@concavejs/runtime-cf-base 0.0.1-alpha.6 → 0.0.1-alpha.8

package/dist/durable-objects/blobstore-rpc.d.ts

@@ -0,0 +1,13 @@
+import type { BlobStore, StorageOptions, StorageMetadata } from "@concavejs/core/abstractions";
+/**
+ * BlobStore RPC surface for service-binding isolation.
+ * Provides async delegation methods for blob storage operations.
+ */
+export declare class BlobStoreRpc {
+    private readonly blobstore;
+    constructor(blobstore: BlobStore);
+    store(buffer: ArrayBuffer, options?: StorageOptions): Promise<StorageMetadata>;
+    get(storageId: string): Promise<ArrayBuffer | null>;
+    delete(storageId: string): Promise<void>;
+    getUrl(storageId: string): Promise<string | null>;
+}

package/dist/durable-objects/blobstore-rpc.js

@@ -0,0 +1,27 @@
+/**
+ * BlobStore RPC surface for service-binding isolation.
+ * Provides async delegation methods for blob storage operations.
+ */
+export class BlobStoreRpc {
+    blobstore;
+    constructor(blobstore) {
+        this.blobstore = blobstore;
+    }
+    async store(buffer, options) {
+        return this.blobstore.store(buffer, options);
+    }
+    async get(storageId) {
+        const result = await this.blobstore.get(storageId);
+        if (result === null)
+            return null;
+        if (result instanceof Blob)
+            return result.arrayBuffer();
+        return result;
+    }
+    async delete(storageId) {
+        return this.blobstore.delete(storageId);
+    }
+    async getUrl(storageId) {
+        return this.blobstore.getUrl(storageId);
+    }
+}

package/dist/durable-objects/concave-do-base.d.ts

@@ -63,6 +63,10 @@ export declare class ConcaveDOBase extends DurableObject {
     env: any;
     protected scheduler: ScheduledFunctionExecutor;
     protected cronExecutor: CronExecutor;
+    private readonly docStoreRpc;
+    private readonly blobStoreRpc;
+    private readonly syncNotifier;
+    private schedulerManager;
     constructor(state: DurableObjectState, env: any, config: ConcaveDOConfig);
     /**
      * Initialize scheduler and cron executor
@@ -74,6 +78,7 @@ export declare class ConcaveDOBase extends DurableObject {
      * runtime auto-discovery from the global module registry.
      */
     private initializeCronSpecs;
+    private currentSnapshotTimestamp;
     /**
      * Main request handler
      */
@@ -89,7 +94,7 @@ export declare class ConcaveDOBase extends DurableObject {
     /**
      * Execute a UDF
      */
-    protected execute(path: string, args: Record<string, any>, type: "query" | "mutation" | "action", auth?: any, componentPath?: string, requestId?: string): Promise<UdfResult>;
+    protected execute(path: string, args: Record<string, any>, type: "query" | "mutation" | "action", auth?: any, componentPath?: string, requestId?: string, snapshotTimestamp?: bigint): Promise<UdfResult>;
     /**
      * Handle scheduled function alarms
      */

package/dist/durable-objects/concave-do-base.js

@@ -12,7 +12,12 @@ import { getSearchIndexesFromSchema, getVectorIndexesFromSchema } from "@concave
 import { SchemaService } from "@concavejs/core/kernel";
 import { runAsClientCall, runAsServerCall } from "@concavejs/core/udf";
 import { ScheduledFunctionExecutor, CronExecutor } from "@concavejs/core";
-import { resolveAdminAuthConfigFromEnv, resolveJwtValidationConfigFromEnv, resolveSystemAuthConfigFromEnv, setAdminAuthConfig, setJwtValidationConfig, setSystemAuthConfig, } from "@concavejs/core/auth";
+import { resolveAuthContext } from "@concavejs/core/http";
+import { AdminAuthError, identityFromToken, isAdminToken, isSystemToken, JWTValidationError, resolveAdminAuthConfigFromEnv, resolveJwtValidationConfigFromEnv, resolveSystemAuthConfigFromEnv, setAdminAuthConfig, setJwtValidationConfig, setSystemAuthConfig, SystemAuthError, } from "@concavejs/core/auth";
+import { DocStoreRpc } from "./docstore-rpc";
+import { BlobStoreRpc } from "./blobstore-rpc";
+import { SyncNotifier } from "./sync-notifier";
+import { SchedulerManager } from "./scheduler-manager";
 const VERSIONED_API_PREFIX = /^\/api\/\d+\.\d+(?:\.\d+)?(?=\/|$)/;
 function stripApiVersionPrefix(pathname) {
     return pathname.replace(VERSIONED_API_PREFIX, "/api");
@@ -23,6 +28,8 @@ function isReservedApiPath(pathname) {
         normalizedPath === "/api/sync" ||
         normalizedPath === "/api/reset-test-state" ||
         normalizedPath === "/api/query" ||
+        normalizedPath === "/api/query_ts" ||
+        normalizedPath === "/api/query_at_ts" ||
         normalizedPath === "/api/mutation" ||
         normalizedPath === "/api/action") {
         return true;
@@ -41,6 +48,28 @@ function shouldHandleAsHttpRoute(pathname) {
     }
     return !isReservedApiPath(pathname);
 }
+function parseSnapshotTimestamp(value) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    if (typeof value === "bigint") {
+        return value;
+    }
+    if (typeof value === "number") {
+        if (!Number.isFinite(value) || !Number.isInteger(value) || value < 0) {
+            throw new Error("Invalid snapshotTimestamp");
+        }
+        return BigInt(value);
+    }
+    if (typeof value === "string") {
+        const trimmed = value.trim();
+        if (!/^\d+$/.test(trimmed)) {
+            throw new Error("Invalid snapshotTimestamp");
+        }
+        return BigInt(trimmed);
+    }
+    throw new Error("Invalid snapshotTimestamp");
+}
 /**
  * Base class for Concave Durable Objects
  *
@@ -61,6 +90,10 @@ export class ConcaveDOBase extends DurableObject {
     env;
     scheduler;
     cronExecutor;
+    docStoreRpc;
+    blobStoreRpc;
+    syncNotifier;
+    schedulerManager;
     constructor(state, env, config) {
         super(state, env);
         this.doState = state;
@@ -74,7 +107,6 @@ export class ConcaveDOBase extends DurableObject {
         setAdminAuthConfig(adminConfig);
         setSystemAuthConfig(systemConfig);
         const instanceId = state.id.name ?? state.id.toString();
-        console.log(`[ConcaveDO.constructor] instanceId=${instanceId}`);
         const adapterContext = {
             state,
             env,
@@ -84,6 +116,9 @@ export class ConcaveDOBase extends DurableObject {
         this._docstore = config.createDocstore ? config.createDocstore(adapterContext) : new DODocStore(state);
         // Create BlobStore (allow override for testing or alternative implementations)
         this._blobstore = config.createBlobstore?.(adapterContext);
+        this.docStoreRpc = new DocStoreRpc(this._docstore);
+        this.blobStoreRpc = this._blobstore ? new BlobStoreRpc(this._blobstore) : null;
+        this.syncNotifier = new SyncNotifier(state, env);
         // Create UDF executor from resolved runtime services
         this.udfExecutor = config.createUdfExecutor({
             ...adapterContext,
@@ -128,6 +163,7 @@ export class ConcaveDOBase extends DurableObject {
             notifyWrites,
             allocateTimestamp,
         });
+        this.schedulerManager = new SchedulerManager(this.scheduler, this.cronExecutor, this.doState);
     }
     /**
      * Discover and sync cron specs during DO initialization.
@@ -155,11 +191,30 @@ export class ConcaveDOBase extends DurableObject {
             console.warn("[ConcaveDO] Failed to initialize cron specs:", error?.message ?? error);
         }
     }
+    currentSnapshotTimestamp() {
+        const oracle = this._docstore?.timestampOracle;
+        const oracleTimestamp = typeof oracle?.beginSnapshot === "function"
+            ? oracle.beginSnapshot()
+            : typeof oracle?.getCurrentTimestamp === "function"
+                ? oracle.getCurrentTimestamp()
+                : undefined;
+        const wallClock = BigInt(Date.now());
+        if (typeof oracleTimestamp === "bigint" && oracleTimestamp > wallClock) {
+            return oracleTimestamp;
+        }
+        return wallClock;
+    }
     /**
      * Main request handler
      */
     async fetch(request) {
         const url = new URL(request.url);
+        if (url.pathname === "/query_ts") {
+            if (request.method !== "POST") {
+                return new Response("Method not allowed", { status: 405 });
+            }
+            return Response.json({ ts: this.currentSnapshotTimestamp().toString() }, { headers: this.corsHeaders(request) });
+        }
         if (shouldHandleAsHttpRoute(url.pathname)) {
             return this.handleHttp(request);
         }
@@ -173,13 +228,16 @@ export class ConcaveDOBase extends DurableObject {
      */
     async handleUdfRequest(request) {
         try {
-            const { path, args, type, auth, componentPath, caller } = await request.json();
+            const { path, args, type, auth, componentPath, caller, snapshotTimestamp } = await request.json();
             const convexArgs = jsonToConvex(args);
+            const parsedSnapshotTimestamp = parseSnapshotTimestamp(snapshotTimestamp);
             const requestId = crypto.randomUUID();
-            const exec = () => this.execute(path, convexArgs, type, auth, componentPath, requestId);
+            const exec = () => this.execute(path, convexArgs, type, auth, componentPath, requestId, parsedSnapshotTimestamp);
             const result = caller === "server" ? await runAsServerCall(exec, path) : await runAsClientCall(exec);
             if (type === "mutation" || type === "action") {
-                this.doState.waitUntil(this.reschedule());
+                this.doState.waitUntil(this.reschedule().catch((error) => {
+                    console.error("[ConcaveDO] Failed to reschedule alarm", error?.message ?? error);
+                }));
             }
             const writtenTables = writtenTablesFromRanges(result.writtenRanges) ?? [];
             const responseBody = {
@@ -196,8 +254,9 @@ export class ConcaveDOBase extends DurableObject {
         }
         catch (e) {
             console.error(e);
-            return new Response(`Error in Durable Object: ${e.message}`, {
-                headers: this.corsHeaders(request),
+            const errorMessage = e?.message ?? "Internal Server Error";
+            return new Response(JSON.stringify({ error: errorMessage }), {
+                headers: { "Content-Type": "application/json", ...this.corsHeaders(request) },
                 status: 500,
             });
         }
@@ -210,177 +269,137 @@ export class ConcaveDOBase extends DurableObject {
             const url = new URL(request.url);
             url.pathname = url.pathname.replace(/^\/api\/http/, "");
             const req = new Request(url.toString(), request);
-            const auth = undefined;
+            const authHeader = req.headers.get("Authorization");
+            const headerToken = authHeader?.replace(/^Bearer\s+/i, "").trim() || undefined;
+            let headerIdentity;
+            try {
+                headerIdentity =
+                    headerToken && !isAdminToken(headerToken) && !isSystemToken(headerToken)
+                        ? await identityFromToken(headerToken)
+                        : undefined;
+            }
+            catch (error) {
+                if (error instanceof JWTValidationError || error instanceof AdminAuthError || error instanceof SystemAuthError) {
+                    return Response.json({ error: "Unauthorized" }, { status: 401, headers: this.corsHeaders(request) });
+                }
+                throw error;
+            }
+            const auth = (await resolveAuthContext(undefined, headerToken, headerIdentity));
             const requestId = crypto.randomUUID();
             return this.udfExecutor.executeHttp(req, auth, requestId);
         }
         catch (e) {
             console.error(e);
-            return new Response(`Error in Durable Object: ${e.message}`, { status: 500 });
+            return new Response("Internal Server Error", { status: 500, headers: this.corsHeaders(request) });
         }
     }
     /**
      * Execute a UDF
      */
-    async execute(path, args, type, auth, componentPath, requestId) {
-        return this.udfExecutor.execute(path, args, type, auth, componentPath, requestId);
+    async execute(path, args, type, auth, componentPath, requestId, snapshotTimestamp) {
+        return this.udfExecutor.execute(path, args, type, auth, componentPath, requestId, snapshotTimestamp);
     }
     /**
      * Handle scheduled function alarms
      */
     async alarm() {
-        const scheduledResult = await this.scheduler.runDueJobs();
-        const cronResult = await this.cronExecutor.runDueJobs();
-        const nextTimes = [scheduledResult.nextScheduledTime, cronResult.nextScheduledTime].filter((t) => t !== null);
-        if (nextTimes.length === 0) {
-            await this.doState.storage.deleteAlarm();
-        }
-        else {
-            await this.doState.storage.setAlarm(Math.min(...nextTimes));
-        }
+        return this.schedulerManager.handleAlarm();
     }
     /**
      * Reschedule alarms
      */
     async reschedule() {
-        const scheduledTime = await this.scheduler.getNextScheduledTime();
-        const cronTime = await this.cronExecutor.getNextScheduledTime();
-        const nextTimes = [scheduledTime, cronTime].filter((t) => t !== null);
-        if (nextTimes.length === 0) {
-            await this.doState.storage.deleteAlarm();
-        }
-        else {
-            await this.doState.storage.setAlarm(Math.min(...nextTimes));
-        }
+        return this.schedulerManager.reschedule();
     }
     /**
      * Sync cron specs
      */
     async syncCronSpecs(cronSpecs) {
-        await this.cronExecutor.syncCronSpecs(cronSpecs);
-        await this.reschedule();
+        return this.schedulerManager.syncCronSpecs(cronSpecs);
     }
     // =============================================================================
     // DocStore RPC Methods - Direct delegation to _docstore
     // =============================================================================
     async setupSchema(options) {
-        return this._docstore.setupSchema(options);
+        return this.docStoreRpc.setupSchema(options);
     }
     async write(documents, indexes, conflictStrategy) {
-        return this._docstore.write(documents, indexes, conflictStrategy);
+        return this.docStoreRpc.write(documents, indexes, conflictStrategy);
     }
     async get(id, readTimestamp) {
-        return this._docstore.get(id, readTimestamp);
+        return this.docStoreRpc.get(id, readTimestamp);
     }
     async scan(table, readTimestamp) {
-        return this._docstore.scan(table, readTimestamp);
+        return this.docStoreRpc.scan(table, readTimestamp);
     }
     async scanPaginated(table, cursor, limit, order, readTimestamp) {
-        return this._docstore.scanPaginated(table, cursor, limit, order, readTimestamp);
+        return this.docStoreRpc.scanPaginated(table, cursor, limit, order, readTimestamp);
     }
     /**
      * Generators return arrays over RPC (cannot stream async generators)
      */
     async index_scan(indexId, tabletId, readTimestamp, interval, order) {
-        const results = [];
-        for await (const item of this._docstore.index_scan(indexId, tabletId, readTimestamp, interval, order)) {
-            results.push(item);
-        }
-        return results;
+        return this.docStoreRpc.index_scan(indexId, tabletId, readTimestamp, interval, order);
     }
     /**
      * Generators return arrays over RPC (cannot stream async generators)
      */
     async load_documents(range, order) {
-        const results = [];
-        for await (const item of this._docstore.load_documents(range, order)) {
-            results.push(item);
-        }
-        return results;
+        return this.docStoreRpc.load_documents(range, order);
     }
     async count(table) {
-        return this._docstore.count(table);
+        return this.docStoreRpc.count(table);
     }
     async search(indexId, searchQuery, filters, options) {
-        return this._docstore.search(indexId, searchQuery, filters, options);
+        return this.docStoreRpc.search(indexId, searchQuery, filters, options);
     }
     async vectorSearch(indexId, vector, limit, filters) {
-        return this._docstore.vectorSearch(indexId, vector, limit, filters);
+        return this.docStoreRpc.vectorSearch(indexId, vector, limit, filters);
     }
     async getGlobal(key) {
-        return this._docstore.getGlobal(key);
+        return this.docStoreRpc.getGlobal(key);
     }
     async writeGlobal(key, value) {
-        return this._docstore.writeGlobal(key, value);
+        return this.docStoreRpc.writeGlobal(key, value);
     }
     async previous_revisions(queries) {
-        const result = await this._docstore.previous_revisions(queries);
-        return Array.from(result.entries());
+        return this.docStoreRpc.previous_revisions(queries);
     }
     async previous_revisions_of_documents(queries) {
-        const result = await this._docstore.previous_revisions_of_documents(queries);
-        return Array.from(result.entries());
+        return this.docStoreRpc.previous_revisions_of_documents(queries);
     }
     // =============================================================================
     // Blobstore RPC Methods - Prefixed to avoid collision with other methods
     // =============================================================================
     async blobstoreStore(buffer, options) {
-        if (!this._blobstore) {
+        if (!this.blobStoreRpc) {
             throw new Error("Blobstore not configured");
         }
-        return this._blobstore.store(buffer, options);
+        return this.blobStoreRpc.store(buffer, options);
     }
     async blobstoreGet(storageId) {
-        if (!this._blobstore) {
+        if (!this.blobStoreRpc) {
             throw new Error("Blobstore not configured");
         }
-        const result = await this._blobstore.get(storageId);
-        if (result === null)
-            return null;
-        if (result instanceof Blob)
-            return result.arrayBuffer();
-        return result;
+        return this.blobStoreRpc.get(storageId);
     }
     async blobstoreDelete(storageId) {
-        if (!this._blobstore) {
+        if (!this.blobStoreRpc) {
             throw new Error("Blobstore not configured");
         }
-        return this._blobstore.delete(storageId);
+        return this.blobStoreRpc.delete(storageId);
     }
     async blobstoreGetUrl(storageId) {
-        if (!this._blobstore) {
+        if (!this.blobStoreRpc) {
             throw new Error("Blobstore not configured");
         }
-        return this._blobstore.getUrl(storageId);
+        return this.blobStoreRpc.getUrl(storageId);
     }
     /**
      * Notify SyncDO of writes for subscription invalidation
      */
     async notifySyncDo(writtenRanges, writtenTables, commitTimestamp) {
-        if (!writtenRanges?.length && !writtenTables?.length) {
-            return;
-        }
-        try {
-            const instanceName = this.doState.id.name ?? "singleton";
-            const syncNamespace = this.env?.SYNC_DO;
-            if (!syncNamespace) {
-                return;
-            }
-            const syncId = syncNamespace.idFromName(instanceName);
-            const syncStub = syncNamespace.get(syncId);
-            await syncStub.fetch("http://do/notify", {
-                method: "POST",
-                headers: { "Content-Type": "application/json" },
-                body: JSON.stringify({
-                    writtenRanges,
-                    writtenTables,
-                    commitTimestamp: commitTimestamp ? commitTimestamp.toString() : undefined,
-                }),
-            });
-        }
-        catch (error) {
-            console.warn("Failed to notify SyncDO", error?.message ?? error);
-        }
+        return this.syncNotifier.notify(writtenRanges, writtenTables, commitTimestamp);
     }
     /**
      * Get CORS headers for responses

package/dist/durable-objects/docstore-rpc.d.ts

@@ -0,0 +1,46 @@
+import type { DocStore, DocumentLogEntry, DatabaseIndexUpdate, Interval, Order, IndexKeyBytes, LatestDocument, TimestampRange, InternalDocumentId, GlobalKey, DocumentPrevTsQuery, SearchIndexDefinition, VectorIndexDefinition } from "@concavejs/core/docstore";
+import type { JSONValue } from "convex/values";
+/**
+ * DocStore RPC surface for service-binding isolation.
+ * Provides async delegation methods that flatten generators into arrays
+ * for RPC transport (async generators cannot be streamed over service bindings).
+ */
+export declare class DocStoreRpc {
+    private readonly docstore;
+    constructor(docstore: DocStore);
+    setupSchema(options?: {
+        searchIndexes?: SearchIndexDefinition[];
+        vectorIndexes?: VectorIndexDefinition[];
+    }): Promise<void>;
+    write(documents: DocumentLogEntry[], indexes: Set<{
+        ts: bigint;
+        update: DatabaseIndexUpdate;
+    }>, conflictStrategy: "Error" | "Overwrite"): Promise<void>;
+    get(id: InternalDocumentId, readTimestamp?: bigint): Promise<LatestDocument | null>;
+    scan(table: string, readTimestamp?: bigint): Promise<LatestDocument[]>;
+    scanPaginated(table: string, cursor: string | null, limit: number, order: Order, readTimestamp?: bigint): Promise<{
+        documents: LatestDocument[];
+        nextCursor: string | null;
+        hasMore: boolean;
+    }>;
+    index_scan(indexId: string, tabletId: string, readTimestamp: bigint, interval: Interval, order: Order): Promise<[IndexKeyBytes, LatestDocument][]>;
+    load_documents(range: TimestampRange, order: Order): Promise<DocumentLogEntry[]>;
+    count(table: string): Promise<number>;
+    search(indexId: string, searchQuery: string, filters: Map<string, unknown>, options?: {
+        limit?: number;
+    }): Promise<{
+        doc: LatestDocument;
+        score: number;
+    }[]>;
+    vectorSearch(indexId: string, vector: number[], limit: number, filters: Map<string, string>): Promise<{
+        doc: LatestDocument;
+        score: number;
+    }[]>;
+    getGlobal(key: GlobalKey): Promise<JSONValue | null>;
+    writeGlobal(key: GlobalKey, value: JSONValue): Promise<void>;
+    previous_revisions(queries: Set<{
+        id: InternalDocumentId;
+        ts: bigint;
+    }>): Promise<[string, DocumentLogEntry][]>;
+    previous_revisions_of_documents(queries: Set<DocumentPrevTsQuery>): Promise<[string, DocumentLogEntry][]>;
+}

package/dist/durable-objects/docstore-rpc.js

@@ -0,0 +1,63 @@
+/**
+ * DocStore RPC surface for service-binding isolation.
+ * Provides async delegation methods that flatten generators into arrays
+ * for RPC transport (async generators cannot be streamed over service bindings).
+ */
+export class DocStoreRpc {
+    docstore;
+    constructor(docstore) {
+        this.docstore = docstore;
+    }
+    async setupSchema(options) {
+        return this.docstore.setupSchema(options);
+    }
+    async write(documents, indexes, conflictStrategy) {
+        return this.docstore.write(documents, indexes, conflictStrategy);
+    }
+    async get(id, readTimestamp) {
+        return this.docstore.get(id, readTimestamp);
+    }
+    async scan(table, readTimestamp) {
+        return this.docstore.scan(table, readTimestamp);
+    }
+    async scanPaginated(table, cursor, limit, order, readTimestamp) {
+        return this.docstore.scanPaginated(table, cursor, limit, order, readTimestamp);
+    }
+    async index_scan(indexId, tabletId, readTimestamp, interval, order) {
+        const results = [];
+        for await (const item of this.docstore.index_scan(indexId, tabletId, readTimestamp, interval, order)) {
+            results.push(item);
+        }
+        return results;
+    }
+    async load_documents(range, order) {
+        const results = [];
+        for await (const item of this.docstore.load_documents(range, order)) {
+            results.push(item);
+        }
+        return results;
+    }
+    async count(table) {
+        return this.docstore.count(table);
+    }
+    async search(indexId, searchQuery, filters, options) {
+        return this.docstore.search(indexId, searchQuery, filters, options);
+    }
+    async vectorSearch(indexId, vector, limit, filters) {
+        return this.docstore.vectorSearch(indexId, vector, limit, filters);
+    }
+    async getGlobal(key) {
+        return this.docstore.getGlobal(key);
+    }
+    async writeGlobal(key, value) {
+        return this.docstore.writeGlobal(key, value);
+    }
+    async previous_revisions(queries) {
+        const result = await this.docstore.previous_revisions(queries);
+        return Array.from(result.entries());
+    }
+    async previous_revisions_of_documents(queries) {
+        const result = await this.docstore.previous_revisions_of_documents(queries);
+        return Array.from(result.entries());
+    }
+}

package/dist/durable-objects/scheduler-manager.d.ts

@@ -0,0 +1,19 @@
+import type { ScheduledFunctionExecutor, CronExecutor } from "@concavejs/core";
+/**
+ * Manages scheduled function and cron job execution.
+ * Extracted from ConcaveDOBase for single-responsibility.
+ */
+export declare class SchedulerManager {
+    private readonly scheduler;
+    private readonly cronExecutor;
+    private readonly doState;
+    constructor(scheduler: ScheduledFunctionExecutor, cronExecutor: CronExecutor, doState: {
+        storage: {
+            setAlarm(time: number): Promise<void>;
+            deleteAlarm(): Promise<void>;
+        };
+    });
+    handleAlarm(): Promise<void>;
+    reschedule(): Promise<void>;
+    syncCronSpecs(cronSpecs: Record<string, any>): Promise<void>;
+}

package/dist/durable-objects/scheduler-manager.js

@@ -0,0 +1,52 @@
+/**
+ * Manages scheduled function and cron job execution.
+ * Extracted from ConcaveDOBase for single-responsibility.
+ */
+export class SchedulerManager {
+    scheduler;
+    cronExecutor;
+    doState;
+    constructor(scheduler, cronExecutor, doState) {
+        this.scheduler = scheduler;
+        this.cronExecutor = cronExecutor;
+        this.doState = doState;
+    }
+    async handleAlarm() {
+        try {
+            const scheduledResult = await this.scheduler.runDueJobs();
+            const cronResult = await this.cronExecutor.runDueJobs();
+            const nextTimes = [scheduledResult.nextScheduledTime, cronResult.nextScheduledTime].filter((t) => t !== null);
+            if (nextTimes.length === 0) {
+                await this.doState.storage.deleteAlarm();
+            }
+            else {
+                await this.doState.storage.setAlarm(Math.min(...nextTimes));
+            }
+        }
+        catch (error) {
+            console.error("[ConcaveDO] Alarm handler failed:", error?.message ?? error);
+            try {
+                await this.reschedule();
+            }
+            catch (rescheduleError) {
+                console.error("[ConcaveDO] Reschedule after alarm failure also failed:", rescheduleError?.message);
+            }
+        }
+    }
+    async reschedule() {
+        const scheduledTime = await this.scheduler.getNextScheduledTime();
+        const cronTime = await this.cronExecutor.getNextScheduledTime();
+        const nextTimes = [scheduledTime, cronTime].filter((t) => t !== null);
+        if (nextTimes.length === 0) {
+            await this.doState.storage.deleteAlarm();
+        }
+        else {
+            const alarmTime = Math.min(...nextTimes);
+            await this.doState.storage.setAlarm(alarmTime);
+        }
+    }
+    async syncCronSpecs(cronSpecs) {
+        await this.cronExecutor.syncCronSpecs(cronSpecs);
+        await this.reschedule();
+    }
+}

package/dist/durable-objects/sync-notifier.d.ts

@@ -0,0 +1,16 @@
+import type { SerializedKeyRange } from "@concavejs/core/queryengine";
+/**
+ * Notifies the SyncDO of writes for subscription invalidation.
+ * Extracted from ConcaveDOBase for single-responsibility.
+ */
+export declare class SyncNotifier {
+    private readonly doState;
+    private readonly env;
+    constructor(doState: {
+        id: {
+            name: string | null;
+            toString(): string;
+        };
+    }, env: any);
+    notify(writtenRanges?: SerializedKeyRange[], writtenTables?: string[], commitTimestamp?: bigint): Promise<void>;
+}

package/dist/durable-objects/sync-notifier.js

@@ -0,0 +1,38 @@
+/**
+ * Notifies the SyncDO of writes for subscription invalidation.
+ * Extracted from ConcaveDOBase for single-responsibility.
+ */
+export class SyncNotifier {
+    doState;
+    env;
+    constructor(doState, env) {
+        this.doState = doState;
+        this.env = env;
+    }
+    async notify(writtenRanges, writtenTables, commitTimestamp) {
+        if (!writtenRanges?.length && !writtenTables?.length) {
+            return;
+        }
+        try {
+            const instanceName = this.doState.id.name ?? "singleton";
+            const syncNamespace = this.env?.SYNC_DO;
+            if (!syncNamespace) {
+                return;
+            }
+            const syncId = syncNamespace.idFromName(instanceName);
+            const syncStub = syncNamespace.get(syncId);
+            await syncStub.fetch("http://do/notify", {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({
+                    writtenRanges,
+                    writtenTables,
+                    commitTimestamp: commitTimestamp ? commitTimestamp.toString() : undefined,
+                }),
+            });
+        }
+        catch (error) {
+            console.warn("Failed to notify SyncDO", error?.message ?? error);
+        }
+    }
+}

package/dist/http/http-api.js

@@ -15,6 +15,8 @@ function isReservedApiPath(pathname) {
         normalizedPath === "/api/sync" ||
         normalizedPath === "/api/reset-test-state" ||
         normalizedPath === "/api/query" ||
+        normalizedPath === "/api/query_ts" ||
+        normalizedPath === "/api/query_at_ts" ||
         normalizedPath === "/api/mutation" ||
         normalizedPath === "/api/action") {
         return true;
@@ -36,6 +38,24 @@ function shouldForwardApiPath(pathname) {
     }
     return !isReservedApiPath(pathname);
 }
+function arrayBufferToBase64(buffer) {
+    const bytes = new Uint8Array(buffer);
+    const chunkSize = 0x8000;
+    let binary = "";
+    for (let offset = 0; offset < bytes.length; offset += chunkSize) {
+        const chunk = bytes.subarray(offset, Math.min(offset + chunkSize, bytes.length));
+        binary += String.fromCharCode(...chunk);
+    }
+    return btoa(binary);
+}
+function base64ToArrayBuffer(base64) {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes.buffer;
+}
 /**
  * Create a storage adapter that routes through the ConcaveDO's storage syscall handler.
  * This ensures storage operations are properly isolated within the DO.
@@ -44,7 +64,7 @@ function createStorageAdapter(concaveDO, _instance) {
     return {
         store: async (blob) => {
             const buffer = await blob.arrayBuffer();
-            const base64 = btoa(String.fromCharCode(...new Uint8Array(buffer)));
+            const base64 = arrayBufferToBase64(buffer);
             const response = await concaveDO.fetch("http://do/storage", {
                 method: "POST",
                 headers: { "Content-Type": "application/json" },
@@ -81,12 +101,8 @@ function createStorageAdapter(concaveDO, _instance) {
             if (!result.result || !result.result.__arrayBuffer) {
                 return { blob: null };
             }
-            const binary = atob(result.result.__arrayBuffer);
-            const bytes = new Uint8Array(binary.length);
-            for (let i = 0; i < binary.length; i++) {
-                bytes[i] = binary.charCodeAt(i);
-            }
-            return { blob: new Blob([bytes.buffer]) };
+            const buffer = base64ToArrayBuffer(result.result.__arrayBuffer);
+            return { blob: new Blob([buffer]) };
         },
     };
 }
@@ -142,10 +158,28 @@ export async function handleHttpApiRequest(request, env, ctx, instance = "single
     }
     // Note: Internal function access control is now handled by core executor (fail-closed)
     const coreResult = await handleCoreHttpApiRequest(request, {
-        executeFunction: async ({ type, path, args, auth, componentPath }) => adapter.executeUdf(path, args, type, auth, componentPath),
+        executeFunction: async ({ type, path, args, auth, componentPath, snapshotTimestamp }) => adapter.executeUdf(path, args, type, auth, componentPath, undefined, snapshotTimestamp),
         notifyWrites,
         storage: storageAdapter,
         corsHeaders,
+        getSnapshotTimestamp: async () => {
+            try {
+                const response = await concave.fetch("http://do/query_ts", {
+                    method: "POST",
+                });
+                if (!response.ok) {
+                    throw new Error(`query_ts failed with status ${response.status}`);
+                }
+                const body = (await response.json());
+                if (typeof body.ts !== "string" || !/^\d+$/.test(body.ts)) {
+                    throw new Error("Invalid query_ts response");
+                }
+                return BigInt(body.ts);
+            }
+            catch {
+                return BigInt(Date.now());
+            }
+        },
     });
     if (coreResult?.handled) {
         return coreResult.response;

package/dist/rpc/docstore-proxy.js

@@ -1,3 +1,4 @@
+import { TimestampOracle } from "@concavejs/core/utils";
 /**
  * Wraps a DO stub as a DocStore.
  * Generator methods are converted from arrays back to async generators.
@@ -16,6 +17,9 @@ export function createGatewayDocStoreProxy(gateway, projectId, instance) {
  * Internal helper that creates a DocStore proxy with configurable argument transformation.
  */
 function createDocStoreProxyInternal(target, transformArgs) {
+    // Use a real TimestampOracle to guarantee monotonic, unique timestamps.
+    // The DO-side oracle cannot be accessed via RPC, so each proxy gets its own.
+    const oracle = new TimestampOracle();
     return new Proxy({}, {
         get(_, prop) {
             // Convert array results back to async generators
@@ -48,25 +52,22 @@ function createDocStoreProxyInternal(target, transformArgs) {
                     return new Map(result);
                 };
             }
-            // Provide a local timestampOracle (DO-side oracle cannot be accessed via RPC)
+            // Provide a local TimestampOracle (DO-side oracle cannot be accessed via RPC)
             if (prop === "timestampOracle") {
-                return {
-                    observeTimestamp: () => { },
-                    allocateTimestamp: () => BigInt(Date.now()),
-                    getCurrentTimestamp: () => BigInt(Date.now()),
-                    beginSnapshot: () => BigInt(Date.now()),
-                };
+                return oracle;
             }
             // No-op close
             if (prop === "close") {
                 return async () => { };
             }
-            // Bind methods to target with transformed args
-            const method = target[prop];
-            if (typeof method === "function") {
-                return (...args) => method.call(target, ...transformArgs(...args));
+            // Bind methods to target with transformed args.
+            // Use direct invocation (target[prop](...)) instead of .call() because
+            // Cloudflare RPC stubs intercept property access - .call() would be
+            // interpreted as an RPC method name rather than Function.prototype.call.
+            if (typeof target[prop] === "function") {
+                return (...args) => target[prop](...transformArgs(...args));
             }
-            return method;
+            return target[prop];
         },
     });
 }

package/dist/udf/executor/do-client-executor.d.ts

@@ -9,6 +9,6 @@ import type { AuthContext } from "@concavejs/core/sync/protocol-handler";
 export declare class ConcaveStubExecutor implements UdfExec {
     private readonly stub;
     constructor(stub: DurableObjectStub);
-    execute(path: string, args: Record<string, any>, type: "query" | "mutation" | "action", auth?: AuthContext | UserIdentityAttributes, componentPath?: string, requestId?: string): Promise<UdfResult>;
+    execute(path: string, args: Record<string, any>, type: "query" | "mutation" | "action", auth?: AuthContext | UserIdentityAttributes, componentPath?: string, requestId?: string, snapshotTimestamp?: bigint): Promise<UdfResult>;
     executeHttp(request: Request): Promise<Response>;
 }

package/dist/udf/executor/do-client-executor.js

@@ -8,7 +8,7 @@ export class ConcaveStubExecutor {
     constructor(stub) {
         this.stub = stub;
     }
-    async execute(path, args, type, auth, componentPath, requestId) {
+    async execute(path, args, type, auth, componentPath, requestId, snapshotTimestamp) {
         const payload = {
             path,
             args: convexToJson(args),
@@ -17,6 +17,7 @@ export class ConcaveStubExecutor {
             componentPath,
             caller: "client",
             requestId,
+            snapshotTimestamp: snapshotTimestamp?.toString(),
         };
         const response = await this.stub.fetch("http://do/execute", {
             method: "POST",
@@ -25,7 +26,23 @@ export class ConcaveStubExecutor {
         });
         if (!response.ok) {
             const errorText = await response.text();
-            throw new Error(`Function execution failed with status ${response.status}: ${errorText}`);
+            // Try to parse JSON error from ConcaveDO (e.g., { error: "message" })
+            let errorMessage = errorText;
+            try {
+                const parsed = JSON.parse(errorText);
+                if (parsed?.error) {
+                    errorMessage = parsed.error;
+                }
+            }
+            catch {
+                // Not JSON, use raw text
+            }
+            // Strip "UDF execution failed: " prefix from shim errors to expose original message
+            const udfPrefix = "UDF execution failed: ";
+            if (errorMessage.startsWith(udfPrefix)) {
+                errorMessage = errorMessage.slice(udfPrefix.length);
+            }
+            throw new Error(errorMessage);
         }
         const result = (await response.json());
         if (result.commitTimestamp) {

package/dist/udf/executor/isolated-executor.d.ts

@@ -19,6 +19,6 @@ export declare class UdfExecIsolated implements UdfExec {
     private instance;
     private projectId;
     constructor(stubOrOptions: UdfExecutorRpc | UdfExecIsolatedOptions);
-    execute(path: string, args: Record<string, any>, type: "query" | "mutation" | "action", auth?: any, componentPath?: string, requestId?: string): Promise<UdfResult>;
+    execute(path: string, args: Record<string, any>, type: "query" | "mutation" | "action", auth?: any, componentPath?: string, requestId?: string, snapshotTimestamp?: bigint): Promise<UdfResult>;
     executeHttp(request: Request, auth?: any, requestId?: string): Promise<Response>;
 }

package/dist/udf/executor/isolated-executor.js

@@ -21,9 +21,9 @@ export class UdfExecIsolated {
             this.projectId = "default";
         }
     }
-    async execute(path, args, type, auth, componentPath, requestId) {
+    async execute(path, args, type, auth, componentPath, requestId, snapshotTimestamp) {
         // Pass instance context for syscall routing
-        return this.rpc.execute(path, args, type, auth, componentPath, requestId, this.instance, this.projectId);
+        return this.rpc.execute(path, args, type, auth, componentPath, requestId, snapshotTimestamp, this.instance, this.projectId);
     }
     async executeHttp(request, auth, requestId) {
         return this.rpc.executeHttp(request, auth, requestId, this.instance, this.projectId);

package/dist/worker/udf-worker.d.ts

@@ -19,7 +19,7 @@ interface Env {
 export declare class UdfExecutorRpc extends WorkerEntrypoint {
     private udfExecutor;
     constructor(ctx: ExecutionContext, env: Env);
-    execute(path: string, args: Record<string, any>, type: "query" | "mutation" | "action", auth?: any, componentPath?: string, requestId?: string, _instance?: string, _projectId?: string): Promise<import("@concavejs/core").UdfResult>;
+    execute(path: string, args: Record<string, any>, type: "query" | "mutation" | "action", auth?: any, componentPath?: string, requestId?: string, snapshotTimestamp?: bigint, _instance?: string, _projectId?: string): Promise<import("@concavejs/core").UdfResult>;
     executeHttp(request: Request, auth?: any, requestId?: string, _instance?: string, _projectId?: string): Promise<Response>;
 }
 export {};

package/dist/worker/udf-worker.js

@@ -51,11 +51,11 @@ export class UdfExecutorRpc extends WorkerEntrypoint {
         // Pass blobstore if available, otherwise fall back to R2Bucket for direct mode
         this.udfExecutor = new UdfExecInline(docstore, blobstore ?? env.STORAGE_BUCKET, env.R2_PUBLIC_URL);
     }
-    async execute(path, args, type, auth, componentPath, requestId, _instance, _projectId) {
+    async execute(path, args, type, auth, componentPath, requestId, snapshotTimestamp, _instance, _projectId) {
         // Note: instance and projectId are passed for per-request context but
         // currently we rely on the environment settings for syscall routing.
         // This can be enhanced to create per-request syscall clients if needed.
-        return this.udfExecutor.execute(path, args, type, auth, componentPath, requestId);
+        return this.udfExecutor.execute(path, args, type, auth, componentPath, requestId, snapshotTimestamp);
     }
     async executeHttp(request, auth, requestId, _instance, _projectId) {
         return this.udfExecutor.executeHttp(request, auth, requestId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@concavejs/runtime-cf-base",
-  "version": "0.0.1-alpha.6",
+  "version": "0.0.1-alpha.8",
   "license": "FSL-1.1-Apache-2.0",
   "publishConfig": {
     "access": "public"
@@ -81,12 +81,12 @@
   "test": "bun test --run --passWithNoTests || true"
 },
 "dependencies": {
-  "@concavejs/core": "0.0.1-alpha.6",
-  "@concavejs/runtime-base": "0.0.1-alpha.6",
-  "@concavejs/docstore-cf-do": "0.0.1-alpha.6",
-  "@concavejs/docstore-cf-d1": "0.0.1-alpha.6",
-  "@concavejs/docstore-cf-hyperdrive": "0.0.1-alpha.6",
-  "@concavejs/blobstore-cf-r2": "0.0.1-alpha.6",
+  "@concavejs/core": "0.0.1-alpha.8",
+  "@concavejs/runtime-base": "0.0.1-alpha.8",
+  "@concavejs/docstore-cf-do": "0.0.1-alpha.8",
+  "@concavejs/docstore-cf-d1": "0.0.1-alpha.8",
+  "@concavejs/docstore-cf-hyperdrive": "0.0.1-alpha.8",
+  "@concavejs/blobstore-cf-r2": "0.0.1-alpha.8",
   "convex": "^1.27.3"
 },
 "devDependencies": {