sphica 0.6.13 → 0.6.15

package/dist/capture.js

@@ -11109,7 +11109,7 @@ var HOST_MARKS = new Set([".orphaned_at", ".in_use"]);
 
 // server/src/sqlite.ts
 var SCHEMA_GENERATION = 2;
-var SCHEMA_REVISION = 4;
+var SCHEMA_REVISION = 5;
 var sphicaHome = () => process.env.SPHICA_HOME || path2.join(os.homedir(), ".sphica");
 var dbFile = () => process.env.SPHICA_DB || path2.join(sphicaHome(), "sphica.db");
 function requireRuntime() {
@@ -11287,24 +11287,92 @@ function captureAuthorizer(own, action, p1, p2, triggerOrView) {
   return C2.SQLITE_DENY;
 }
 var writes = (action) => action === C2.SQLITE_INSERT || action === C2.SQLITE_UPDATE || action === C2.SQLITE_DELETE;
-var FORGET_ONLY = new Set(["forget_batch", "source_forgotten"]);
-var KEPT_BY_INGEST = new Set(["source", "unit_evidence", "unit_adoption"]);
-function ingestAuthorizer(action, p1, p2) {
+var INGEST_INSERTS = new Set([
+  "project",
+  "ingest_source",
+  "extraction_run",
+  "source_processing",
+  "unit",
+  "unit_option",
+  "unit_evidence",
+  "unit_adoption",
+  "unit_link",
+  "unit_state",
+  "unit_anchor",
+  "unit_alias",
+  "field_def",
+  "unit_field",
+  "work",
+  "artifact_link"
+]);
+var RETRACTION = [
+  "retracted_at",
+  "retraction_reason",
+  "retraction_source_id",
+  "retraction_span_start",
+  "retraction_span_end"
+];
+var INGEST_UPDATES = {
+  extraction_run: new Set(["status", "finished_at"]),
+  unit_anchor: new Set(["retired_at", "replaced_by"]),
+  unit_link: new Set(["resolved_at", "resolution"]),
+  unit_evidence: new Set(RETRACTION),
+  unit_adoption: new Set(RETRACTION),
+  work: new Set(["title", "goal", "current", "next", "status", "branch", "run_id", "updated_at"])
+};
+var INGEST_DELETES = new Set(["artifact_link"]);
+var INGEST_TRIGGER_WRITES = {
+  ingest_source_insert: ["insert source"],
+  source_fts_ai: ["insert source_fts"],
+  source_fts_ad: ["delete source_fts"],
+  unit_state_apply: ["update unit"],
+  unit_state_restore: ["insert unit_state"],
+  ...Object.fromEntries([
+    "evidence_i",
+    "evidence_u",
+    "evidence_d",
+    "adoption_i",
+    "adoption_u",
+    "adoption_d",
+    "link_i",
+    "link_u",
+    "anchor_i",
+    "anchor_u",
+    "alias_i",
+    "field_i",
+    "field_d"
+  ].map((t) => [`unit_rev_${t}`, ["update unit"]])),
+  unit_fts_ai: ["insert unit_fts"],
+  unit_fts_ad: ["delete unit_fts"],
+  ...Object.fromEntries(["option_i", "anchor_i", "anchor_u", "anchor_d", "alias_i", "alias_d", "field_i", "field_d"].map((t) => [
+    `unit_fts_${t}`,
+    ["delete unit_fts", "insert unit_fts"]
+  ]))
+};
+var opOf = (action) => action === C2.SQLITE_INSERT ? "insert" : action === C2.SQLITE_UPDATE ? "update" : action === C2.SQLITE_DELETE ? "delete" : undefined;
+function ingestAuthorizer(action, p1, p2, trigger) {
   if (DDL().has(action))
     return C2.SQLITE_DENY;
-  if (writes(action) && (p1 === "owner_identity" || FORGET_ONLY.has(p1 ?? "")))
-    return C2.SQLITE_DENY;
-  if (action === C2.SQLITE_DELETE && KEPT_BY_INGEST.has(p1 ?? ""))
-    return C2.SQLITE_DENY;
+  const op = opOf(action);
+  if (op) {
+    const table = p1 ?? "";
+    if (SHADOW.test(table))
+      return C2.SQLITE_OK;
+    if (trigger !== null)
+      return INGEST_TRIGGER_WRITES[trigger]?.includes(`${op} ${table}`) ? C2.SQLITE_OK : C2.SQLITE_DENY;
+    const allowed = op === "insert" ? INGEST_INSERTS.has(table) : op === "update" ? INGEST_UPDATES[table]?.has(p2 ?? "") : INGEST_DELETES.has(table);
+    return allowed ? C2.SQLITE_OK : C2.SQLITE_DENY;
+  }
   if (action === C2.SQLITE_PRAGMA)
     return readsDataVersion(p1, p2) ? C2.SQLITE_OK : C2.SQLITE_DENY;
-  return C2.SQLITE_OK;
+  if (action === C2.SQLITE_READ || action === C2.SQLITE_SELECT || action === C2.SQLITE_FUNCTION || action === C2.SQLITE_RECURSIVE || action === C2.SQLITE_TRANSACTION || action === C2.SQLITE_SAVEPOINT)
+    return C2.SQLITE_OK;
+  return C2.SQLITE_DENY;
 }
 var FORGET_WRITES = {
   [C2.SQLITE_INSERT]: new Set(["forget_batch", "source_forgotten", "unit_state", "source_fts", "unit_fts"]),
   [C2.SQLITE_DELETE]: new Set([
     "source",
-    "external_reference",
     "unit_evidence",
     "unit_adoption",
     "source_processing",
@@ -11344,7 +11412,7 @@ function connectWriter(role, file = dbFile(), create = false) {
     throw e;
   }
   if (role === "ingest")
-    raw.setAuthorizer(ingestAuthorizer);
+    raw.setAuthorizer((action, p1, p2, _db, trigger) => ingestAuthorizer(action, p1, p2, trigger));
   else if (role === "forget")
     raw.setAuthorizer(forgetAuthorizer);
   else if (role === "capture") {
@@ -11451,7 +11519,7 @@ function identify(dir) {
 function relativeTo(root, file, cwd = root) {
   const abs = path4.resolve(cwd, file);
   const rel = path4.relative(root, abs);
-  if (!rel || leaves(rel))
+  if (!rel || leaves(rel) || /\p{Cc}/u.test(rel))
     return null;
   return rel.split(path4.sep).join("/");
 }
@@ -11483,7 +11551,7 @@ var git2 = (root, args) => {
     return null;
   }
 };
-var usable = (p) => p !== "" && !p.includes("\\");
+var usable = (p) => p !== "" && !p.includes("\\") && !/\p{Cc}/u.test(p);
 function snapshot(root) {
   const out = git2(root, ["status", "--porcelain=v2", "-z", "--untracked-files=all"]);
   if (out === null)

package/dist/cli.js

@@ -3625,7 +3625,7 @@ ${indent}${caution(note)}` : ""}`);
 
 // server/src/sqlite.ts
 var SCHEMA_GENERATION = 2;
-var SCHEMA_REVISION = 4;
+var SCHEMA_REVISION = 5;
 var sphicaHome = () => process.env.SPHICA_HOME || path3.join(os2.homedir(), ".sphica");
 var dbFile = () => process.env.SPHICA_DB || path3.join(sphicaHome(), "sphica.db");
 function requireRuntime() {
@@ -14754,24 +14754,92 @@ function captureAuthorizer(own, action, p1, p2, triggerOrView) {
   return C2.SQLITE_DENY;
 }
 var writes = (action) => action === C2.SQLITE_INSERT || action === C2.SQLITE_UPDATE || action === C2.SQLITE_DELETE;
-var FORGET_ONLY = new Set(["forget_batch", "source_forgotten"]);
-var KEPT_BY_INGEST = new Set(["source", "unit_evidence", "unit_adoption"]);
-function ingestAuthorizer(action, p1, p2) {
+var INGEST_INSERTS = new Set([
+  "project",
+  "ingest_source",
+  "extraction_run",
+  "source_processing",
+  "unit",
+  "unit_option",
+  "unit_evidence",
+  "unit_adoption",
+  "unit_link",
+  "unit_state",
+  "unit_anchor",
+  "unit_alias",
+  "field_def",
+  "unit_field",
+  "work",
+  "artifact_link"
+]);
+var RETRACTION = [
+  "retracted_at",
+  "retraction_reason",
+  "retraction_source_id",
+  "retraction_span_start",
+  "retraction_span_end"
+];
+var INGEST_UPDATES = {
+  extraction_run: new Set(["status", "finished_at"]),
+  unit_anchor: new Set(["retired_at", "replaced_by"]),
+  unit_link: new Set(["resolved_at", "resolution"]),
+  unit_evidence: new Set(RETRACTION),
+  unit_adoption: new Set(RETRACTION),
+  work: new Set(["title", "goal", "current", "next", "status", "branch", "run_id", "updated_at"])
+};
+var INGEST_DELETES = new Set(["artifact_link"]);
+var INGEST_TRIGGER_WRITES = {
+  ingest_source_insert: ["insert source"],
+  source_fts_ai: ["insert source_fts"],
+  source_fts_ad: ["delete source_fts"],
+  unit_state_apply: ["update unit"],
+  unit_state_restore: ["insert unit_state"],
+  ...Object.fromEntries([
+    "evidence_i",
+    "evidence_u",
+    "evidence_d",
+    "adoption_i",
+    "adoption_u",
+    "adoption_d",
+    "link_i",
+    "link_u",
+    "anchor_i",
+    "anchor_u",
+    "alias_i",
+    "field_i",
+    "field_d"
+  ].map((t2) => [`unit_rev_${t2}`, ["update unit"]])),
+  unit_fts_ai: ["insert unit_fts"],
+  unit_fts_ad: ["delete unit_fts"],
+  ...Object.fromEntries(["option_i", "anchor_i", "anchor_u", "anchor_d", "alias_i", "alias_d", "field_i", "field_d"].map((t2) => [
+    `unit_fts_${t2}`,
+    ["delete unit_fts", "insert unit_fts"]
+  ]))
+};
+var opOf = (action) => action === C2.SQLITE_INSERT ? "insert" : action === C2.SQLITE_UPDATE ? "update" : action === C2.SQLITE_DELETE ? "delete" : undefined;
+function ingestAuthorizer(action, p1, p2, trigger) {
   if (DDL().has(action))
     return C2.SQLITE_DENY;
-  if (writes(action) && (p1 === "owner_identity" || FORGET_ONLY.has(p1 ?? "")))
-    return C2.SQLITE_DENY;
-  if (action === C2.SQLITE_DELETE && KEPT_BY_INGEST.has(p1 ?? ""))
-    return C2.SQLITE_DENY;
+  const op = opOf(action);
+  if (op) {
+    const table = p1 ?? "";
+    if (SHADOW.test(table))
+      return C2.SQLITE_OK;
+    if (trigger !== null)
+      return INGEST_TRIGGER_WRITES[trigger]?.includes(`${op} ${table}`) ? C2.SQLITE_OK : C2.SQLITE_DENY;
+    const allowed = op === "insert" ? INGEST_INSERTS.has(table) : op === "update" ? INGEST_UPDATES[table]?.has(p2 ?? "") : INGEST_DELETES.has(table);
+    return allowed ? C2.SQLITE_OK : C2.SQLITE_DENY;
+  }
   if (action === C2.SQLITE_PRAGMA)
     return readsDataVersion(p1, p2) ? C2.SQLITE_OK : C2.SQLITE_DENY;
-  return C2.SQLITE_OK;
+  if (action === C2.SQLITE_READ || action === C2.SQLITE_SELECT || action === C2.SQLITE_FUNCTION || action === C2.SQLITE_RECURSIVE || action === C2.SQLITE_TRANSACTION || action === C2.SQLITE_SAVEPOINT)
+    return C2.SQLITE_OK;
+  return C2.SQLITE_DENY;
 }
 var FORGET_WRITES = {
   [C2.SQLITE_INSERT]: new Set(["forget_batch", "source_forgotten", "unit_state", "source_fts", "unit_fts"]),
   [C2.SQLITE_DELETE]: new Set([
     "source",
-    "external_reference",
     "unit_evidence",
     "unit_adoption",
     "source_processing",
@@ -14811,7 +14879,7 @@ function connectWriter(role, file = dbFile(), create = false) {
     throw e;
   }
   if (role === "ingest")
-    raw.setAuthorizer(ingestAuthorizer);
+    raw.setAuthorizer((action, p1, p2, _db, trigger) => ingestAuthorizer(action, p1, p2, trigger));
   else if (role === "forget")
     raw.setAuthorizer(forgetAuthorizer);
   else if (role === "capture") {
@@ -14841,6 +14909,9 @@ var say = (text) => console.log(indent(text));
 var SCHEMA = () => path5.join(dbDir(), "schema.sql");
 var MIGRATIONS = () => path5.join(dbDir(), "migrations");
 var MIGRATION = (dir, revision) => path5.join(dir, `${String(revision).padStart(4, "0")}.sql`);
+var CHECK = (dir, revision) => path5.join(dir, `${String(revision).padStart(4, "0")}.check.sql`);
+var STOP2 = "sphica_migration_stop";
+var NOTE = "sphica_migration_note";
 var KEEP = 3;
 function backUp(raw, file, from) {
   fs5.mkdirSync(backupDir(file), { recursive: true, mode: 448 });
@@ -14880,6 +14951,46 @@ function prune(file, kept) {
     } catch {}
 }
 var versionOf = (raw) => raw.prepare("pragma user_version").get().user_version;
+var SQLITE_BUSY = 5;
+function taken(raw, table) {
+  if (!raw.prepare("select 1 from temp.sqlite_schema where type = 'table' and name = ?").get(table))
+    return [];
+  const rows = raw.prepare(`select * from temp.${table} order by rule, rowid`).all();
+  raw.exec(`drop table temp.${table}`);
+  return rows;
+}
+function listed(rows) {
+  const rules = new Map;
+  for (const r2 of rows) {
+    const of = rules.get(r2.rule);
+    if (of)
+      of.push(r2);
+    else
+      rules.set(r2.rule, [r2]);
+  }
+  return [...rules].flatMap(([rule2, of]) => [
+    `${inline(String(rule2))}: ${plural(of.length, "row")}`,
+    ...of.map((r2) => `  ${inline(String(r2.item))}${r2.action ? ` → ${inline(String(r2.action))}` : ""}`)
+  ]).join(`
+`);
+}
+
+class Stop extends Error {
+  list;
+  constructor(revision, rows) {
+    super(`The database has ${plural(rows.length, "row")} that revision ${revision} cannot take, and Sphica writes no such row (listed below). Fix the rows, or forget a listed source with /sphica:forget on the Sphica version that still opens this database, then run \`sphica init\` again`);
+    this.list = listed(rows);
+  }
+}
+function committed(raw) {
+  if (raw.isTransaction)
+    return null;
+  try {
+    return versionOf(raw);
+  } catch {
+    return null;
+  }
+}
 function immediate(raw, fn) {
   raw.exec("begin immediate");
   try {
@@ -14891,6 +15002,11 @@ function immediate(raw, fn) {
     throw e;
   }
 }
+function optimize(raw) {
+  try {
+    raw.exec("pragma optimize");
+  } catch {}
+}
 function withOwner(file, fn, create = false) {
   const raw = connectWriter("owner", file, create);
   try {
@@ -14910,27 +15026,53 @@ function migrate(file = dbFile(), dir = MIGRATIONS()) {
       for (let r2 = from + 1;r2 <= SCHEMA_REVISION; r2++) {
         const script = MIGRATION(dir, r2);
         if (!fs5.existsSync(script))
-          throw new Error(`No migration from revision ${r2 - 1}. Move the database aside, then run \`sphica init\`.`);
+          throw new Error(`This Sphica has no migration script for revision ${r2} (${script} is missing). Reinstall sphica (\`npm i -g sphica@${packageVersionAt(ROOT) ?? "latest"}\`), then run \`sphica init\` again.`);
         raw.exec("pragma foreign_keys = off");
         try {
-          immediate(raw, () => {
+          const notes = immediate(raw, () => {
             if (versionOf(raw) !== r2 - 1)
-              return;
+              return [];
+            if (fs5.existsSync(CHECK(dir, r2))) {
+              raw.exec(fs5.readFileSync(CHECK(dir, r2), "utf8"));
+              const stops = taken(raw, STOP2);
+              if (stops.length)
+                throw new Stop(r2, stops);
+            }
             raw.exec(fs5.readFileSync(script, "utf8"));
             const broken = raw.prepare("pragma foreign_key_check").all().length;
             if (broken)
               throw new Error(`Migration to revision ${r2} left ${plural(broken, "broken reference")}; nothing was changed`);
             if (versionOf(raw) !== r2)
               throw new Error(`${path5.basename(script)} did not set revision ${r2}`);
+            return taken(raw, NOTE);
           });
+          if (notes.length)
+            say(`Changed while migrating to revision ${r2}: ${plural(notes.length, "row")} (the backup keeps them as they were)
+${listed(notes)}`);
         } finally {
           raw.exec("pragma foreign_keys = on");
         }
       }
     } catch (e) {
+      const said = e.message.replace(/\.$/, "");
+      const list = e instanceof Stop ? `
+${e.list}` : "";
+      const now = committed(raw);
+      if (now === from) {
+        let left = "the backup made for this run was removed";
+        try {
+          fs5.rmSync(backup, { force: true });
+        } catch {
+          left = `the backup made for this run is still at ${backup}; delete it yourself`;
+        }
+        const retry = sqliteCode(e) === SQLITE_BUSY ? " Another process is writing to the database. Run `sphica init` again when it has finished." : "";
+        throw new Error(`${said}. No migration step was committed: the database is still at revision ${from}, and there is no need to replace it with a backup (${left}).${retry}${list}`);
+      }
       const base = path5.basename(file);
-      throw new Error(`${e.message}. The database before migrating is at ${backup} (anything recorded after it was made is not in it). To go back to it, close every session using Sphica, move ${base}, ${base}-wal, and ${base}-shm in ${path5.dirname(file)} aside, then copy the backup to ${file}.`);
+      const state = now === null ? "The committed revision could not be confirmed after the failure" : `The database is now at revision ${now} (this run, or another \`sphica init\` running at the same time, migrated it that far)`;
+      throw new Error(`${said}. ${state}. The database before migrating is at ${backup} (anything recorded after it was made is not in it). To go back to it, close every session using Sphica, move ${base}, ${base}-wal, and ${base}-shm in ${path5.dirname(file)} aside, then copy the backup to ${file}.${list}`);
     }
+    optimize(raw);
     prune(file, backup);
     return from;
   });
@@ -14966,6 +15108,7 @@ function dbInit(file = dbFile()) {
       raw.exec(fs5.readFileSync(SCHEMA(), "utf8"));
       if (versionOf(raw) !== SCHEMA_REVISION)
         throw new Error(`db/schema.sql has user_version ${versionOf(raw)}, but the code expects ${SCHEMA_REVISION}`);
+      optimize(raw);
     }, true);
     try {
       fs5.linkSync(tmp, file);
@@ -14994,17 +15137,21 @@ function bindOwner(user, file = dbFile()) {
   }));
 }
 function reindex(file = dbFile()) {
-  const counts = withOwner(file, (raw) => immediate(raw, () => {
-    raw.exec("insert into unit_fts (unit_fts) values ('delete-all')");
-    raw.exec("insert into unit_fts (rowid, body, ident, alias) select id, body, ident, alias from unit_search_text");
-    raw.exec("insert into source_fts (source_fts) values ('delete-all')");
-    raw.exec("insert into source_fts (rowid, lexemes) select id, sphica_terms(text) from source where indexed = 1");
-    const n2 = (sql2) => raw.prepare(sql2).get().n;
-    return {
-      units: n2("select count(*) as n from unit"),
-      sources: n2("select count(*) as n from source where indexed = 1")
-    };
-  }));
+  const counts = withOwner(file, (raw) => {
+    const n2 = immediate(raw, () => {
+      raw.exec("insert into unit_fts (unit_fts) values ('delete-all')");
+      raw.exec("insert into unit_fts (rowid, body, ident, alias) select id, body, ident, alias from unit_search_text");
+      raw.exec("insert into source_fts (source_fts) values ('delete-all')");
+      raw.exec("insert into source_fts (rowid, lexemes) select id, sphica_terms(text) from source where indexed = 1");
+      const n3 = (sql2) => raw.prepare(sql2).get().n;
+      return {
+        units: n3("select count(*) as n from unit"),
+        sources: n3("select count(*) as n from source where indexed = 1")
+      };
+    });
+    optimize(raw);
+    return n2;
+  });
   say(`Rebuilt the index: ${plural(counts.units, "unit")}, ${plural(counts.sources, "source")}`);
 }
 function inspect(file = dbFile()) {
@@ -15162,7 +15309,7 @@ function localRoots(roots = [path7.join(os3.homedir(), "Projects")]) {
 function relativeTo(root, file, cwd = root) {
   const abs = path7.resolve(cwd, file);
   const rel = path7.relative(root, abs);
-  if (!rel || leaves(rel))
+  if (!rel || leaves(rel) || /\p{Cc}/u.test(rel))
     return null;
   return rel.split(path7.sep).join("/");
 }
@@ -15194,7 +15341,7 @@ var git2 = (root, args) => {
     return null;
   }
 };
-var usable = (p) => p !== "" && !p.includes("\\");
+var usable = (p) => p !== "" && !p.includes("\\") && !/\p{Cc}/u.test(p);
 function snapshot(root) {
   const out = git2(root, ["status", "--porcelain=v2", "-z", "--untracked-files=all"]);
   if (out === null)
@@ -15934,12 +16081,15 @@ async function doctor(cwd) {
       await withDb("reader", async (db) => {
         const owners = await db.selectFrom("owner_identity").select(["external_id", "login"]).where("provider", "=", "github").orderBy("bound_at").execute();
         say2(owners.length ? "ok" : "none", "GitHub owner", owners.length ? owners.map((o) => `${inline(o.login ?? "?")} (id ${inline(o.external_id)})`).join(" / ") : "none. Bind it with sphica init while gh is signed in");
+        const twice = await db.selectFrom("unit").select("project_id").where("lifecycle", "in", ["active", "candidate"]).groupBy(["project_id", "content_hash"]).having((eb) => eb.fn.countAll(), ">", 1).execute();
+        if (twice.length)
+          say2("warn", "Records", `${plural(twice.length, "set")} of live records hold the same words. Read them with Sphica's read and withdraw the extra ones with /sphica:glean`);
         const { found } = localRoots();
         const rows = await db.selectFrom("project as p").select((eb) => [
           "p.key",
           "p.name",
           eb.selectFrom("unit as u").select((u3) => u3.fn.countAll().as("n")).whereRef("u.project_id", "=", "p.id").as("records"),
-          eb.selectFrom("extraction_run as r").select((r2) => r2.fn.max("r.finished_at").as("at")).whereRef("r.project_id", "=", "p.id").where("r.status", "=", "saved").as("extracted")
+          eb.selectFrom("extraction_run as r").select((r2) => r2.fn.max("r.finished_at").as("at")).whereRef("r.project_id", "=", "p.id").where("r.status", "=", "saved").where("r.origin", "<>", "migration").as("extracted")
         ]).orderBy("p.name").execute();
         if (rows.length)
           console.log(section("Projects", true));

package/dist/deliver.js

@@ -11134,7 +11134,7 @@ var HOST_MARKS = new Set([".orphaned_at", ".in_use"]);
 
 // server/src/sqlite.ts
 var SCHEMA_GENERATION = 2;
-var SCHEMA_REVISION = 4;
+var SCHEMA_REVISION = 5;
 var sphicaHome = () => process.env.SPHICA_HOME || path3.join(os.homedir(), ".sphica");
 var dbFile = () => process.env.SPHICA_DB || path3.join(sphicaHome(), "sphica.db");
 function requireRuntime() {
@@ -11336,24 +11336,92 @@ function captureAuthorizer(own, action, p1, p2, triggerOrView) {
   return C2.SQLITE_DENY;
 }
 var writes = (action) => action === C2.SQLITE_INSERT || action === C2.SQLITE_UPDATE || action === C2.SQLITE_DELETE;
-var FORGET_ONLY = new Set(["forget_batch", "source_forgotten"]);
-var KEPT_BY_INGEST = new Set(["source", "unit_evidence", "unit_adoption"]);
-function ingestAuthorizer(action, p1, p2) {
+var INGEST_INSERTS = new Set([
+  "project",
+  "ingest_source",
+  "extraction_run",
+  "source_processing",
+  "unit",
+  "unit_option",
+  "unit_evidence",
+  "unit_adoption",
+  "unit_link",
+  "unit_state",
+  "unit_anchor",
+  "unit_alias",
+  "field_def",
+  "unit_field",
+  "work",
+  "artifact_link"
+]);
+var RETRACTION = [
+  "retracted_at",
+  "retraction_reason",
+  "retraction_source_id",
+  "retraction_span_start",
+  "retraction_span_end"
+];
+var INGEST_UPDATES = {
+  extraction_run: new Set(["status", "finished_at"]),
+  unit_anchor: new Set(["retired_at", "replaced_by"]),
+  unit_link: new Set(["resolved_at", "resolution"]),
+  unit_evidence: new Set(RETRACTION),
+  unit_adoption: new Set(RETRACTION),
+  work: new Set(["title", "goal", "current", "next", "status", "branch", "run_id", "updated_at"])
+};
+var INGEST_DELETES = new Set(["artifact_link"]);
+var INGEST_TRIGGER_WRITES = {
+  ingest_source_insert: ["insert source"],
+  source_fts_ai: ["insert source_fts"],
+  source_fts_ad: ["delete source_fts"],
+  unit_state_apply: ["update unit"],
+  unit_state_restore: ["insert unit_state"],
+  ...Object.fromEntries([
+    "evidence_i",
+    "evidence_u",
+    "evidence_d",
+    "adoption_i",
+    "adoption_u",
+    "adoption_d",
+    "link_i",
+    "link_u",
+    "anchor_i",
+    "anchor_u",
+    "alias_i",
+    "field_i",
+    "field_d"
+  ].map((t) => [`unit_rev_${t}`, ["update unit"]])),
+  unit_fts_ai: ["insert unit_fts"],
+  unit_fts_ad: ["delete unit_fts"],
+  ...Object.fromEntries(["option_i", "anchor_i", "anchor_u", "anchor_d", "alias_i", "alias_d", "field_i", "field_d"].map((t) => [
+    `unit_fts_${t}`,
+    ["delete unit_fts", "insert unit_fts"]
+  ]))
+};
+var opOf = (action) => action === C2.SQLITE_INSERT ? "insert" : action === C2.SQLITE_UPDATE ? "update" : action === C2.SQLITE_DELETE ? "delete" : undefined;
+function ingestAuthorizer(action, p1, p2, trigger) {
   if (DDL().has(action))
     return C2.SQLITE_DENY;
-  if (writes(action) && (p1 === "owner_identity" || FORGET_ONLY.has(p1 ?? "")))
-    return C2.SQLITE_DENY;
-  if (action === C2.SQLITE_DELETE && KEPT_BY_INGEST.has(p1 ?? ""))
-    return C2.SQLITE_DENY;
+  const op = opOf(action);
+  if (op) {
+    const table = p1 ?? "";
+    if (SHADOW.test(table))
+      return C2.SQLITE_OK;
+    if (trigger !== null)
+      return INGEST_TRIGGER_WRITES[trigger]?.includes(`${op} ${table}`) ? C2.SQLITE_OK : C2.SQLITE_DENY;
+    const allowed = op === "insert" ? INGEST_INSERTS.has(table) : op === "update" ? INGEST_UPDATES[table]?.has(p2 ?? "") : INGEST_DELETES.has(table);
+    return allowed ? C2.SQLITE_OK : C2.SQLITE_DENY;
+  }
   if (action === C2.SQLITE_PRAGMA)
     return readsDataVersion(p1, p2) ? C2.SQLITE_OK : C2.SQLITE_DENY;
-  return C2.SQLITE_OK;
+  if (action === C2.SQLITE_READ || action === C2.SQLITE_SELECT || action === C2.SQLITE_FUNCTION || action === C2.SQLITE_RECURSIVE || action === C2.SQLITE_TRANSACTION || action === C2.SQLITE_SAVEPOINT)
+    return C2.SQLITE_OK;
+  return C2.SQLITE_DENY;
 }
 var FORGET_WRITES = {
   [C2.SQLITE_INSERT]: new Set(["forget_batch", "source_forgotten", "unit_state", "source_fts", "unit_fts"]),
   [C2.SQLITE_DELETE]: new Set([
     "source",
-    "external_reference",
     "unit_evidence",
     "unit_adoption",
     "source_processing",
@@ -11393,7 +11461,7 @@ function connectWriter(role, file = dbFile(), create = false) {
     throw e;
   }
   if (role === "ingest")
-    raw.setAuthorizer(ingestAuthorizer);
+    raw.setAuthorizer((action, p1, p2, _db, trigger) => ingestAuthorizer(action, p1, p2, trigger));
   else if (role === "forget")
     raw.setAuthorizer(forgetAuthorizer);
   else if (role === "capture") {
@@ -11497,7 +11565,7 @@ async function projectId(db, key) {
 function relativeTo(root, file, cwd = root) {
   const abs = path4.resolve(cwd, file);
   const rel = path4.relative(root, abs);
-  if (!rel || leaves(rel))
+  if (!rel || leaves(rel) || /\p{Cc}/u.test(rel))
     return null;
   return rel.split(path4.sep).join("/");
 }
@@ -11529,7 +11597,7 @@ var git2 = (root, args) => {
     return null;
   }
 };
-var usable = (p) => p !== "" && !p.includes("\\");
+var usable = (p) => p !== "" && !p.includes("\\") && !/\p{Cc}/u.test(p);
 function snapshot(root) {
   const out = git2(root, ["status", "--porcelain=v2", "-z", "--untracked-files=all"]);
   if (out === null)