across request completion,
-                        // while the next serialized client push can join the same batch.
-                        this.ctx.waitUntil(this.#enqueueWake(mutation.clientID));
-                        await deferred.runAfterCommit((error) => {
-                            this.#counters.externalEffectFailures++;
-                            console.error(JSON.stringify({
-                                event: 'sync_external_effect_error',
-                                hostVersion: config.hostVersion,
-                                error: errorMessage(error),
-                            }));
-                        });
+                if (!this.#executor)
+                    throw new Error('local sync executor is not configured');
+                // Consume the fault outside the transaction it aborts so a rollback
+                // cannot restore the one-shot control flag.
+                this.#executorBeforeCommitFault = this.#takeFault('push_after_write_before_commit');
+                const txStarted = performance.now();
+                let result;
+                try {
+                    result = await this.#executor.push(body, claims);
+                }
+                finally {
+                    this.#executorBeforeCommitFault = null;
+                }
+                transactionMs += performance.now() - txStarted;
+                const mutationResults = 'mutations' in result.pushResponse ? result.pushResponse.mutations : [];
+                for (const mutation of mutationResults) {
+                    if ('error' in mutation.result &&
+                        mutation.result.error === 'alreadyProcessed') {
+                        continue;
                     }
-                    catch (error) {
-                        const isAppError = isMutationApplicationError(error);
-                        if (!isAppError)
-                            throw error;
+                    lmidAdvances++;
+                    if ('error' in mutation.result && mutation.result.error === 'app') {
                         this.#counters.applicationErrors++;
                         resultClass = 'application_error';
-                        const appError = error;
-                        const txStarted = performance.now();
-                        await this.ctx.storage.transaction(async () => {
-                            this.#wasm(() => engine_record_app_error(this.#engineDb, plan.clientGroupID, mutation.clientID, mutation.id, claims.userID));
-                        });
-                        transactionMs += performance.now() - txStarted;
-                        lmidAdvances++;
-                        results.push({
-                            clientID: mutation.clientID,
-                            id: mutation.id,
-                            result: {
-                                error: 'app',
-                                message: appError.message,
-                                details: appError.details ?? appError.message,
-                            },
-                        });
-                        this.ctx.waitUntil(this.#enqueueWake(mutation.clientID));
                     }
+                    this.ctx.waitUntil(this.#enqueueWake(mutation.id.clientID));
                 }
-                if (plan.mutations.length > 0) {
+                if (mutationResults.length > 0) {
                     const txStarted = performance.now();
                     await this.ctx.storage.transaction(async () => {
                         this.#wasm(() => engine_prune(this.#engineDb, this.#retainChanges()));
@@ -1220,7 +1213,6 @@ export function createSyncDurableObject(config) {
                 const afterCommitFault = this.#takeFault('push_after_commit_before_response');
                 if (afterCommitFault)
                     throw this.#faultError(afterCommitFault, 'push_after_commit_before_response');
-                const response = this.#wasm(() => engine_assemble_push_response(results));
                 const state = this.#engineStateBestEffort();
                 this.#log({
                     namespaceHash: namespace,
@@ -1246,7 +1238,7 @@ export function createSyncDurableObject(config) {
                     this.#dropNextPushResponse = false;
                     return json({ error: 'intentionally dropped push response' }, 503);
                 }
-                return json(response);
+                return json(result);
             }
             catch (error) {
                 const status = statusOf(error);

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 export { createSyncDurableObject, createSyncWorker } from './host.js';
 export { createQueryCompiler } from './query-compiler.js';
-export { MutationApplicationError, isMutationApplicationError, registerMutators, } from './types.js';
+export { visibility } from './types.js';
 export { DEFAULT_TRANSACTION_QUERY_BUDGET, TransactionQueryBudgetError, executeTransactionQueryPlan, executeTransactionQueryPlanAsync, } from './transaction-query.js';
-export type { DeferredEffect, JsonPrimitive, JsonValue, MutatorContext, MutatorRegistry, MutatorSql, NormalizedClaims, PullCaps, QueryResolver, RegisteredMutator, SyncHostConfig, SyncHostEnv, ServiceBinding, SQLiteExecResult, SqlStatementMetadata, SyncSql, UpstreamConfig, VisibilityConfig, VisibilityFilter, ZeroSchemaConfig, } from './types.js';
+export type { PullCaps, QueryResolver, SyncHostConfig, SyncHostEnv, ServiceBinding, SyncSql, UpstreamConfig, VisibilityConfig, VisibilityExpression, VisibilityFilter, VisibilityOperand, VisibilityValue, } from './types.js';
 export type { SyncDurableObjectConstructor } from './host.js';
-export type { CompiledTransactionQueryNode, CompiledTransactionQueryPlan, CompiledTransactionQueryRelationship, TransactionQueryBinding, TransactionQueryBudget, TransactionQueryColumn, TransactionQueryColumnType, TransactionQueryExecutionOptions, TransactionQueryFormat, TransactionQueryWireValue, } from './transaction-query.js';
+export type { CompiledTransactionQueryNode, CompiledTransactionQueryPlan, CompiledTransactionQueryRelationship, TransactionQueryBinding, TransactionQueryBudget, TransactionQueryColumn, TransactionQueryColumnType, TransactionQueryExecutionOptions, TransactionQueryWireValue, } from './transaction-query.js';
 export type { TransactionQueryCompiler } from './query-compiler.js';

package/dist/index.js

@@ -1,4 +1,4 @@
 export { createSyncDurableObject, createSyncWorker } from './host.js';
 export { createQueryCompiler } from './query-compiler.js';
-export { MutationApplicationError, isMutationApplicationError, registerMutators, } from './types.js';
+export { visibility } from './types.js';
 export { DEFAULT_TRANSACTION_QUERY_BUDGET, TransactionQueryBudgetError, executeTransactionQueryPlan, executeTransactionQueryPlanAsync, } from './transaction-query.js';

package/dist/query-compiler.d.ts

@@ -1,4 +1,4 @@
-import type { CompiledTransactionQueryPlan, TransactionQueryFormat } from './transaction-query.js';
-import type { ZeroSchemaConfig } from './types.js';
+import type { CompiledTransactionQueryPlan } from './transaction-query.js';
+import type { TransactionQueryFormat, ZeroSchemaConfig } from 'orez-sync-executor';
 export type TransactionQueryCompiler = (ast: unknown, format: TransactionQueryFormat) => CompiledTransactionQueryPlan;
 export declare function createQueryCompiler(schema: ZeroSchemaConfig): TransactionQueryCompiler;

package/dist/sql-storage-adapter.d.ts

@@ -1,5 +1,7 @@
-import type { CompiledTransactionQueryPlan, TransactionQueryBudget, TransactionQueryFormat } from './transaction-query.js';
-import type { MutatorSql, SQLiteExecResult, SqlStatementMetadata, SyncSql } from './types.js';
+import type { CompiledTransactionQueryPlan, TransactionQueryBudget } from './transaction-query.js';
+import type { SyncSql } from './types.js';
+import type { ApplicationTransaction, ExecResult, SqlStatementMetadata } from 'orez-sync-executor';
+import type { TransactionQueryFormat } from 'orez-sync-executor';
 type WireValue = {
     kind: 'null';
 } | {
@@ -49,7 +51,7 @@ export declare class SqlStorageDirect implements SyncSql {
     private readonly sql;
     private readonly recordRowsWritten;
     constructor(sql: SqlStorage, recordRowsWritten?: (rows: number) => void);
-    exec(sql: string, params?: readonly unknown[], _metadata?: SqlStatementMetadata): SQLiteExecResult;
+    exec(sql: string, params?: readonly unknown[], _metadata?: SqlStatementMetadata): ExecResult;
     query<Row extends Record<string, unknown> = Record<string, unknown>>(sql: string, params?: readonly unknown[]): Row[];
 }
 /**
@@ -57,12 +59,12 @@ export declare class SqlStorageDirect implements SyncSql {
  * materializes its SqlStorage operation before its promise resolves, so an
  * existing `await tx.query(...)` cannot carry a cursor across an await.
  */
-export declare class SqlStorageMutatorTransaction implements MutatorSql {
+export declare class SqlStorageMutatorTransaction implements ApplicationTransaction {
     private readonly direct;
     private readonly compileQuery;
     private readonly queryBudget?;
     constructor(direct: SqlStorageDirect, compileQuery: (ast: unknown, format: TransactionQueryFormat) => CompiledTransactionQueryPlan, queryBudget?: Partial<TransactionQueryBudget> | undefined);
-    exec(sql: string, params?: readonly unknown[], metadata?: SqlStatementMetadata): Promise<SQLiteExecResult>;
+    exec(sql: string, params?: readonly unknown[], metadata?: SqlStatementMetadata): Promise<ExecResult>;
     query<Row extends Record<string, unknown> = Record<string, unknown>>(sql: string, params?: readonly unknown[]): Promise<Row[]>;
     queryAst<Result = unknown>(ast: unknown, format: TransactionQueryFormat, queryName?: string): Promise<Result>;
 }

package/dist/transaction-query.d.ts

@@ -50,10 +50,6 @@ export type TransactionQueryExecutionOptions = {
     queryName?: string;
     budget?: Partial<TransactionQueryBudget>;
 };
-export type TransactionQueryFormat = {
-    singular: boolean;
-    relationships: Readonly<Record<string, TransactionQueryFormat>>;
-};
 export declare const DEFAULT_TRANSACTION_QUERY_BUDGET: TransactionQueryBudget;
 export declare class TransactionQueryBudgetError extends Error {
     readonly query: string;

package/dist/types.d.ts

@@ -1,73 +1,12 @@
-import type { DeferredEffect } from './post-commit.js';
-import type { TransactionQueryBudget, TransactionQueryFormat } from './transaction-query.js';
-export type { DeferredEffect } from './post-commit.js';
-export type JsonPrimitive = string | number | boolean | null;
-export type JsonValue = JsonPrimitive | JsonValue[] | {
-    [key: string]: JsonValue;
-};
-export type NormalizedClaims = {
-    /** Stable consumer user id used for client-group ownership. */
-    userID: string;
-    [claim: string]: JsonValue;
-};
-export type ZeroSchemaConfig = {
-    readonly tables: Readonly<Record<string, {
-        readonly name?: string;
-        readonly serverName?: string;
-        readonly columns: Readonly<Record<string, {
-            readonly type: string;
-            readonly serverName?: string;
-        }>>;
-        readonly primaryKey: readonly string[];
-    }>>;
-};
-/**
- * Explicit identity for a SQLite write to a published application table.
- *
- * The physical table installs CDC. `publicTable` is the logical Zero name
- * emitted in the change feed. This replaces metadata recovered by parsing
- * PostgreSQL statements.
- */
-export type SqlStatementMetadata = {
-    table: string;
-    publicTable: string;
-    kind: 'insert' | 'update' | 'delete' | 'upsert';
-};
-export type SQLiteExecResult = {
-    changes: number;
-};
+import type { TransactionQueryBudget } from './transaction-query.js';
+import type { Schema } from '@rocicorp/zero';
+import type { ExecResult, JsonValue, MutatorRegistry, NormalizedClaims, SqlStatementMetadata, VisibilityConfig } from 'orez-sync-executor';
+export { visibility, type VisibilityExpression, type VisibilityFilter, type VisibilityOperand, type VisibilityValue, } from './visibility.js';
+export type { VisibilityConfig } from 'orez-sync-executor';
 export interface SyncSql {
-    exec(sql: string, params?: readonly unknown[], metadata?: SqlStatementMetadata): SQLiteExecResult;
+    exec(sql: string, params?: readonly unknown[], metadata?: SqlStatementMetadata): ExecResult;
     query<Row extends Record<string, unknown> = Record<string, unknown>>(sql: string, params?: readonly unknown[]): Row[];
 }
-export interface MutatorSql {
-    exec(sql: string, params?: readonly unknown[], metadata?: SqlStatementMetadata): Promise<SQLiteExecResult>;
-    query<Row extends Record<string, unknown> = Record<string, unknown>>(sql: string, params?: readonly unknown[]): Promise<Row[]>;
-    /** Execute a validated Zero AST inside the current application transaction. */
-    queryAst<Result = unknown>(ast: JsonValue, format: TransactionQueryFormat, queryName?: string): Promise<Result>;
-}
-export type MutatorContext = {
-    claims: NormalizedClaims;
-    /** Current Zero mutation identity, when invoked by the production host. */
-    clientID?: string;
-    mutationID?: string | number;
-    defer(effect: DeferredEffect): void;
-};
-export type RegisteredMutator = (tx: MutatorSql, args: JsonValue, context: MutatorContext) => void | Promise<void>;
-export type MutatorRegistry = Readonly<Record<string, RegisteredMutator>>;
-/** Preserve mutator names while making the host-facing registry immutable. */
-export declare function registerMutators<const Registry extends Record<string, RegisteredMutator>>(registry: Registry): Readonly<Registry>;
-export { MutationApplicationError, isMutationApplicationError } from './mutation-error.js';
-export type VisibilityFilter = {
-    /** SQL WHERE fragment only, without the WHERE keyword. */
-    sql: string;
-    params?: readonly JsonPrimitive[];
-};
-export type VisibilityConfig = {
-    /** True only when every predicate depends on the selected row alone. */
-    rowLocal: boolean | ((claims: NormalizedClaims) => boolean);
-    filter(table: string, claims: NormalizedClaims): VisibilityFilter | undefined;
-};
 export type QueryResolver = (name: string, args: readonly JsonValue[], claims: NormalizedClaims, env: SyncHostEnv) => JsonValue | Promise<JsonValue>;
 export type PullCaps = {
     maxChangeRows: number;
@@ -108,10 +47,10 @@ export type DelegatedPushRetryConfig = {
     /** Per-attempt service-binding timeout. Defaults to 5,000ms. */
     timeoutMs?: number;
 };
-export type SyncHostConfig<Env extends SyncHostEnv = SyncHostEnv> = {
+export type SyncHostConfig<Env extends SyncHostEnv = SyncHostEnv, S extends Schema = Schema> = {
     hostVersion: string;
-    schema: ZeroSchemaConfig;
-    mutators?: MutatorRegistry;
+    schema: S;
+    mutators?: MutatorRegistry<S>;
     /**
      * absolute app push path on the delegated mutation service. a successful
      * response must be causally visible through the configured upstream data
@@ -132,6 +71,8 @@ export type SyncHostConfig<Env extends SyncHostEnv = SyncHostEnv> = {
     /** Application DDL and optional seed, called before sync-core schema init. */
     initialize(sql: SyncSql): void;
     authenticate(request: Request, env: Env): NormalizedClaims | null | Promise<NormalizedClaims | null>;
+    /** Authorize authenticated application access before selecting a namespace DO. */
+    authorize(request: Request, claims: NormalizedClaims, namespace: string, env: Env): boolean | Promise<boolean>;
     /** Authorize the advisory wake socket before selecting a namespace DO.
      * Browser clients should present a short-lived, namespace-scoped capability
      * in the query string because WebSocket cannot set request headers. */

package/dist/types.js

@@ -1,5 +1 @@
-/** Preserve mutator names while making the host-facing registry immutable. */
-export function registerMutators(registry) {
-    return Object.freeze({ ...registry });
-}
-export { MutationApplicationError, isMutationApplicationError } from './mutation-error.js';
+export { visibility, } from './visibility.js';

package/dist/visibility.d.ts

@@ -0,0 +1,12 @@
+import type { VisibilityExpression, VisibilityFilter, VisibilityOperand, VisibilityValue } from 'orez-sync-executor';
+export type { VisibilityExpression, VisibilityFilter, VisibilityOperand, VisibilityValue, } from 'orez-sync-executor';
+export declare const visibility: {
+    readonly column: (table: string, column: string, qualifier?: string) => VisibilityOperand;
+    readonly value: (value: VisibilityValue) => VisibilityOperand;
+    readonly comparison: (left: VisibilityOperand, operator: "=" | "!=" | "<" | ">" | "<=" | ">=" | "IS" | "IS NOT", right: VisibilityOperand) => VisibilityExpression;
+    readonly and: (...conditions: VisibilityExpression[]) => VisibilityExpression;
+    readonly or: (...conditions: VisibilityExpression[]) => VisibilityExpression;
+    readonly exists: (table: string, where: VisibilityExpression, qualifier?: string) => VisibilityExpression;
+    readonly filter: (expression: VisibilityExpression) => VisibilityFilter;
+    readonly raw: (sql: string, params?: readonly VisibilityValue[]) => VisibilityFilter;
+};

package/dist/visibility.js

@@ -0,0 +1,30 @@
+export const visibility = {
+    column(table, column, qualifier) {
+        return qualifier
+            ? { type: 'column', table, column, qualifier }
+            : { type: 'column', table, column };
+    },
+    value(value) {
+        return { type: 'value', value };
+    },
+    comparison(left, operator, right) {
+        return { type: 'comparison', operator, left, right };
+    },
+    and(...conditions) {
+        return { type: 'and', conditions };
+    },
+    or(...conditions) {
+        return { type: 'or', conditions };
+    },
+    exists(table, where, qualifier) {
+        return qualifier
+            ? { type: 'exists', table, qualifier, where }
+            : { type: 'exists', table, where };
+    },
+    filter(expression) {
+        return { kind: 'expression', expression };
+    },
+    raw(sql, params = []) {
+        return { kind: 'raw', sql, params };
+    },
+};

package/package.json

@@ -1,20 +1,12 @@
 {
   "name": "orez-sync-cf-host",
-  "version": "0.5.30",
+  "version": "0.5.34",
   "type": "module",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
-    "./post-commit": {
-      "types": "./dist/post-commit.d.ts",
-      "import": "./dist/post-commit.js"
-    },
-    "./mutation-error": {
-      "types": "./dist/mutation-error.d.ts",
-      "import": "./dist/mutation-error.js"
-    },
     "./node-wasm-loader": {
       "types": "./dist/node-wasm-loader.d.ts",
       "import": "./dist/node-wasm-loader.js"
@@ -31,6 +23,10 @@
       "types": "./dist/transaction-query.d.ts",
       "import": "./dist/transaction-query.js"
     },
+    "./visibility": {
+      "types": "./dist/visibility.d.ts",
+      "import": "./dist/visibility.js"
+    },
     "./vite-wasm-loader": {
       "types": "./dist/vite-wasm-loader.d.ts",
       "import": "./dist/vite-wasm-loader.js"
@@ -49,7 +45,7 @@
     "bundle": "bun run build:dist && wrangler deploy --dry-run --outdir .wrangler/bundle",
     "measure": "bun run build:dist && bun measure.mjs",
     "test": "bun run test:config && bun run test:query-compiler && bun run test:package && bun run test:platform && bun run test:integration && bun run test:ingest && bun run test:restart",
-    "test:config": "bun test config.test.mjs write-safeguards.test.mjs mutation-error.test.mjs post-commit.test.mjs transaction-query.test.mjs",
+    "test:config": "bun test config.test.mjs write-safeguards.test.mjs transaction-query.test.mjs",
     "test:integration": "bun run build:dist && bun integration-test.mjs",
     "test:ingest": "bun run build:dist && bun ingest-test.mjs",
     "test:package": "bun run build:dist && node package-runtime-test.mjs",
@@ -58,6 +54,9 @@
     "test:platform": "bun run build:dist:platform && bun platform-test.mjs",
     "typecheck": "bun run build:dist:platform && tsc --noEmit"
   },
+  "dependencies": {
+    "orez-sync-executor": "0.5.34"
+  },
   "devDependencies": {
     "@cloudflare/workers-types": "4.20260617.1",
     "@types/bun": "1.3.14",
@@ -67,6 +66,7 @@
     "wrangler": "4.103.0"
   },
   "peerDependencies": {
+    "@rocicorp/zero": ">=1.7.0",
     "vite": ">=5"
   },
   "peerDependenciesMeta": {

package/dist/mutation-error.d.ts

@@ -1,9 +0,0 @@
-export declare class MutationApplicationError extends Error {
-    readonly details: string;
-    constructor(details: string, message?: string);
-}
-export declare function isMutationApplicationError(error: unknown): error is {
-    name: string;
-    message: string;
-    details: string;
-};

package/dist/mutation-error.js

@@ -1,23 +0,0 @@
-// the app-rejection contract shared by every orez sync host and by
-// protocol-neutral authoring layers (on-zero adapters). classification is
-// STRUCTURAL, never instanceof: adapters must not depend on orez to reject a
-// mutation, and instanceof breaks across package copies (dual-package
-// installs, --into tarballs, workspace duplication). any error whose name is
-// 'MutationApplicationError' with string details/message is claiming this
-// contract deliberately.
-export class MutationApplicationError extends Error {
-    details;
-    constructor(details, message = details) {
-        super(message);
-        this.details = details;
-        this.name = 'MutationApplicationError';
-    }
-}
-export function isMutationApplicationError(error) {
-    if (typeof error !== 'object' || error === null)
-        return false;
-    const shaped = error;
-    return (shaped.name === 'MutationApplicationError' &&
-        typeof shaped.message === 'string' &&
-        typeof shaped.details === 'string');
-}

package/dist/post-commit.d.ts

@@ -1,13 +0,0 @@
-export type DeferredEffect = () => void | Promise<void>;
-export type PostCommitEffects = {
-    /** discard effects from a storage-transaction attempt before starting another */
-    beginAttempt(): void;
-    defer(effect: DeferredEffect): void;
-    /** run the committed attempt's effects in order without rejecting */
-    runAfterCommit(onError: (error: unknown) => void): Promise<void>;
-};
-/**
- * collect external work during a retryable transaction and run only the effects
- * belonging to the attempt that commits.
- */
-export declare function createPostCommitEffects(): PostCommitEffects;

package/dist/post-commit.js

@@ -1,31 +0,0 @@
-/**
- * collect external work during a retryable transaction and run only the effects
- * belonging to the attempt that commits.
- */
-export function createPostCommitEffects() {
-    const effects = [];
-    return {
-        beginAttempt() {
-            effects.length = 0;
-        },
-        defer(effect) {
-            effects.push(effect);
-        },
-        async runAfterCommit(onError) {
-            const committed = effects.splice(0);
-            for (const effect of committed) {
-                try {
-                    await effect();
-                }
-                catch (error) {
-                    try {
-                        onError(error);
-                    }
-                    catch {
-                        // reporting must not turn a committed effect failure into a rejection
-                    }
-                }
-            }
-        },
-    };
-}