sporades 0.8.3 → 0.8.5

package/CHANGES.md

@@ -6,12 +6,22 @@ Changes since v0.8.1.
 
 ### 🚀 Features
 
+- Add reactive query arguments (5b882f5).
 - Add exact pagination and join admission (63f68a0).
 
 ### 🐛 Bug Fixes
 
 - Resolve npm audit vulnerabilities (a6a4b51).
 
+### 📝 Documentation
+
+- Describe parameterized queries (287ef63).
+- Plan reactive query arguments (4876db8).
+
+### 📦 Packaging
+
+- Release v0.8.3 (c17bb1b).
+
 ## 0.8.1 - 2026-08-14
 
 Corrects the incomplete `0.8.0` package release with the merged `main` runtime,

package/bin/sporades-host-helper.js

@@ -418,7 +418,7 @@ function writeEnvelope(result, failed = false) {
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.8.3";
+var CLI_VERSION = "0.8.5";
 
 // src/cli/schedule-inspection-envelope.ts
 function sanitizeScheduleInspectionEnvelope(envelope, invalid) {

package/bin/sporades.js

@@ -38,11 +38,69 @@ export function onMessage(listener) {
 }
 
 export const queries = {
-  subscribe(name, listener) {
-    return connect().subscribeQuery(name, listener);
+  subscribe(name, listener, ...args) {
+    const normalizedArgs = args.length === 1 && args[0]?.[normalizedQueryArgumentsMarker]
+      ? args[0]
+      : normalizeQueryArguments(args);
+    return connect().subscribeNormalizedQuery(name, listener, normalizedArgs);
   },
 };
 
+const queryArgumentLimitBytes = 65536;
+const normalizedQueryArgumentsMarker = Symbol("sporades.normalizedQueryArguments");
+
+function normalizeQueryArguments(args) {
+  if (!Array.isArray(args)) throw new TypeError("Query arguments must be an array.");
+  const ancestors = new Set();
+  const snapshot = normalizeQueryArgumentValue(args, ancestors);
+  const identity = JSON.stringify(snapshot);
+  const byteLength = new TextEncoder().encode(identity).byteLength;
+  if (byteLength > queryArgumentLimitBytes) throw new RangeError("Query arguments exceed the 65536-byte limit.");
+  return Object.freeze({ snapshot, identity, byteLength, [normalizedQueryArgumentsMarker]: true });
+}
+
+function normalizeQueryArgumentValue(value, ancestors) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new TypeError("Query arguments must contain JSON values.");
+    return value;
+  }
+  if (Array.isArray(value)) {
+    if (Object.getOwnPropertySymbols(value).length > 0) throw new TypeError("Query arguments must not contain symbol keys.");
+    if (ancestors.has(value)) throw new TypeError("Query arguments must not contain cycles.");
+    if (Object.getOwnPropertyNames(value).some((key) => key !== "length" && (!/^(0|[1-9]\\d*)$/.test(key) || Number(key) >= value.length))) {
+      throw new TypeError("Query arguments must not contain non-index array properties.");
+    }
+    ancestors.add(value);
+    const snapshot = [];
+    for (let index = 0; index < value.length; index += 1) {
+      if (!Object.hasOwn(value, index)) throw new TypeError("Query arguments must not contain sparse arrays.");
+      snapshot.push(normalizeQueryArgumentValue(value[index], ancestors));
+    }
+    ancestors.delete(value);
+    return Object.freeze(snapshot);
+  }
+  if (!value || typeof value !== "object") throw new TypeError("Query arguments must contain JSON values.");
+  if (Object.getOwnPropertySymbols(value).length > 0) throw new TypeError("Query arguments must not contain symbol keys.");
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) throw new TypeError("Query arguments must contain plain JSON objects.");
+  if (ancestors.has(value)) throw new TypeError("Query arguments must not contain cycles.");
+  ancestors.add(value);
+  const snapshot = Object.create(null);
+  for (const key of Object.getOwnPropertyNames(value).sort()) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !descriptor.enumerable || !Object.hasOwn(descriptor, "value")) throw new TypeError("Query arguments must contain plain JSON objects.");
+    Object.defineProperty(snapshot, key, {
+      value: normalizeQueryArgumentValue(descriptor.value, ancestors),
+      enumerable: true,
+      configurable: false,
+      writable: false,
+    });
+  }
+  ancestors.delete(value);
+  return Object.freeze(snapshot);
+}
+
 export const mutations = {
   run(name, ...args) {
     return connect().mutate(name, args);
@@ -171,13 +229,14 @@ export const files = {
 export function createHooks(primitives) {
   const { useEffect, useState } = primitives;
 
-  function useQuery(name) {
+  function useQuery(name, ...args) {
+    const normalizedArgs = normalizeQueryArguments(args);
     const [state, setState] = useState({ data: null, error: null, loading: true });
 
     useEffect(() => {
-      const subscription = queries.subscribe(name, setState);
+      const subscription = queries.subscribe(name, setState, normalizedArgs);
       return () => subscription.unsubscribe();
-    }, [name]);
+    }, [name, normalizedArgs.identity]);
 
     return state;
   }
@@ -237,9 +296,10 @@ export function createHooks(primitives) {
 export function createVueComposables(primitives) {
   const { reactive, onScopeDispose } = primitives;
 
-  function useQuery(name) {
+  function useQuery(name, ...args) {
+    const normalizedArgs = normalizeQueryArguments(args);
     const state = reactive({ data: null, error: null, loading: true });
-    const subscription = queries.subscribe(name, (nextState) => Object.assign(state, nextState));
+    const subscription = queries.subscribe(name, (nextState) => Object.assign(state, nextState), normalizedArgs);
     onScopeDispose(() => subscription.unsubscribe());
     return state;
   }
@@ -293,9 +353,10 @@ export function createVueComposables(primitives) {
 export function createSolidPrimitives(primitives) {
   const { createSignal, onCleanup } = primitives;
 
-  function createQuery(name) {
+  function createQuery(name, ...args) {
+    const normalizedArgs = normalizeQueryArguments(args);
     const [state, setState] = createSignal({ data: null, error: null, loading: true });
-    const subscription = queries.subscribe(name, setState);
+    const subscription = queries.subscribe(name, setState, normalizedArgs);
     onCleanup(() => subscription.unsubscribe());
     return state;
   }
@@ -389,8 +450,9 @@ export function createLitControllers() {
     return controller;
   }
 
-  function queryController(host, name) {
-    return observedController(host, { data: null, error: null, loading: true }, (publish) => queries.subscribe(name, publish));
+  function queryController(host, name, ...args) {
+    const normalizedArgs = normalizeQueryArguments(args);
+    return observedController(host, { data: null, error: null, loading: true }, (publish) => queries.subscribe(name, publish, normalizedArgs));
   }
 
   function mutationController(host, name) {
@@ -477,7 +539,10 @@ export function createInfernoAdapters() {
     };
     return adapter;
   }
-  const queryAdapter = (host, name) => observedAdapter(host, { data: null, error: null, loading: true }, (publish) => queries.subscribe(name, publish));
+  const queryAdapter = (host, name, ...args) => {
+    const normalizedArgs = normalizeQueryArguments(args);
+    return observedAdapter(host, { data: null, error: null, loading: true }, (publish) => queries.subscribe(name, publish, normalizedArgs));
+  };
   function mutationAdapter(host, name) {
     let pending = 0, latestInvocation = 0;
     const adapter = { state: { data: null, error: null, loading: false }, async run(...args) {
@@ -513,10 +578,11 @@ export function createInfernoAdapters() {
 }
 
 export function createSvelteStores() {
-  function queryStore(name) {
+  function queryStore(name, ...args) {
+    const normalizedArgs = normalizeQueryArguments(args);
     return createLazyStore(
       { data: null, error: null, loading: true },
-      (publish) => queries.subscribe(name, publish).unsubscribe,
+      (publish) => queries.subscribe(name, publish, normalizedArgs).unsubscribe,
       true,
     );
   }
@@ -688,6 +754,7 @@ function createConnection() {
           id: subscription.id,
           type: "query.subscribe",
           query: subscription.name,
+          args: subscription.args.snapshot,
         });
       }
     });
@@ -1073,17 +1140,19 @@ function createConnection() {
     confirmPasswordReset(code, newPassword) {
       return request("auth.confirmPasswordReset", { code, newPassword });
     },
-    subscribeQuery(name, listener) {
+    subscribeNormalizedQuery(name, listener, args) {
       if (typeof name !== "string" || !name) throw new TypeError("queries.subscribe requires a query name.");
       if (typeof listener !== "function") throw new TypeError("queries.subscribe requires a listener function.");
-      let subscription = queryChannels.get(name);
+      const channelsForName = queryChannels.get(name) ?? new Map();
+      if (!queryChannels.has(name)) queryChannels.set(name, channelsForName);
+      let subscription = channelsForName.get(args.identity);
       if (!subscription) {
         const id = nextId++;
-        subscription = { id, name, listeners: new Set(), latest: null };
-        queryChannels.set(name, subscription);
+        subscription = { id, name, args, listeners: new Set(), latest: null };
+        channelsForName.set(args.identity, subscription);
         subscriptions.set(id, subscription);
         const activeSocket = open();
-        if (activeSocket.readyState === WebSocket.OPEN) send({ id, type: "query.subscribe", query: name });
+        if (activeSocket.readyState === WebSocket.OPEN) send({ id, type: "query.subscribe", query: name, args: args.snapshot });
       }
       subscription.listeners.add(listener);
       listener(subscription.latest ?? { data: null, error: null, loading: true });
@@ -1093,7 +1162,8 @@ function createConnection() {
         active = false;
         subscription.listeners.delete(listener);
         if (subscription.listeners.size === 0) {
-          queryChannels.delete(name);
+          channelsForName.delete(args.identity);
+          if (channelsForName.size === 0) queryChannels.delete(name);
           subscriptions.delete(subscription.id);
           sendIfOpen({ id: nextId++, type: "query.unsubscribe", subscriptionId: subscription.id });
         }
@@ -16621,7 +16691,30 @@ function createWebSocketHub(getDatabase, trustedRefresh = null) {
         });
         return;
       }
-      const subscription = { id: message.id, name: queryName, style: message.query ? "direct" : "rows", generation: 0 };
+      let args;
+      try {
+        args = normalizeQueryArguments(message.args ?? []);
+      } catch {
+        sendJson(client, {
+          id: message.id,
+          type: "query.result",
+          query: queryName,
+          data: null,
+          error: invalidQueryArgumentsError()
+        });
+        return;
+      }
+      if (!message.query && args.length > 0) {
+        sendJson(client, {
+          id: message.id,
+          type: "query.result",
+          query: queryName,
+          data: null,
+          error: invalidQueryArgumentsError()
+        });
+        return;
+      }
+      const subscription = { id: message.id, name: queryName, args, style: message.query ? "direct" : "rows", generation: 0 };
       client.subscriptions.set(message.id, subscription);
       void sendQueryResult(client, subscription, (error) => sendUnhandledMessageError(client, rawMessage, error));
       return;
@@ -17006,7 +17099,7 @@ function createWebSocketHub(getDatabase, trustedRefresh = null) {
     subscription.generation = generation;
     try {
       const database = getDatabase();
-      const result = await runQuery(database, client.session.auth, subscription.name);
+      const result = await runQuery(database, client.session.auth, subscription.name, subscription.args);
       const data = subscription.style === "direct" ? result.data ?? result.rows : { rows: result.data ?? result.rows };
       if (client.subscriptions.get(subscription.id) !== subscription || subscription.generation !== generation) return;
       sendJson(client, {
@@ -17228,7 +17321,13 @@ function sendJsonWithCompletion(client, message, timeoutMs = 250) {
     }
   });
 }
-async function runQuery(database, auth, queryName) {
+async function runQuery(database, auth, queryName, rawArgs = []) {
+  let args;
+  try {
+    args = normalizeQueryArguments(rawArgs);
+  } catch {
+    return { rows: null, data: null, error: invalidQueryArgumentsError() };
+  }
   let context;
   try {
     context = await applyContextMiddleware(database, createMutationContext(database, auth), "query");
@@ -17242,9 +17341,10 @@ async function runQuery(database, auth, queryName) {
     };
   }
   if (queryName === "ctx.env") {
+    if (args.length > 0) return { rows: null, data: null, error: invalidQueryArgumentsError() };
     return { data: context.env, error: null };
   }
-  const customResult = await runCustomQuery(database, context, queryName);
+  const customResult = await runCustomQuery(database, context, queryName, args);
   if (customResult) {
     return customResult;
   }
@@ -17258,6 +17358,7 @@ async function runQuery(database, auth, queryName) {
       }
     };
   }
+  if (args.length > 0) return { rows: null, data: null, error: invalidQueryArgumentsError() };
   const cacheKey = `${table.name}:${context.auth.userId}`;
   if (!database.rowCache.has(cacheKey)) {
     const columns = ["id", "createdAt", "updatedAt", ...table.fields.map((field) => field.name)];
@@ -17272,14 +17373,14 @@ async function runQuery(database, auth, queryName) {
   const rows = await filterRowsByReadAcl(database, table, database.rowCache.get(cacheKey), context);
   return { rows, error: null };
 }
-async function runCustomQuery(database, context, queryName) {
+async function runCustomQuery(database, context, queryName, args) {
   const handler = database.queries.find((candidate) => candidate.name === queryName);
   if (!handler) {
     return null;
   }
   try {
     const queryHandler = typeof handler.handler === "function" ? handler.handler : new Function(`return (${handler.handlerSource});`)();
-    const data = await queryHandler(context);
+    const data = await queryHandler(context, ...args);
     assertJsonCompatible(data);
     return { data, error: null };
   } catch (error) {
@@ -17296,6 +17397,64 @@ async function runCustomQuery(database, context, queryName) {
     };
   }
 }
+var QUERY_ARGUMENT_LIMIT_BYTES = 65536;
+function invalidQueryArgumentsError() {
+  return {
+    message: "Invalid query arguments.",
+    hint: "Use a JSON-compatible argument array no larger than 65536 UTF-8 bytes."
+  };
+}
+function normalizeQueryArguments(value) {
+  if (!Array.isArray(value)) throw new Error("Query arguments must be an array.");
+  const snapshot = normalizeQueryArgumentValue(value, /* @__PURE__ */ new Set());
+  const canonicalJson = JSON.stringify(snapshot);
+  if (Buffer.byteLength(canonicalJson, "utf8") > QUERY_ARGUMENT_LIMIT_BYTES) {
+    throw new Error("Query arguments are too large.");
+  }
+  return snapshot;
+}
+function normalizeQueryArgumentValue(value, ancestors) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("Query arguments must contain finite numbers.");
+    return value;
+  }
+  if (typeof value !== "object") throw new Error("Query arguments must be JSON-compatible.");
+  if (Object.getOwnPropertySymbols(value).length > 0) throw new Error("Query arguments must not contain symbol keys.");
+  if (ancestors.has(value)) throw new Error("Query arguments must not contain cycles.");
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      if (Object.getOwnPropertyNames(value).some((key) => key !== "length" && (!/^(0|[1-9]\\d*)$/.test(key) || Number(key) >= value.length))) {
+        throw new Error("Query arguments must not contain non-index array properties.");
+      }
+      const copy2 = [];
+      for (let index = 0; index < value.length; index += 1) {
+        if (!Object.hasOwn(value, index)) throw new Error("Query arguments must not contain sparse arrays.");
+        copy2.push(normalizeQueryArgumentValue(value[index], ancestors));
+      }
+      return Object.freeze(copy2);
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw new Error("Query arguments must contain plain objects only.");
+    }
+    const copy = /* @__PURE__ */ Object.create(null);
+    for (const key of Object.getOwnPropertyNames(value).sort()) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (!descriptor || !descriptor.enumerable || !("value" in descriptor)) throw new Error("Query arguments must not contain accessors.");
+      Object.defineProperty(copy, key, {
+        value: normalizeQueryArgumentValue(descriptor.value, ancestors),
+        enumerable: true,
+        writable: false,
+        configurable: false
+      });
+    }
+    return Object.freeze(copy);
+  } finally {
+    ancestors.delete(value);
+  }
+}
 async function runMutation(database, auth, mutationName, args) {
   let context;
   let result;
@@ -23645,7 +23804,7 @@ jobs:
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.8.3";
+var CLI_VERSION = "0.8.5";
 
 // src/cli/sporades.ts
 var SUPPORTED_TEMPLATES = new Set(CLIENT_TEMPLATES);

package/dist/cli/cli-version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.8.3";
+export declare const CLI_VERSION = "0.8.5";
 //# sourceMappingURL=cli-version.d.ts.map

package/dist/cli/cli-version.js

@@ -1,3 +1,3 @@
 // Generated by `npm run build` from package.json. Do not edit by hand.
-export const CLI_VERSION = "0.8.3";
+export const CLI_VERSION = "0.8.5";
 //# sourceMappingURL=cli-version.js.map

package/dist/server-runtime-source.d.ts

@@ -144,7 +144,7 @@ export declare function sendEmailPasswordResetLink(database: LooseRecord, sessio
     ok: boolean;
     error?: undefined;
 }>;
-export declare function runQuery(database: LooseRecord, auth: any, queryName: string): Promise<any>;
+export declare function runQuery(database: LooseRecord, auth: any, queryName: string, rawArgs?: unknown): Promise<any>;
 export declare function runMutation(database: LooseRecord, auth: any, mutationName: string, args: any): Promise<any>;
 export declare function runAppMessage(database: LooseRecord, auth: any, messageName: any, data: any, options?: LooseRecord): Promise<any>;
 export declare function runCurrentUserJobWorker(database: LooseRecord): Promise<void>;

package/dist/server-runtime-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-runtime-source.d.ts","sourceRoot":"","sources":["../src/server-runtime-source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAA4C,MAAM,WAAW,CAAC;AAQ3G,OAAO,EAAY,oBAAoB,EAAuD,MAAM,SAAS,CAAC;AAE9G,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAkHhC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AAoBrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAmBlC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AA8BpC,cAAc,mBAAmB,CAAC;AAsBlC,cAAc,+BAA+B,CAAC;AAiC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AA2BnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AAuBzC,cAAc,wBAAwB,CAAC;AAqBvC,cAAc,uBAAuB,CAAC;AAiCtC,cAAc,kBAAkB,CAAC;AA8BjC,cAAc,mBAAmB,CAAC;AAElC,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACvC,KAAK,aAAa,GAAG,WAAW,CAAC;AACjC,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAqBrD,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,GAAG,EACjB,SAAS,GAAE,UAAe,EAC1B,MAAM,GAAE,aAAkB,EAC1B,iBAAiB,GAAE,GAAU,EAC7B,OAAO,GAAE,WAAgB,wBAqL1B;AA2KD,wBAAsB,0BAA0B,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,gBAUxG;AAmBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAAE,QAAQ,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC;CAAE;;gBAU3F,GAAG;;;EA4BlB;AAyJD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE;QAAE,EAAE,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,GAAG,CAAC;QAAC,IAAI,EAAE,GAAG,CAAC;KAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,GAAG,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;CAAE,eA2B/O;AA2GD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,EAAE,KAAK,SAAM,SAe5E;AAED,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,GAAG;;;;;;;;;;;;;;EAY1D;AAwJD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM;;;;;IA8BpD;AAuaD,wBAAsB,aAAa,CAAC,QAAQ,EAAE;IAAE,SAAS,EAAE,GAAG,EAAE,CAAC;CAAE,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG;IAAE,GAAG,EAAE,eAAe,CAAC;CAAE,oBAmBnK;AA2BD,wBAAsB,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE;IAAE,OAAO,CAAC,EAAE,QAAQ,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,gBAwCxI;AAsID,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,GAAE,GAAU;;EAIzF;AA0RD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,GAAG;;;SAahD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM;;;;EAU1E;AAiBD,KAAK,uBAAuB,GAAG;IAC7B,aAAa,EAAE,uBAAuB,CAAC;IACvC,YAAY,EAAE,sBAAsB,CAAC;IACrC,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACtI,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,EAAE,cAAc,GAAE,uBAAuB,GAAG,IAAW;;oBAgBtF,eAAe,UAAU,MAAM;;;;;;;;;;;;;;;;;;;;4BAiF7B,GAAG,SAAS,GAAG;+BAaZ,GAAG,eAAe;QAAE,YAAY,EAAE;YAAE,KAAK,EAAE,GAAG,CAAC;SAAE,CAAC;QAAC,IAAI,EAAE,GAAG,CAAC;KAAE;;;;;EAq1B7F;AA+CD,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,WAAgB;;;;;;;;;GAyB1B;AA2GD,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAgDhG;AA+BD,wBAAsB,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,gBA6ClG;AAyBD,wBAAsB,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,GAAE,WAAgB,gBA6E3H;AAyOD,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,iBAuDlE"}
+{"version":3,"file":"server-runtime-source.d.ts","sourceRoot":"","sources":["../src/server-runtime-source.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAA4C,MAAM,WAAW,CAAC;AAQ3G,OAAO,EAAY,oBAAoB,EAAuD,MAAM,SAAS,CAAC;AAE9G,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAkHhC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AAoBrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAmBlC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AA8BpC,cAAc,mBAAmB,CAAC;AAsBlC,cAAc,+BAA+B,CAAC;AAiC9C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AA2BnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AAuBzC,cAAc,wBAAwB,CAAC;AAqBvC,cAAc,uBAAuB,CAAC;AAiCtC,cAAc,kBAAkB,CAAC;AA8BjC,cAAc,mBAAmB,CAAC;AAElC,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACvC,KAAK,aAAa,GAAG,WAAW,CAAC;AACjC,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAqBrD,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,GAAG,EACjB,SAAS,GAAE,UAAe,EAC1B,MAAM,GAAE,aAAkB,EAC1B,iBAAiB,GAAE,GAAU,EAC7B,OAAO,GAAE,WAAgB,wBAqL1B;AA2KD,wBAAsB,0BAA0B,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,gBAUxG;AAmBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAAE,QAAQ,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC;CAAE;;gBAU3F,GAAG;;;EA4BlB;AAyJD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC;IAAC,OAAO,EAAE;QAAE,EAAE,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,GAAG,CAAC;QAAC,IAAI,EAAE,GAAG,CAAC;KAAE,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,GAAG,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC;CAAE,eA2B/O;AA2GD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,EAAE,KAAK,SAAM,SAe5E;AAED,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,GAAG;;;;;;;;;;;;;;EAY1D;AAwJD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM;;;;;IA8BpD;AAuaD,wBAAsB,aAAa,CAAC,QAAQ,EAAE;IAAE,SAAS,EAAE,GAAG,EAAE,CAAC;CAAE,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,CAAC,eAAe,CAAC,GAAG;IAAE,GAAG,EAAE,eAAe,CAAC;CAAE,oBAmBnK;AA2BD,wBAAsB,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE;IAAE,OAAO,CAAC,EAAE,QAAQ,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,gBAwCxI;AAsID,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,GAAE,GAAU;;EAIzF;AA0RD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,GAAG;;;SAahD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM;;;;EAU1E;AAiBD,KAAK,uBAAuB,GAAG;IAC7B,aAAa,EAAE,uBAAuB,CAAC;IACvC,YAAY,EAAE,sBAAsB,CAAC;IACrC,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACtI,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACvD,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,EAAE,cAAc,GAAE,uBAAuB,GAAG,IAAW;;oBAgBtF,eAAe,UAAU,MAAM;;;;;;;;;;;;;;;;;;;;4BAiF7B,GAAG,SAAS,GAAG;+BAaZ,GAAG,eAAe;QAAE,YAAY,EAAE;YAAE,KAAK,EAAE,GAAG,CAAC;SAAE,CAAC;QAAC,IAAI,EAAE,GAAG,CAAC;KAAE;;;;;EA42B7F;AA+CD,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,WAAgB;;;;;;;;;GAyB1B;AA2GD,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,OAAY,GAAG,OAAO,CAAC,GAAG,CAAC,CAyDvH;AA6FD,wBAAsB,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,gBA6ClG;AAyBD,wBAAsB,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,GAAE,WAAgB,gBA6E3H;AAyOD,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,iBAuDlE"}

package/dist/server-runtime-source.js

@@ -2548,7 +2548,31 @@ export function createWebSocketHub(getDatabase, trustedRefresh = null) {
                 });
                 return;
             }
-            const subscription = { id: message.id, name: queryName, style: message.query ? "direct" : "rows", generation: 0 };
+            let args;
+            try {
+                args = normalizeQueryArguments(message.args ?? []);
+            }
+            catch {
+                sendJson(client, {
+                    id: message.id,
+                    type: "query.result",
+                    query: queryName,
+                    data: null,
+                    error: invalidQueryArgumentsError(),
+                });
+                return;
+            }
+            if (!message.query && args.length > 0) {
+                sendJson(client, {
+                    id: message.id,
+                    type: "query.result",
+                    query: queryName,
+                    data: null,
+                    error: invalidQueryArgumentsError(),
+                });
+                return;
+            }
+            const subscription = { id: message.id, name: queryName, args, style: message.query ? "direct" : "rows", generation: 0 };
             client.subscriptions.set(message.id, subscription);
             void sendQueryResult(client, subscription, (error) => sendUnhandledMessageError(client, rawMessage, error));
             return;
@@ -2959,7 +2983,7 @@ export function createWebSocketHub(getDatabase, trustedRefresh = null) {
         subscription.generation = generation;
         try {
             const database = getDatabase();
-            const result = await runQuery(database, client.session.auth, subscription.name);
+            const result = await runQuery(database, client.session.auth, subscription.name, subscription.args);
             const data = subscription.style === "direct"
                 ? (result.data ?? result.rows)
                 : { rows: result.data ?? result.rows };
@@ -3197,7 +3221,14 @@ function sendJsonWithCompletion(client, message, timeoutMs = 250) {
         }
     });
 }
-export async function runQuery(database, auth, queryName) {
+export async function runQuery(database, auth, queryName, rawArgs = []) {
+    let args;
+    try {
+        args = normalizeQueryArguments(rawArgs);
+    }
+    catch {
+        return { rows: null, data: null, error: invalidQueryArgumentsError() };
+    }
     let context;
     try {
         context = await applyContextMiddleware(database, createMutationContext(database, auth), "query");
@@ -3212,9 +3243,11 @@ export async function runQuery(database, auth, queryName) {
         };
     }
     if (queryName === "ctx.env") {
+        if (args.length > 0)
+            return { rows: null, data: null, error: invalidQueryArgumentsError() };
         return { data: context.env, error: null };
     }
-    const customResult = await runCustomQuery(database, context, queryName);
+    const customResult = await runCustomQuery(database, context, queryName, args);
     if (customResult) {
         return customResult;
     }
@@ -3228,6 +3261,8 @@ export async function runQuery(database, auth, queryName) {
             },
         };
     }
+    if (args.length > 0)
+        return { rows: null, data: null, error: invalidQueryArgumentsError() };
     const cacheKey = `${table.name}:${context.auth.userId}`;
     if (!database.rowCache.has(cacheKey)) {
         const columns = ["id", "createdAt", "updatedAt", ...table.fields.map((field) => field.name)];
@@ -3242,7 +3277,7 @@ export async function runQuery(database, auth, queryName) {
     const rows = await filterRowsByReadAcl(database, table, database.rowCache.get(cacheKey), context);
     return { rows, error: null };
 }
-async function runCustomQuery(database, context, queryName) {
+async function runCustomQuery(database, context, queryName, args) {
     const handler = database.queries.find((candidate) => candidate.name === queryName);
     if (!handler) {
         return null;
@@ -3251,7 +3286,7 @@ async function runCustomQuery(database, context, queryName) {
         const queryHandler = typeof handler.handler === "function"
             ? handler.handler
             : new Function(`return (${handler.handlerSource});`)();
-        const data = await queryHandler(context);
+        const data = await queryHandler(context, ...args);
         assertJsonCompatible(data);
         return { data, error: null };
     }
@@ -3269,6 +3304,73 @@ async function runCustomQuery(database, context, queryName) {
         };
     }
 }
+const QUERY_ARGUMENT_LIMIT_BYTES = 65536;
+function invalidQueryArgumentsError() {
+    return {
+        message: "Invalid query arguments.",
+        hint: "Use a JSON-compatible argument array no larger than 65536 UTF-8 bytes.",
+    };
+}
+function normalizeQueryArguments(value) {
+    if (!Array.isArray(value))
+        throw new Error("Query arguments must be an array.");
+    const snapshot = normalizeQueryArgumentValue(value, new Set());
+    const canonicalJson = JSON.stringify(snapshot);
+    if (Buffer.byteLength(canonicalJson, "utf8") > QUERY_ARGUMENT_LIMIT_BYTES) {
+        throw new Error("Query arguments are too large.");
+    }
+    return snapshot;
+}
+function normalizeQueryArgumentValue(value, ancestors) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return value;
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new Error("Query arguments must contain finite numbers.");
+        return value;
+    }
+    if (typeof value !== "object")
+        throw new Error("Query arguments must be JSON-compatible.");
+    if (Object.getOwnPropertySymbols(value).length > 0)
+        throw new Error("Query arguments must not contain symbol keys.");
+    if (ancestors.has(value))
+        throw new Error("Query arguments must not contain cycles.");
+    ancestors.add(value);
+    try {
+        if (Array.isArray(value)) {
+            if (Object.getOwnPropertyNames(value).some((key) => key !== "length" && (!/^(0|[1-9]\\d*)$/.test(key) || Number(key) >= value.length))) {
+                throw new Error("Query arguments must not contain non-index array properties.");
+            }
+            const copy = [];
+            for (let index = 0; index < value.length; index += 1) {
+                if (!Object.hasOwn(value, index))
+                    throw new Error("Query arguments must not contain sparse arrays.");
+                copy.push(normalizeQueryArgumentValue(value[index], ancestors));
+            }
+            return Object.freeze(copy);
+        }
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null) {
+            throw new Error("Query arguments must contain plain objects only.");
+        }
+        const copy = Object.create(null);
+        for (const key of Object.getOwnPropertyNames(value).sort()) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (!descriptor || !descriptor.enumerable || !("value" in descriptor))
+                throw new Error("Query arguments must not contain accessors.");
+            Object.defineProperty(copy, key, {
+                value: normalizeQueryArgumentValue(descriptor.value, ancestors),
+                enumerable: true,
+                writable: false,
+                configurable: false,
+            });
+        }
+        return Object.freeze(copy);
+    }
+    finally {
+        ancestors.delete(value);
+    }
+}
 export async function runMutation(database, auth, mutationName, args) {
     let context;
     let result;