snapback4 0.0.1 → 0.0.3

package/dist/replica/interpreter.js

@@ -0,0 +1,906 @@
+// The interpreter on the device: the same IR the server runs, over the
+// replica store, with the same meter and the same cursors, so a query is
+// `complete` inside the horizon and a predictable mutation runs locally
+// first (LLP 2000.000 §7.2, §7.3). Values are plain JSON here; the server's
+// tagged literals are untagged as they are read.
+import { canonicalJson, decodeCursor, encodeCursor } from "./cursor.js";
+export class Refused extends Error {
+    refusal;
+    constructor(refusal) {
+        super(`${refusal.code}: ${refusal.message}`);
+        this.refusal = refusal;
+    }
+}
+export const CEILINGS = { examined: 8192, ruleProbes: 8192, steps: 1_000_000, rowsWritten: 1024 };
+const untagged = (v) => {
+    if (v === null || typeof v !== "object")
+        return v;
+    if (Array.isArray(v))
+        return v.map(untagged);
+    const entries = Object.entries(v);
+    if (entries.length === 1) {
+        const [tag, inner] = entries[0];
+        switch (tag) {
+            case "Null": return null;
+            case "Bool":
+            case "Int":
+            case "String":
+            case "Id":
+            case "Bytes": return inner;
+            case "Array": return inner.map(untagged);
+            case "Row":
+            case "Map": return Object.fromEntries(Object.entries(inner).map(([k, x]) => [k, untagged(x)]));
+        }
+    }
+    return v;
+};
+/** A tagged literal from the IR as a plain value. */
+/** Every `.field` a rule reads, on any probe key or comparison. */
+function ruleFields(rule, out) {
+    if (typeof rule !== "object" || rule === null)
+        return;
+    const [kind, body] = Object.entries(rule)[0];
+    const term = (t) => { if (typeof t === "object" && t !== null && "Field" in t)
+        out.add(t.Field); };
+    switch (kind) {
+        case "Eq":
+        case "Ne":
+            body.forEach(term);
+            break;
+        case "And":
+        case "Or":
+            body.forEach((r) => ruleFields(r, out));
+            break;
+        case "Not":
+            ruleFields(body, out);
+            break;
+        case "Exists":
+        case "Created":
+            body.key.forEach(term);
+            break;
+    }
+}
+/** Whether a rule term is pinned by a scan's prefix expression. */
+function pinnedTerm(term, expression) {
+    if (expression === undefined)
+        return false;
+    if (term === "Viewer")
+        return typeof expression === "object" && expression !== null && expression.Input === "Viewer";
+    if (typeof term === "object" && term !== null && "Literal" in term)
+        return typeof expression === "object" && expression !== null && "Literal" in expression && canonicalJson(term.Literal) === canonicalJson(expression.Literal);
+    return false;
+}
+export function literal(v) {
+    if (v === "Null")
+        return null;
+    return untagged(v);
+}
+const tagOf = (v) => v === null || v === undefined ? 0 : typeof v === "boolean" ? 1 : typeof v === "number" ? 2 : typeof v === "string" ? 3 : Array.isArray(v) ? 7 : 6;
+/** The value model's total order over plain values. */
+export function totalCompare(a, b) {
+    const ta = tagOf(a), tb = tagOf(b);
+    if (ta !== tb)
+        return ta < tb ? -1 : 1;
+    switch (ta) {
+        case 0: return 0;
+        case 1: return a === b ? 0 : a ? 1 : -1;
+        case 2: return a < b ? -1 : a === b ? 0 : 1;
+        case 3: return a < b ? -1 : a === b ? 0 : 1;
+        case 7: {
+            const x = a, y = b;
+            for (let i = 0; i < Math.min(x.length, y.length); i++) {
+                const c = totalCompare(x[i], y[i]);
+                if (c !== 0)
+                    return c;
+            }
+            return x.length - y.length;
+        }
+        default: {
+            const x = Object.entries(a).sort(), y = Object.entries(b).sort();
+            if (x.length !== y.length)
+                return x.length - y.length;
+            for (let i = 0; i < x.length; i++) {
+                if (x[i][0] !== y[i][0])
+                    return x[i][0] < y[i][0] ? -1 : 1;
+                const c = totalCompare(x[i][1], y[i][1]);
+                if (c !== 0)
+                    return c;
+            }
+            return 0;
+        }
+    }
+}
+export function equal(a, b) {
+    return totalCompare(a, b) === 0;
+}
+class Flow {
+    kind;
+    value;
+    constructor(kind, value) {
+        this.kind = kind;
+        this.value = value;
+    }
+}
+/** Runs programs over one store transaction. */
+export class Interpreter {
+    tx;
+    schema;
+    ctx;
+    mode;
+    ceilings;
+    env = new Map();
+    examined = 0;
+    probes = 0;
+    steps = 0;
+    written = 0;
+    capped = false;
+    beyondHorizon = false;
+    page = null;
+    pageDepth = 0;
+    created = new Set();
+    tables = new Set();
+    writes = [];
+    site = "";
+    constructor(tx, schema, ctx, mode, ceilings = CEILINGS) {
+        this.tx = tx;
+        this.schema = schema;
+        this.ctx = ctx;
+        this.mode = mode;
+        this.ceilings = ceilings;
+        for (const [k, v] of Object.entries(ctx.args))
+            this.env.set(k, v);
+    }
+    charge(kind, n = 1) {
+        if (kind === "examined")
+            this.examined += n;
+        else
+            this.probes += n;
+        const over = kind === "examined" ? this.examined > this.ceilings.examined : this.probes > this.ceilings.ruleProbes;
+        if (!over)
+            return true;
+        if (this.mode === "mutation")
+            throw new Refused({ code: "E_BOUND", family: "bound", message: `${kind === "examined" ? "examined rows" : "rule probes"} reached the ceiling at ${this.site}`, site: this.site });
+        this.capped = true;
+        return false;
+    }
+    step(n = 1) {
+        this.steps += n;
+        if (this.steps > this.ceilings.steps)
+            throw new Refused({ code: "E_BOUND", family: "bound", message: `steps reached ${this.steps} against the ceiling ${this.ceilings.steps}`, site: this.site });
+    }
+    async run(program) {
+        // An omitted optional argument (or cursor) reads as null, as on the server.
+        for (const [name, kind] of Object.entries(program.args)) {
+            if (!this.env.has(name) && (kind === "Cursor" || (typeof kind === "object" && kind !== null && "Optional" in kind)))
+                this.env.set(name, null);
+        }
+        const flow = await this.statements(program.body, program.name);
+        const data = flow instanceof Flow && flow.kind === "return" ? flow.value : null;
+        return { data, complete: !this.capped && !this.beyondHorizon, next: this.capped ? null : this.nextCursor(), tables: this.tables };
+    }
+    nextCursor() {
+        if (!this.page || !this.page.next)
+            return null;
+        const table = this.schema.tables[this.page.table];
+        const columns = table.indexes[this.page.index].components.map((c) => ("Column" in c ? c.Column : "")).slice(this.page.prefixLen);
+        const suffix = columns.map((name) => ({ name, kind: (name === "id" ? "Id" : table.columns[name]) }));
+        return encodeCursor({ table: this.page.table, index: this.page.index, order: this.page.order, suffix, values: this.page.next });
+    }
+    async statements(stmts, prefix) {
+        for (let i = 0; i < stmts.length; i++) {
+            this.site = `${prefix}:${i + 1}`;
+            this.step();
+            const raw = stmts[i];
+            if (raw === "Break")
+                return new Flow("break");
+            if (raw === "Continue")
+                return new Flow("continue");
+            const [kind, body] = Object.entries(raw)[0];
+            switch (kind) {
+                case "Const":
+                case "Let":
+                case "Assign":
+                    this.env.set(body.name, await this.expr(body.value));
+                    break;
+                case "Push": {
+                    const value = await this.expr(body.value);
+                    const target = this.env.get(body.target);
+                    if (!Array.isArray(target))
+                        throw new Refused({ code: "E_TYPE", family: "input", message: `push into ${body.target}` });
+                    target.push(value);
+                    break;
+                }
+                case "If": {
+                    const c = await this.expr(body.condition);
+                    const flow = await this.statements((c ? body.then_body : body.else_body), `${this.site}:${c ? "then" : "else"}`);
+                    if (flow)
+                        return flow;
+                    break;
+                }
+                case "For": {
+                    const items = await this.domain(body.domain);
+                    const isPage = typeof body.domain === "object" && body.domain !== null && ("Page" in body.domain || "Recurse" in body.domain);
+                    if (isPage)
+                        this.pageDepth++;
+                    let result;
+                    for (const item of items) {
+                        this.env.set(body.binding, item);
+                        const flow = await this.statements(body.body, this.site);
+                        if (flow?.kind === "break")
+                            break;
+                        if (flow?.kind === "return") {
+                            result = flow;
+                            break;
+                        }
+                    }
+                    if (isPage)
+                        this.pageDepth--;
+                    if (result)
+                        return result;
+                    break;
+                }
+                case "Require": {
+                    if (!(await this.expr(body.condition)))
+                        throw new Refused({ code: body.code, family: "rule", message: `the program refused with ${body.code}`, rule: body.code, site: body.site ?? this.site });
+                    break;
+                }
+                case "Check": {
+                    if (!(await this.expr(body.condition)))
+                        throw new Refused({ code: "E_CONFLICT", family: "constraint", message: "the row no longer matches the update condition", retryable: true });
+                    break;
+                }
+                case "InsertIfAbsent": {
+                    const row = (await this.expr(body.row));
+                    const inserted = await this.insert(body.table, row, true);
+                    this.env.set(body.result, inserted ? row : null);
+                    break;
+                }
+                case "Insert":
+                    await this.insert(body.table, (await this.expr(body.row)), false);
+                    break;
+                case "Update":
+                    await this.update(body.table, (await this.expr(body.key)), (await this.expr(body.patch)));
+                    break;
+                case "Upsert":
+                    await this.upsert(body.table, (await this.expr(body.key)), (await this.expr(body.row)));
+                    break;
+                case "Delete":
+                    await this.delete(body.table, (await this.expr(body.key)));
+                    break;
+                case "Emit": throw new Refused({ code: "E_PREDICT", family: "predict", message: "effects run on the server; this write is not predicted", retryable: true });
+                case "Return": return new Flow("return", await this.expr(body));
+                default: throw new Refused({ code: "E_SCHEMA", family: "schema", message: `unknown statement ${kind}` });
+            }
+        }
+        return undefined;
+    }
+    async domain(domain) {
+        const [kind, body] = Object.entries(domain)[0];
+        switch (kind) {
+            case "Page": return this.scan(body);
+            case "LiteralRange": {
+                const out = [];
+                for (let i = body.start; i < body.end_exclusive; i++)
+                    out.push(i);
+                return out;
+            }
+            case "ArgList": {
+                const v = this.env.get(body.name);
+                if (!Array.isArray(v))
+                    return [];
+                if (v.length > body.max)
+                    throw new Refused({ code: "E_FANOUT", family: "bound", message: "more items than the bound" });
+                return v;
+            }
+            case "DerivedArray": {
+                const v = await this.expr(body.value);
+                if (!Array.isArray(v))
+                    return [];
+                if (v.length > body.max)
+                    throw new Refused({ code: "E_FANOUT", family: "bound", message: "more items than the bound" });
+                return v;
+            }
+            case "Recurse": return this.recurse(body);
+            default: throw new Refused({ code: "E_SCHEMA", family: "schema", message: `unknown loop domain ${kind}` });
+        }
+    }
+    async recurse(r) {
+        const seed = await this.expr(r.seed);
+        const queue = [[seed, 0]];
+        const visited = new Set();
+        const rows = [];
+        while (queue.length) {
+            const [key, depth] = queue.shift();
+            if (depth > r.depth || visited.has(canonicalJson(key)))
+                continue;
+            visited.add(canonicalJson(key));
+            const row = await this.get({ site: r.site, table: r.table, index: r.index, key: [{ Literal: tag(key) }] });
+            if (row === null)
+                continue;
+            rows.push(row);
+            const next = row[r.next_field];
+            if (next === null || next === undefined)
+                continue;
+            if (Array.isArray(next)) {
+                if (next.length > r.fanout)
+                    throw new Refused({ code: "E_FANOUT", family: "bound", message: "walk fan-out exceeds the bound" });
+                for (const n of next)
+                    queue.push([n, depth + 1]);
+            }
+            else
+                queue.push([next, depth + 1]);
+        }
+        return rows;
+    }
+    async expr(e) {
+        this.step();
+        if (typeof e === "string") {
+            // Unit variants appear as bare strings.
+            throw new Refused({ code: "E_SCHEMA", family: "schema", message: `bare expression ${e}` });
+        }
+        const [kind, body] = Object.entries(e)[0];
+        switch (kind) {
+            case "Literal": return literal(body);
+            case "Variable": {
+                if (!this.env.has(body))
+                    throw new Refused({ code: "E_INPUT", family: "input", message: `unknown variable ${body}` });
+                return this.env.get(body);
+            }
+            case "Input": switch (body) {
+                case "Viewer": return this.ctx.viewer;
+                case "Now": return this.ctx.now;
+                case "NewId": return this.ctx.newIds.shift() ?? this.ctx.mint();
+                default: return this.ctx.now;
+            }
+            case "Field": {
+                const b = body;
+                const base = await this.expr(b.base);
+                if (base === null || base === undefined)
+                    return null;
+                if (typeof base !== "object")
+                    throw new Refused({ code: "E_FIELD", family: "input", message: `no field ${b.name}` });
+                return base[b.name] ?? null;
+            }
+            case "Array": {
+                const out = [];
+                for (const item of body)
+                    out.push(await this.expr(item));
+                return out;
+            }
+            case "Object": {
+                const out = {};
+                for (const [k, v] of Object.entries(body))
+                    out[k] = await this.expr(v);
+                return out;
+            }
+            case "Binary": {
+                const b = body;
+                const left = await this.expr(b.left);
+                if (b.op === "And" && !left)
+                    return false;
+                if (b.op === "Or" && left)
+                    return true;
+                const right = await this.expr(b.right);
+                switch (b.op) {
+                    case "Eq": return equal(left, right);
+                    case "Ne": return !equal(left, right);
+                    case "Lt": return totalCompare(left, right) < 0;
+                    case "Lte": return totalCompare(left, right) <= 0;
+                    case "Gt": return totalCompare(left, right) > 0;
+                    case "Gte": return totalCompare(left, right) >= 0;
+                    case "Add": return num(left) + num(right);
+                    case "Sub": return num(left) - num(right);
+                    case "Mul": return num(left) * num(right);
+                    case "And": return Boolean(left) && Boolean(right);
+                    case "Or": return Boolean(left) || Boolean(right);
+                    default: return equal(left, right);
+                }
+            }
+            case "Unary": {
+                const b = body;
+                const v = await this.expr(b.value);
+                return b.op === "Not" ? !v : -num(v);
+            }
+            case "Builtin": return this.builtin(body);
+            case "Get": return this.get(body);
+            case "Exists": return (await this.get(body)) !== null;
+            case "Scan": return this.scan(body);
+            case "Merge": return this.merge(body);
+            default: throw new Refused({ code: "E_SCHEMA", family: "schema", message: `unknown expression ${kind}` });
+        }
+    }
+    async builtin(b) {
+        const args = [];
+        for (const a of b.args)
+            args.push(await this.expr(a));
+        const name = typeof b.builtin === "string" ? b.builtin : Object.keys(b.builtin)[0];
+        switch (name) {
+            case "Len":
+            case "Count":
+            case "CountCapped": {
+                const v = args[0];
+                return typeof v === "string" ? [...v].length : Array.isArray(v) ? v.length : v && typeof v === "object" ? Object.keys(v).length : 0;
+            }
+            case "Sum": return args[0].reduce((s, x) => s + x, 0);
+            case "Slice": {
+                const [v, s, e] = args;
+                const start = Math.max(0, s), end = Math.max(0, e);
+                return typeof v === "string" ? [...v].slice(start, end).join("") : v.slice(start, end);
+            }
+            case "Concat": {
+                const [l, r] = args;
+                return Array.isArray(l) && Array.isArray(r) ? [...l, ...r] : `${String(l ?? "")}${String(r ?? "")}`;
+            }
+            case "Min": return totalCompare(args[0], args[1]) <= 0 ? args[0] : args[1];
+            case "Max": return totalCompare(args[0], args[1]) >= 0 ? args[0] : args[1];
+            case "Divmod": {
+                const [n, d] = args;
+                if (d === 0)
+                    throw new Refused({ code: "E_DIV_ZERO", family: "input", message: "division by zero" });
+                const q = Math.floor(n / d);
+                return { quotient: q, remainder: n - q * d, sink: "lexicographic-id" };
+            }
+            case "Sort": {
+                const keys = b.builtin.Sort.keys;
+                return [...args[0]].sort((x, y) => { for (const k of keys) {
+                    const c = totalCompare(x[k.field], y[k.field]);
+                    if (c !== 0)
+                        return k.order === "Desc" ? -c : c;
+                } return 0; });
+            }
+            case "MentionTokens": {
+                const seen = new Set();
+                const out = [];
+                for (const w of String(args[0]).split(/[\s,;()[\]{}<>"']+/)) {
+                    if (!w.startsWith("@"))
+                        continue;
+                    const t = w.slice(1).replace(/^[^\p{L}\p{N}_]+|[^\p{L}\p{N}_]+$/gu, "");
+                    if (t && !seen.has(t)) {
+                        seen.add(t);
+                        out.push(t);
+                    }
+                }
+                return out;
+            }
+            case "DeterministicShare": {
+                const [amount, list, who] = args;
+                const sorted = [...list].sort(totalCompare);
+                const at = sorted.findIndex((x) => equal(x, who));
+                if (at < 0)
+                    throw new Refused({ code: "E_INPUT", family: "input", message: "recipient missing from shares" });
+                const n = sorted.length;
+                const base = Math.floor(amount / n);
+                return base + (at < amount - base * n ? 1 : 0);
+            }
+            default: throw new Refused({ code: "E_SCHEMA", family: "schema", message: `unknown builtin ${name}` });
+        }
+    }
+    // ----- reads -----
+    async get(read) {
+        const key = [];
+        for (const k of read.key)
+            key.push(await this.expr(k));
+        this.site = read.site;
+        this.tables.add(read.table);
+        const table = this.schema.tables[read.table];
+        if (!table)
+            throw new Refused({ code: "E_SCHEMA", family: "schema", message: `unknown table ${read.table}` });
+        if (!table.sync)
+            this.beyondHorizon = true;
+        // Absent, hidden or visible: one examined row; the probes that decided
+        // a hidden row are rolled back, as on the server.
+        const mark = { probes: this.probes, capped: this.capped };
+        const row = await this.tx.lookup(read.table, read.index, key);
+        if (!this.charge("examined"))
+            return null;
+        if (!row)
+            return null;
+        if (await this.readable(read.table, row))
+            return row;
+        this.probes = mark.probes;
+        this.capped = mark.capped;
+        return null;
+    }
+    async scan(scan) {
+        const table = scan.table, index = scan.index;
+        const prefix = [];
+        for (const p of scan.prefix)
+            prefix.push(p.Scalar === undefined ? null : await this.expr(p.Scalar));
+        const definition = this.schema.tables[table];
+        if (!definition)
+            throw new Refused({ code: "E_SCHEMA", family: "schema", message: `unknown table ${table}` });
+        this.tables.add(table);
+        this.site = scan.site;
+        if (!definition.sync)
+            this.beyondHorizon = true;
+        const take = typeof scan.take === "object" && scan.take !== null && "Literal" in scan.take ? scan.take.Literal : num(this.env.get(scan.take.Arg.name));
+        const order = scan.order;
+        const bounds = {};
+        if (scan.after) {
+            const after = await this.expr(scan.after);
+            if (after !== null && after !== undefined) {
+                if (scan.opaque_cursor) {
+                    const position = decodeCursor(String(after));
+                    if (!position || position.table !== table || position.index !== index || position.order !== order)
+                        throw new Refused({ code: "E_INPUT", family: "input", message: "cursor: the token names another scope" });
+                    bounds.after = position.values;
+                }
+                else
+                    bounds.after = Array.isArray(after) ? after : [after];
+            }
+        }
+        if (scan.before) {
+            const before = await this.expr(scan.before);
+            if (before !== null && before !== undefined)
+                bounds.before = Array.isArray(before) ? before : [before];
+        }
+        if (scan.range) {
+            const r = scan.range;
+            for (const k of ["gt", "gte", "lt", "lte"])
+                if (r[k])
+                    bounds[k] = await this.expr(r[k]);
+        }
+        const dir = order === "Asc" ? "asc" : "desc";
+        const visible = [];
+        let lastKey = null;
+        let hasMore = false;
+        let cursor = { ...bounds };
+        const batch = take + 1;
+        const { uniform, decidedTrue } = this.visibility(table, index, scan.prefix);
+        let verdict = decidedTrue ? true : null;
+        const mark = { examined: this.examined, probes: this.probes, capped: this.capped };
+        outer: for (;;) {
+            const fetched = await this.tx.scan(table, index, prefix, cursor, dir, batch);
+            if (fetched.length === 0)
+                break;
+            for (const { row, key } of fetched) {
+                if (!this.charge("examined"))
+                    break outer;
+                let allowed;
+                if (verdict !== null)
+                    allowed = verdict;
+                else {
+                    allowed = await this.readable(table, row);
+                    if (uniform)
+                        verdict = allowed;
+                }
+                if (this.capped)
+                    break outer;
+                if (allowed) {
+                    if (visible.length === take) {
+                        hasMore = true;
+                        break outer;
+                    }
+                    visible.push(row);
+                    lastKey = key;
+                }
+                else if (uniform) {
+                    // One hidden row hides the prefix: stop without reading it, at
+                    // the cost of an empty range.
+                    this.examined = mark.examined;
+                    this.probes = mark.probes;
+                    this.capped = mark.capped;
+                    break outer;
+                }
+                cursor = { ...cursor, after: suffixOf(this.schema, table, index, row, prefix.length) };
+            }
+            if (fetched.length < batch)
+                break;
+        }
+        // Inside the horizon, a short page is the whole group; at the horizon
+        // it may continue on the server.
+        const horizon = definition.sync?.horizon;
+        if (horizon && !hasMore && !this.capped && horizon.by === index) {
+            const held = await this.tx.count(table, index, prefix, horizon.last);
+            if (held >= horizon.last)
+                this.beyondHorizon = true;
+        }
+        if (this.pageDepth === 0 && scan.opaque_cursor) {
+            const columns = definition.indexes[index].components.length;
+            this.page = { table, index, order, prefixLen: prefix.length, next: hasMore && lastKey && visible.length ? suffixOf(this.schema, table, index, visible[visible.length - 1], prefix.length).slice(0, columns - prefix.length) : null };
+        }
+        return visible;
+    }
+    async merge(merge) {
+        const lanes = merge.lanes;
+        const first = lanes[0]?.scan;
+        if (!first)
+            return [];
+        const table = first.table, index = first.index, order = first.order;
+        const take = first.take.Literal;
+        const columns = this.schema.tables[table].indexes[index].components.map((c) => ("Column" in c ? c.Column : ""));
+        const prefixLen = first.prefix.length;
+        const suffixColumns = columns.slice(prefixLen);
+        const candidates = [];
+        const seen = new Set();
+        const depth = this.pageDepth;
+        for (const lane of lanes) {
+            const sources = lane.source ? await (async () => { this.pageDepth++; const r = await this.scan(lane.source); this.pageDepth--; return r; })() : [null];
+            for (const source of sources) {
+                if (lane.source)
+                    this.env.set(lane.binding, source);
+                await this.statements(lane.setup ?? [], merge.site);
+                this.pageDepth++;
+                const rows = await this.scan(lane.scan);
+                this.pageDepth = depth;
+                for (const row of rows) {
+                    if (seen.has(row.id))
+                        continue;
+                    seen.add(row.id);
+                    candidates.push({ key: suffixColumns.map((c) => row[c] ?? null), row });
+                }
+            }
+        }
+        candidates.sort((a, b) => { const c = totalCompare(a.key, b.key); return order === "Asc" ? c : -c; });
+        const hasMore = candidates.length > take;
+        const page = candidates.slice(0, take);
+        if (this.pageDepth === 0 && first.opaque_cursor)
+            this.page = { table, index, order, prefixLen, next: hasMore && page.length ? page[page.length - 1].key : null };
+        return page.map((c) => c.row);
+    }
+    /** The server's `scan_visibility`, on the device: a read rule whose every
+     * field the prefix pins is decided once for the whole range (`uniform`);
+     * one the prefix proves is `decidedTrue` before any row is read. A
+     * uniform-false range halts after one row at the cost of an empty one,
+     * so the rows the viewer may no longer read (delivered history) are never
+     * counted. */
+    visibility(table, index, prefix) {
+        const definition = this.schema.tables[table];
+        const rule = definition.rules.read;
+        const pinned = new Map();
+        definition.indexes[index].components.forEach((component, n) => {
+            if ("Column" in component && n < prefix.length && prefix[n].Scalar !== undefined)
+                pinned.set(component.Column, prefix[n].Scalar);
+        });
+        const decidedTrue = this.ruleTrue(rule, table, pinned);
+        const used = new Set();
+        ruleFields(rule, used);
+        return { uniform: decidedTrue || [...used].every((field) => pinned.has(field)), decidedTrue };
+    }
+    ruleTrue(rule, table, pinned) {
+        if (rule === "Allow")
+            return true;
+        if (typeof rule !== "object" || rule === null)
+            return false;
+        const [kind, body] = Object.entries(rule)[0];
+        switch (kind) {
+            case "Public": return true;
+            case "Eq": {
+                const [a, b] = body;
+                return [[a, b], [b, a]].some(([field, value]) => typeof field === "object" && field !== null && "Field" in field && pinnedTerm(value, pinned.get(field.Field)));
+            }
+            case "Or": return body.some((r) => this.ruleTrue(r, table, pinned));
+            case "And": return body.length > 0 && body.every((r) => this.ruleTrue(r, table, pinned));
+            case "Exists": {
+                // A self-probe on a total unique key whose every component is the
+                // row's own column or pinned to the probing value holds for every
+                // row the prefix selects.
+                const b = body;
+                if (b.table !== table)
+                    return false;
+                const definition = this.schema.tables[table];
+                const index = definition.indexes[b.index];
+                if (!index || !index.unique || b.key.length === 0 || b.key.length !== index.components.length)
+                    return false;
+                return index.components.every((component, n) => {
+                    if (!("Column" in component))
+                        return false;
+                    const type = definition.columns[component.Column];
+                    if (typeof type === "object" && type !== null && "Optional" in type)
+                        return false;
+                    const term = b.key[n];
+                    if (typeof term === "object" && term !== null && "Field" in term)
+                        return term.Field === component.Column;
+                    return pinnedTerm(term, pinned.get(component.Column));
+                });
+            }
+            default: return false;
+        }
+    }
+    /** The read rule for one row, with probes over the replica. */
+    async readable(table, row) {
+        const rule = this.schema.tables[table].rules.read;
+        return this.rule(rule, undefined, row, false);
+    }
+    async rule(rule, old, next, insert) {
+        if (rule === "Allow")
+            return true;
+        if (rule === "Deny")
+            return false;
+        const [kind, body] = Object.entries(rule)[0];
+        const term = (t) => {
+            if (t === "Viewer")
+                return this.ctx.viewer;
+            const [k, v] = Object.entries(t)[0];
+            if (k === "Field" || k === "NextField")
+                return next[v] ?? null;
+            if (k === "OldField")
+                return old?.[v] ?? null;
+            return literal(v);
+        };
+        switch (kind) {
+            case "Public": return true;
+            case "Eq": return equal(term(body[0]), term(body[1]));
+            case "Ne": return !equal(term(body[0]), term(body[1]));
+            case "And":
+                for (const r of body)
+                    if (!(await this.rule(r, old, next, insert)))
+                        return false;
+                return true;
+            case "Or":
+                for (const r of body)
+                    if (await this.rule(r, old, next, insert))
+                        return true;
+                return false;
+            case "Not": return !(await this.rule(body, old, next, insert));
+            case "Exists": {
+                const b = body;
+                if (!this.charge("probes"))
+                    return false;
+                this.tables.add(b.table);
+                return (await this.tx.lookup(b.table, b.index, b.key.map(term))) !== undefined;
+            }
+            case "Created": {
+                const b = body;
+                return this.created.has(`${b.table}\u0000${b.index}\u0000${canonicalJson(b.key.map(term))}`);
+            }
+            default: return false;
+        }
+    }
+    // ----- writes (predictions) -----
+    async permitted(table, effect, old, next) {
+        const rules = this.schema.tables[table].rules;
+        if (!(await this.rule(rules[effect], old, next, effect === "insert")))
+            throw new Refused({ code: "E_RULE", family: "auth", message: `${table}'s ${effect} rule does not admit this viewer` });
+    }
+    async constraints(table, old, row, effect) {
+        const definition = this.schema.tables[table];
+        for (const [name, index] of Object.entries(definition.indexes)) {
+            if (!index.unique)
+                continue;
+            const columns = index.components.map((c) => ("Column" in c ? c.Column : ""));
+            const key = columns.map((c) => row[c] ?? null);
+            if (key.some((v) => v === null))
+                continue;
+            const hit = await this.tx.lookup(table, name, key);
+            if (hit && hit.id !== row.id)
+                throw new Refused({ code: "E_CONSTRAINT", family: "constraint", message: `${table} already has a row where ${columns.join(", ")} = ${key.map(String).join(", ")}` });
+        }
+        for (const constraint of definition.constraints ?? []) {
+            if (typeof constraint !== "object" || constraint === null)
+                continue;
+            if ("Cap" in constraint) {
+                const { by, max } = constraint.Cap;
+                const group = by.map((c) => row[c] ?? null);
+                const moved = !old || by.some((c) => !equal(old[c] ?? null, row[c] ?? null));
+                if (!moved)
+                    continue;
+                const index = Object.entries(definition.indexes).find(([, i]) => by.every((c, n) => i.components[n]?.Column === c))?.[0];
+                if (!index)
+                    continue;
+                if ((await this.tx.count(table, index, group, max + 1)) >= max)
+                    throw new Refused({ code: "E_CONSTRAINT", family: "constraint", message: `${table} holds at most ${max} rows where ${by.join(", ")} = ${group.map(String).join(", ")}` });
+            }
+            if ("Immutable" in constraint && old && effect === "update") {
+                for (const field of constraint.Immutable.fields)
+                    if (!equal(old[field] ?? null, row[field] ?? null))
+                        throw new Refused({ code: "E_CONSTRAINT", family: "constraint", message: `${table}.${field} is immutable` });
+            }
+        }
+    }
+    async insert(table, row, ifAbsent) {
+        this.tables.add(table);
+        await this.permitted(table, "insert", undefined, row);
+        if (ifAbsent) {
+            for (const [name, index] of Object.entries(this.schema.tables[table].indexes)) {
+                if (!index.unique)
+                    continue;
+                const key = index.components.map((c) => ("Column" in c ? row[c.Column] ?? null : null));
+                if (await this.tx.lookup(table, name, key))
+                    return false;
+            }
+        }
+        if (await this.tx.get(table, row.id))
+            throw new Refused({ code: "E_CONSTRAINT", family: "constraint", message: `${table} already has a row with id ${row.id}` });
+        await this.constraints(table, undefined, row, "insert");
+        await this.put(table, { ...row, pending: true });
+        for (const [name, index] of Object.entries(this.schema.tables[table].indexes))
+            this.created.add(`${table}\u0000${name}\u0000${canonicalJson(index.components.map((c) => ("Column" in c ? row[c.Column] ?? null : null)))}`);
+        return true;
+    }
+    async update(table, id, patch) {
+        this.tables.add(table);
+        const old = await this.tx.get(table, id);
+        if (!old)
+            throw new Refused({ code: "NOT_FOUND", family: "rule", message: "the row does not exist on this device", rule: "NOT_FOUND" });
+        const next = { ...old, ...patch, pending: true };
+        await this.permitted(table, "update", old, next);
+        await this.constraints(table, old, next, "update");
+        await this.put(table, next, old);
+    }
+    async upsert(table, id, row) {
+        const old = await this.tx.get(table, id);
+        if (old)
+            return this.update(table, id, row);
+        await this.insert(table, row, false);
+    }
+    async delete(table, id) {
+        this.tables.add(table);
+        const old = await this.tx.get(table, id);
+        if (!old)
+            throw new Refused({ code: "NOT_FOUND", family: "rule", message: "the row does not exist on this device", rule: "NOT_FOUND" });
+        await this.permitted(table, "delete", undefined, old);
+        this.written++;
+        if (this.written > this.ceilings.rowsWritten)
+            throw new Refused({ code: "E_BOUND", family: "bound", message: "rows written reached the ceiling", site: this.site });
+        await this.tx.delete(table, id);
+        this.writes.push({ table, row: old, old });
+        await this.maintain(table, old, undefined);
+    }
+    async put(table, row, old) {
+        this.written++;
+        if (this.written > this.ceilings.rowsWritten)
+            throw new Refused({ code: "E_BOUND", family: "bound", message: "rows written reached the ceiling", site: this.site });
+        await this.tx.put(table, row);
+        this.writes.push(old ? { table, row, old } : { table, row });
+        await this.maintain(table, old, row);
+    }
+    /** A device keeps its counts honest while a prediction stands. */
+    async maintain(source, old, next) {
+        for (const maintain of (this.schema.maintains ?? [])) {
+            if (maintain.source !== source)
+                continue;
+            const delta = (row, sign) => (row ? (maintain.kind === "Count" ? sign : sign * num(row[maintain.kind.Sum.of])) : 0);
+            const groups = new Map();
+            for (const [row, sign] of [[old, -1], [next, 1]]) {
+                if (!row)
+                    continue;
+                const key = maintain.by.map((c) => row[c] ?? null);
+                const id = canonicalJson(key.map(tag));
+                const g = groups.get(id) ?? { key, change: 0 };
+                g.change += delta(row, sign);
+                groups.set(id, g);
+            }
+            for (const [id, g] of groups) {
+                if (g.change === 0)
+                    continue;
+                const existing = await this.tx.get(maintain.target, id);
+                const value = num(existing?.value ?? 0) + g.change;
+                if (value === 0) {
+                    if (existing)
+                        await this.tx.delete(maintain.target, id);
+                    continue;
+                }
+                const row = { id, value, pending: true };
+                maintain.by.forEach((c, i) => { row[c] = g.key[i]; });
+                await this.tx.put(maintain.target, row);
+            }
+        }
+    }
+}
+function num(v) {
+    if (typeof v !== "number")
+        throw new Refused({ code: "E_TYPE", family: "input", message: `expected a number, got ${typeof v}` });
+    return v;
+}
+/** A plain value as the server's tagged literal (for canonical ids). */
+export function tag(v) {
+    if (v === null || v === undefined)
+        return "Null";
+    if (typeof v === "boolean")
+        return { Bool: v };
+    if (typeof v === "number")
+        return { Int: v };
+    if (typeof v === "string")
+        return { Id: v };
+    if (Array.isArray(v))
+        return { Array: v.map(tag) };
+    return { Row: Object.fromEntries(Object.entries(v).map(([k, x]) => [k, tag(x)])) };
+}
+function suffixOf(schema, table, index, row, prefixLen) {
+    const columns = schema.tables[table].indexes[index].components.map((c) => ("Column" in c ? c.Column : ""));
+    const suffix = columns.slice(prefixLen).map((c) => row[c] ?? null);
+    if (columns[columns.length - 1] !== "id")
+        suffix.push(row.id);
+    return suffix;
+}