@edge-base/server 0.2.3 → 0.2.5

package/admin-build/_app/immutable/nodes/{9.C2Ub82wn.js → 9.Dmxf6zAC.js}

@@ -1 +1 @@
-import"../chunks/CWj6FrbW.js";import{o as U}from"../chunks/Bn2NtlTj.js";import{p as j,a as z,f as G,c as b,g as t,s as m,r as g,u as n,b as y,d as D,t as J}from"../chunks/BdTBlfLy.js";import{d as K,s as N,a as O}from"../chunks/DtZk82gG.js";import{a as Q,t as V,e as W,i as X}from"../chunks/Dc1-6Po6.js";import{a as F,f as I}from"../chunks/DEELgv7K.js";import{s as Y}from"../chunks/CoI6jjbg.js";import{P as Z}from"../chunks/B8s_s9QY.js";import{a as tt}from"../chunks/Q2nPFxS6.js";import{M as _,T as et}from"../chunks/CzSAxmuj.js";import{D as at,T as rt}from"../chunks/A_3UuvCe.js";var nt=I("<button> </button>"),st=I('<div class="range-selector"></div>'),ot=I('<div class="analytics-grid"><!> <!> <!> <!></div> <div class="analytics-chart"><!></div> <div class="analytics-bottom"><!> <!></div>',1);function bt(w,M){j(M,!0);let s=D(!0),o=D(null),p=D("24h");const T=[{value:"1h",label:"1H"},{value:"6h",label:"6H"},{value:"24h",label:"24H"},{value:"7d",label:"7D"},{value:"30d",label:"30D"}],k=n(()=>()=>{switch(t(p)){case"1h":return"minute";case"6h":case"24h":return"hour";default:return"day"}});async function $(){try{const e=await Q.fetch(`data/analytics?range=${t(p)}&category=function&metric=overview&groupBy=${t(k)()}`);y(o,e,!0)}catch(e){V(e instanceof Error?e.message:"Failed to load functions analytics")}finally{y(s,!1)}}function A(e){y(p,e,!0),y(s,!0),$()}U(()=>{$();const e=setInterval($,3e4);return()=>clearInterval(e)});const H=n(()=>()=>{var c;if(!((c=t(o))!=null&&c.summary))return 0;const{totalRequests:e,totalErrors:a}=t(o).summary;return e>0?a/e*100:0}),B=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.timeSeries)||[]).map(a=>({timestamp:a.timestamp,value:a.requests??a.value??0}))}),C=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.breakdown)||[]).map(a=>({label:a.label||"other",value:a.count}))}),E=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.topItems)||[]).map(a=>({label:a.label,count:a.count,secondary:`${Math.round(a.avgLatency)}ms · ${a.errorRate.toFixed(1)}% 5xx`}))});Z(w,{title:"Functions Analytics",description:"Serverless function execution and performance metrics",get docsHref(){return tt},actions:a=>{var c=st();W(c,21,()=>T,X,(f,d)=>{var l=nt();let v;var h=b(l,!0);g(l),J(()=>{v=Y(l,1,"range-btn",null,v,{"range-btn--active":t(p)===t(d).value}),N(h,t(d).label)}),O("click",l,()=>A(t(d).value)),F(f,l)}),g(c),F(a,c)},children:(a,c)=>{var f=ot(),d=G(f),l=b(d);{let r=n(()=>{var i,u;return((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.totalRequests)??0});_(l,{label:"Invocations",get value(){return t(r)},get loading(){return t(s)}})}var v=m(l,2);{let r=n(()=>{var i,u;return((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.uniqueUsers)??0});_(v,{label:"Unique Users",get value(){return t(r)},get loading(){return t(s)}})}var h=m(v,2);{let r=n(()=>t(H)().toFixed(1));_(h,{label:"5xx Rate",get value(){return t(r)},unit:"%",get loading(){return t(s)}})}var L=m(h,2);{let r=n(()=>{var i,u;return Math.round(((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.avgLatency)??0)});_(L,{label:"Avg Duration",get value(){return t(r)},unit:"ms",get loading(){return t(s)}})}g(d);var x=m(d,2),P=b(x);{let r=n(()=>t(B)());et(P,{get data(){return t(r)},type:"bar",height:240,label:"Function invocations over time",get loading(){return t(s)},color:"#dc2626"})}g(x);var R=m(x,2),q=b(R);{let r=n(()=>t(C)());at(q,{get items(){return t(r)},title:"Functions by invocation count",get loading(){return t(s)}})}var S=m(q,2);{let r=n(()=>t(E)());rt(S,{get items(){return t(r)},title:"Top Functions",get loading(){return t(s)}})}g(R),F(a,f)}}),z()}K(["click"]);export{bt as component};
+import"../chunks/CWj6FrbW.js";import{o as U}from"../chunks/Bn2NtlTj.js";import{p as j,a as z,f as G,c as b,g as t,s as m,r as g,u as n,b as y,d as D,t as J}from"../chunks/BdTBlfLy.js";import{d as K,s as N,a as O}from"../chunks/DtZk82gG.js";import{a as Q,t as V,e as W,i as X}from"../chunks/BEW7Ez_g.js";import{a as F,f as I}from"../chunks/DEELgv7K.js";import{s as Y}from"../chunks/CoI6jjbg.js";import{P as Z}from"../chunks/B8s_s9QY.js";import{a as tt}from"../chunks/Q2nPFxS6.js";import{M as _,T as et}from"../chunks/BqTb6Mxk.js";import{D as at,T as rt}from"../chunks/D2j3I1VQ.js";var nt=I("<button> </button>"),st=I('<div class="range-selector"></div>'),ot=I('<div class="analytics-grid"><!> <!> <!> <!></div> <div class="analytics-chart"><!></div> <div class="analytics-bottom"><!> <!></div>',1);function bt(w,M){j(M,!0);let s=D(!0),o=D(null),p=D("24h");const T=[{value:"1h",label:"1H"},{value:"6h",label:"6H"},{value:"24h",label:"24H"},{value:"7d",label:"7D"},{value:"30d",label:"30D"}],k=n(()=>()=>{switch(t(p)){case"1h":return"minute";case"6h":case"24h":return"hour";default:return"day"}});async function $(){try{const e=await Q.fetch(`data/analytics?range=${t(p)}&category=function&metric=overview&groupBy=${t(k)()}`);y(o,e,!0)}catch(e){V(e instanceof Error?e.message:"Failed to load functions analytics")}finally{y(s,!1)}}function A(e){y(p,e,!0),y(s,!0),$()}U(()=>{$();const e=setInterval($,3e4);return()=>clearInterval(e)});const H=n(()=>()=>{var c;if(!((c=t(o))!=null&&c.summary))return 0;const{totalRequests:e,totalErrors:a}=t(o).summary;return e>0?a/e*100:0}),B=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.timeSeries)||[]).map(a=>({timestamp:a.timestamp,value:a.requests??a.value??0}))}),C=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.breakdown)||[]).map(a=>({label:a.label||"other",value:a.count}))}),E=n(()=>()=>{var e;return(((e=t(o))==null?void 0:e.topItems)||[]).map(a=>({label:a.label,count:a.count,secondary:`${Math.round(a.avgLatency)}ms · ${a.errorRate.toFixed(1)}% 5xx`}))});Z(w,{title:"Functions Analytics",description:"Serverless function execution and performance metrics",get docsHref(){return tt},actions:a=>{var c=st();W(c,21,()=>T,X,(f,d)=>{var l=nt();let v;var h=b(l,!0);g(l),J(()=>{v=Y(l,1,"range-btn",null,v,{"range-btn--active":t(p)===t(d).value}),N(h,t(d).label)}),O("click",l,()=>A(t(d).value)),F(f,l)}),g(c),F(a,c)},children:(a,c)=>{var f=ot(),d=G(f),l=b(d);{let r=n(()=>{var i,u;return((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.totalRequests)??0});_(l,{label:"Invocations",get value(){return t(r)},get loading(){return t(s)}})}var v=m(l,2);{let r=n(()=>{var i,u;return((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.uniqueUsers)??0});_(v,{label:"Unique Users",get value(){return t(r)},get loading(){return t(s)}})}var h=m(v,2);{let r=n(()=>t(H)().toFixed(1));_(h,{label:"5xx Rate",get value(){return t(r)},unit:"%",get loading(){return t(s)}})}var L=m(h,2);{let r=n(()=>{var i,u;return Math.round(((u=(i=t(o))==null?void 0:i.summary)==null?void 0:u.avgLatency)??0)});_(L,{label:"Avg Duration",get value(){return t(r)},unit:"ms",get loading(){return t(s)}})}g(d);var x=m(d,2),P=b(x);{let r=n(()=>t(B)());et(P,{get data(){return t(r)},type:"bar",height:240,label:"Function invocations over time",get loading(){return t(s)},color:"#dc2626"})}g(x);var R=m(x,2),q=b(R);{let r=n(()=>t(C)());at(q,{get items(){return t(r)},title:"Functions by invocation count",get loading(){return t(s)}})}var S=m(q,2);{let r=n(()=>t(E)());rt(S,{get items(){return t(r)},title:"Top Functions",get loading(){return t(s)}})}g(R),F(a,f)}}),z()}K(["click"]);export{bt as component};

package/admin-build/_app/version.json

@@ -1 +1 @@
-{"version":"1774317332252"}
+{"version":"1774526372532"}

package/admin-build/index.html

@@ -5,12 +5,12 @@
         <meta name="viewport" content="width=device-width, initial-scale=1" />
         <title>EdgeBase Admin</title>
         <link rel="icon" href="/admin/favicon.svg" type="image/svg+xml" />
-        <link href="/admin/_app/immutable/entry/start.l1WvHznQ.js" rel="modulepreload">
-		<link href="/admin/_app/immutable/chunks/byv2rTy8.js" rel="modulepreload">
+        <link href="/admin/_app/immutable/entry/start.Cl6sLxnz.js" rel="modulepreload">
+		<link href="/admin/_app/immutable/chunks/CrOZMmdF.js" rel="modulepreload">
 		<link href="/admin/_app/immutable/chunks/BdTBlfLy.js" rel="modulepreload">
 		<link href="/admin/_app/immutable/chunks/Bn2NtlTj.js" rel="modulepreload">
-		<link href="/admin/_app/immutable/chunks/DiyBpamp.js" rel="modulepreload">
-		<link href="/admin/_app/immutable/entry/app.CfrmEXPD.js" rel="modulepreload">
+		<link href="/admin/_app/immutable/chunks/Cw6OYcq-.js" rel="modulepreload">
+		<link href="/admin/_app/immutable/entry/app.D3flihMw.js" rel="modulepreload">
 		<link href="/admin/_app/immutable/chunks/B2bEC_Hm.js" rel="modulepreload">
 		<link href="/admin/_app/immutable/chunks/Bb0e0sAP.js" rel="modulepreload">
 		<link href="/admin/_app/immutable/chunks/DtZk82gG.js" rel="modulepreload">
@@ -26,7 +26,7 @@
         <div style="display: contents">
 			<script>
 				{
-					__sveltekit_1thdx8y = {
+					__sveltekit_1k0lbsj = {
 						base: "/admin",
 						assets: "/admin"
 					};
@@ -34,8 +34,8 @@
 					const element = document.currentScript.parentElement;
 
 					Promise.all([
-						import("/admin/_app/immutable/entry/start.l1WvHznQ.js"),
-						import("/admin/_app/immutable/entry/app.CfrmEXPD.js")
+						import("/admin/_app/immutable/entry/start.Cl6sLxnz.js"),
+						import("/admin/_app/immutable/entry/app.D3flihMw.js")
 					]).then(([kit, app]) => {
 						kit.start(app, element);
 					});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edge-base/server",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "EdgeBase runtime assets consumed by the EdgeBase CLI",
   "license": "MIT",
   "repository": {
@@ -34,8 +34,8 @@
     "jose": "^6.0.0",
     "pg": "^8.16.3",
     "zod": "^4.3.6",
-    "@edge-base/core": "0.2.3",
-    "@edge-base/shared": "0.2.3"
+    "@edge-base/core": "0.2.5",
+    "@edge-base/shared": "0.2.5"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.8.71",

package/src/__tests__/admin-data-routes.test.ts

@@ -165,6 +165,35 @@ describe('admin data routes', () => {
     });
   });
 
+  it('rejects instanceId query params for single-instance record browsing', async () => {
+    setConfig(
+      createConfig({
+        shared: {
+          tables: {
+            posts: { schema: { title: { type: 'string' } } },
+          },
+        },
+      }),
+    );
+
+    const app = createApp();
+    const response = await app.request(
+      '/admin/api/data/tables/posts/records?instanceId=shadow',
+      {
+        headers: {
+          'X-EdgeBase-Service-Key': 'sk-root',
+        },
+      },
+      {} as Env,
+    );
+
+    expect(response.status).toBe(400);
+    await expect(response.json()).resolves.toMatchObject({
+      code: 400,
+      message: "instanceId is not allowed for single-instance namespace 'shared'",
+    });
+  });
+
   it('routes dynamic record browsing to the scoped DO when instanceId is provided', async () => {
     setConfig(
       createConfig({

package/src/__tests__/database-do-route-validation.test.ts

@@ -0,0 +1,108 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { defineConfig } from '@edge-base/shared';
+import { setConfig } from '../lib/do-router.js';
+
+vi.mock('cloudflare:workers', () => ({
+  DurableObject: class DurableObject {
+    ctx: unknown;
+    env: unknown;
+
+    constructor(ctx: unknown, env: unknown) {
+      this.ctx = ctx;
+      this.env = env;
+    }
+  },
+}));
+
+function createCtx() {
+  return {
+    storage: {
+      sql: {
+        exec: vi.fn(),
+      },
+    },
+    waitUntil: vi.fn(),
+  } as unknown as DurableObjectState;
+}
+
+function createEnv(config?: unknown) {
+  return {
+    DATABASE_LIVE: {} as DurableObjectNamespace,
+    DATABASE: {} as DurableObjectNamespace,
+    AUTH: {} as DurableObjectNamespace,
+    EDGEBASE_CONFIG: config,
+  };
+}
+
+describe('DatabaseDO route validation', () => {
+  afterEach(() => {
+    setConfig({});
+  });
+
+  it('rejects id-suffixed doNames for single-instance namespaces', async () => {
+    const config = defineConfig({
+      release: true,
+      databases: {
+        app: {
+          provider: 'do',
+          tables: {
+            posts: {},
+          },
+        },
+      },
+    });
+    setConfig(config);
+
+    const { DatabaseDO } = await import('../durable-objects/database-do.js');
+    const ctx = createCtx();
+    const databaseDo = new DatabaseDO(ctx, createEnv(config) as never);
+
+    const response = await databaseDo.fetch(new Request('http://do/tables/posts', {
+      headers: {
+        'X-DO-Name': 'app:shadow',
+      },
+    }));
+
+    expect(response.status).toBe(400);
+    await expect(response.json()).resolves.toMatchObject({
+      code: 400,
+      message: "instanceId is not allowed for single-instance namespace 'app'",
+      error: 'INVALID_DB_INSTANCE_ID',
+    });
+    expect((ctx.storage.sql.exec as unknown as ReturnType<typeof vi.fn>)).not.toHaveBeenCalled();
+  });
+
+  it('rejects missing instance ids for dynamic namespaces', async () => {
+    const config = defineConfig({
+      release: true,
+      databases: {
+        workspace: {
+          provider: 'do',
+          instance: true,
+          tables: {
+            users: {},
+          },
+        },
+      },
+    });
+    setConfig(config);
+
+    const { DatabaseDO } = await import('../durable-objects/database-do.js');
+    const ctx = createCtx();
+    const databaseDo = new DatabaseDO(ctx, createEnv(config) as never);
+
+    const response = await databaseDo.fetch(new Request('http://do/tables/users', {
+      headers: {
+        'X-DO-Name': 'workspace',
+      },
+    }));
+
+    expect(response.status).toBe(400);
+    await expect(response.json()).resolves.toMatchObject({
+      code: 400,
+      message: "instanceId is required for dynamic namespace 'workspace'",
+      error: 'INVALID_DB_INSTANCE_ID',
+    });
+    expect((ctx.storage.sql.exec as unknown as ReturnType<typeof vi.fn>)).not.toHaveBeenCalled();
+  });
+});

package/src/__tests__/database-live-route.test.ts

@@ -2,6 +2,7 @@ import { afterEach, describe, expect, it } from 'vitest';
 import { OpenAPIHono, type HonoEnv } from '../lib/hono.js';
 import { setConfig } from '../lib/do-router.js';
 import { databaseLiveRoute } from '../routes/database-live.js';
+import { defineConfig } from '@edge-base/shared';
 import type { Env } from '../types.js';
 
 interface MockKVStore {
@@ -52,6 +53,16 @@ describe('database live subscription route', () => {
   });
 
   it('reports connect-check readiness for explicit database params', async () => {
+    setConfig(defineConfig({
+      databases: {
+        shared: {
+          tables: {
+            posts: { schema: { title: { type: 'string' } } },
+          },
+        },
+      },
+    }));
+
     const kv = createMockKV();
     const app = createApp();
 
@@ -90,7 +101,78 @@ describe('database live subscription route', () => {
     });
   });
 
+  it('rejects structured targets that omit instanceId for dynamic namespaces', async () => {
+    setConfig(defineConfig({
+      databases: {
+        workspace: {
+          instance: true,
+          tables: {
+            posts: { schema: { title: { type: 'string' } } },
+          },
+        },
+      },
+    }));
+
+    const kv = createMockKV();
+    const app = createApp();
+
+    const response = await app.request('/api/db/connect-check?namespace=workspace&table=posts', {
+      method: 'GET',
+      headers: {
+        'CF-Connecting-IP': '127.0.0.1',
+      },
+    }, createMockEnv(kv));
+
+    expect(response.status).toBe(400);
+    await expect(response.json()).resolves.toMatchObject({
+      ok: false,
+      type: 'db_connect_invalid_request',
+      message: "instanceId is required for dynamic namespace 'workspace'",
+    });
+  });
+
+  it('rejects legacy channels that target dynamic namespaces without an instanceId', async () => {
+    setConfig(defineConfig({
+      databases: {
+        workspace: {
+          instance: true,
+          tables: {
+            posts: { schema: { title: { type: 'string' } } },
+          },
+        },
+      },
+    }));
+
+    const kv = createMockKV();
+    const app = createApp();
+
+    const response = await app.request('/api/db/connect-check?channel=dblive:workspace:posts', {
+      method: 'GET',
+      headers: {
+        'CF-Connecting-IP': '127.0.0.1',
+      },
+    }, createMockEnv(kv));
+
+    expect(response.status).toBe(400);
+    await expect(response.json()).resolves.toMatchObject({
+      ok: false,
+      type: 'db_connect_invalid_request',
+      message: "instanceId is required for dynamic namespace 'workspace'",
+    });
+  });
+
   it('proxies websocket subscribe requests through the database-owned path and releases pending slots', async () => {
+    setConfig(defineConfig({
+      databases: {
+        workspace: {
+          instance: true,
+          tables: {
+            posts: { schema: { title: { type: 'string' } } },
+          },
+        },
+      },
+    }));
+
     const kv = createMockKV();
     const app = createApp();
     let forwardedUrl = '';

package/src/__tests__/do-router.test.ts

@@ -18,8 +18,12 @@ import {
   parseConfig,
   getTablesInNamespace,
   findTableNamespace,
+  formatDbTargetValidationIssue,
   callDO,
   callDOByHexId,
+  isDynamicDbBlock,
+  normalizeDbInstanceId,
+  resolveDbTarget,
   shouldRouteToD1,
   getD1BindingName,
 } from '../lib/do-router.js';
@@ -634,6 +638,118 @@ describe('callDOByHexId', () => {
 
 // ─── J. shouldRouteToD1 ───────────────────────────────────────────────────────
 
+describe('isDynamicDbBlock', () => {
+  it('returns false for undefined db blocks', () => {
+    expect(isDynamicDbBlock()).toBe(false);
+  });
+
+  it('returns false for single-instance db blocks without create/access semantics', () => {
+    expect(isDynamicDbBlock({ tables: { posts: {} } } as any)).toBe(false);
+  });
+
+  it('returns true for db blocks with instance routing', () => {
+    expect(isDynamicDbBlock({ instance: true, tables: {} } as any)).toBe(true);
+  });
+
+  it('returns true for db blocks with canCreate rules', () => {
+    expect(isDynamicDbBlock({
+      access: {
+        canCreate: () => true,
+      },
+      tables: {},
+    } as any)).toBe(true);
+  });
+
+  it('returns true for db blocks with access rules', () => {
+    expect(isDynamicDbBlock({
+      access: {
+        access: () => true,
+      },
+      tables: {},
+    } as any)).toBe(true);
+  });
+});
+
+describe('normalizeDbInstanceId', () => {
+  it('preserves non-empty ids verbatim', () => {
+    expect(normalizeDbInstanceId('  ws-1  ')).toBe('  ws-1  ');
+  });
+
+  it('keeps blank string inputs distinguishable from missing ids', () => {
+    expect(normalizeDbInstanceId('   ')).toBe('   ');
+    expect(normalizeDbInstanceId(undefined)).toBeUndefined();
+    expect(normalizeDbInstanceId(null)).toBeUndefined();
+  });
+});
+
+describe('resolveDbTarget', () => {
+  const config = {
+    databases: {
+      shared: { tables: { posts: {} } },
+      workspace: { instance: true, tables: { members: {} } },
+    },
+  } as any;
+
+  it('resolves single-instance namespaces without instance ids', () => {
+    expect(resolveDbTarget(config, 'shared', undefined)).toEqual({
+      ok: true,
+      value: {
+        namespace: 'shared',
+        instanceId: undefined,
+        dbBlock: config.databases.shared,
+        dynamic: false,
+      },
+    });
+  });
+
+  it('rejects instance ids on single-instance namespaces', () => {
+    const result = resolveDbTarget(config, 'shared', 'shadow');
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.issue).toBe('instance_id_not_allowed');
+    expect(formatDbTargetValidationIssue(result.issue, 'shared')).toBe(
+      "instanceId is not allowed for single-instance namespace 'shared'",
+    );
+  });
+
+  it('requires instance ids on dynamic namespaces', () => {
+    const result = resolveDbTarget(config, 'workspace', undefined);
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.issue).toBe('instance_id_required');
+  });
+
+  it('rejects empty instance ids without rewriting non-empty ones', () => {
+    const empty = resolveDbTarget(config, 'workspace', '   ');
+    expect(empty.ok).toBe(false);
+    if (empty.ok) return;
+    expect(empty.issue).toBe('instance_id_empty');
+    expect(formatDbTargetValidationIssue(empty.issue, 'workspace')).toBe(
+      'instanceId must not be empty',
+    );
+
+    const preserved = resolveDbTarget(config, 'workspace', ' ws-1 ');
+    expect(preserved.ok).toBe(true);
+    if (!preserved.ok) return;
+    expect(preserved.value.instanceId).toBe(' ws-1 ');
+  });
+
+  it('rejects ids containing colons', () => {
+    const result = resolveDbTarget(config, 'workspace', 'ws:1');
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.issue).toBe('instance_id_invalid');
+  });
+
+  it('returns not-found when the namespace is missing', () => {
+    const result = resolveDbTarget(config, 'missing', undefined);
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.status).toBe(404);
+    expect(result.issue).toBe('namespace_not_found');
+  });
+});
+
 describe('shouldRouteToD1', () => {
   it('namespace not in config → false', () => {
     expect(shouldRouteToD1('unknown', {})).toBe(false);

package/src/__tests__/functions-context.test.ts

@@ -52,6 +52,48 @@ describe('buildFunctionContext admin.db', () => {
     );
   });
 
+  it('preserves significant whitespace in dynamic admin.db instance ids', async () => {
+    const databaseFetch = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({ items: [{ id: 'm1' }] }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    );
+    const databaseNamespace = {
+      idFromName: vi.fn(() => 'workspace-id'),
+      get: vi.fn(() => ({ fetch: databaseFetch })),
+    } as unknown as DurableObjectNamespace;
+
+    const ctx = buildFunctionContext({
+      request: new Request('http://localhost/api/functions/feed-summary'),
+      auth: null,
+      databaseNamespace,
+      authNamespace: {} as DurableObjectNamespace,
+      d1Database: {} as D1Database,
+      config: {
+        databases: {
+          workspace: {
+            instance: true,
+            tables: {
+              members: { schema: { role: { type: 'string' } } },
+            },
+          },
+        },
+      },
+    });
+
+    await ctx.admin.db('workspace', ' ws-1 ').table('members').getList();
+
+    expect(databaseNamespace.idFromName).toHaveBeenCalledWith('workspace: ws-1 ');
+    expect(databaseFetch.mock.calls[0]?.[1]).toEqual(
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          'X-DO-Name': 'workspace: ws-1 ',
+        }),
+      }),
+    );
+  });
+
   it('routes upsert calls through the worker with upsert query params', async () => {
     const fetchMock = vi.fn().mockResolvedValue(
       new Response(JSON.stringify({ id: 'p1', title: 'Upserted', action: 'inserted' }), {
@@ -155,6 +197,46 @@ describe('buildFunctionContext admin.db', () => {
     );
   });
 
+  it('rejects instance ids for single-instance admin.sqlProviderAware calls before touching direct backends', async () => {
+    const fetchMock = vi.fn();
+    vi.stubGlobal('fetch', fetchMock);
+
+    const databaseNamespace = {
+      idFromName: vi.fn(),
+      get: vi.fn(),
+    } as unknown as DurableObjectNamespace;
+
+    const ctx = buildFunctionContext({
+      request: new Request('http://localhost/api/functions/feed-summary'),
+      auth: null,
+      databaseNamespace,
+      authNamespace: {} as DurableObjectNamespace,
+      d1Database: {} as D1Database,
+      config: {
+        databases: {
+          shared: {
+            tables: {
+              posts: { schema: { title: { type: 'string' } } },
+            },
+          },
+        },
+      },
+      env: {
+        DB_D1_SHARED: {
+          prepare: vi.fn(),
+        },
+      } as never,
+    });
+
+    await expect(
+      ctx.admin.sqlProviderAware('shared', 'shadow', 'SELECT COUNT(*) AS total FROM posts'),
+    ).rejects.toThrow("instanceId is not allowed for single-instance namespace 'shared'");
+    expect(
+      (databaseNamespace as unknown as { get: ReturnType<typeof vi.fn> }).get,
+    ).not.toHaveBeenCalled();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
   it('routes admin.sqlWithDirectD1Access through the database DO when env is available', async () => {
     const fetchMock = vi.fn();
     vi.stubGlobal('fetch', fetchMock);
@@ -203,6 +285,7 @@ describe('buildFunctionContext admin.db', () => {
       config: {
         databases: {
           workspace: {
+            instance: true,
             tables: {
               members: { schema: { userId: { type: 'string' } } },
             },
@@ -331,6 +414,7 @@ describe('buildFunctionContext admin.db', () => {
       config: {
         databases: {
           workspace: {
+            instance: true,
             tables: {
               members: { schema: { userId: { type: 'string' } } },
             },

package/src/__tests__/functions-d1-proxy.test.ts

@@ -226,4 +226,58 @@ describe('buildFunctionContext admin.db D1 routing', () => {
     expect(workerFetch).not.toHaveBeenCalled();
     expect(databaseFetch).not.toHaveBeenCalled();
   });
+
+  it('rejects instance ids for single-instance namespaces before touching D1 handlers', async () => {
+    const handleD1Request = vi.fn();
+    vi.doMock('../lib/d1-handler.js', () => ({
+      handleD1Request,
+    }));
+
+    const workerFetch = vi.fn();
+    vi.stubGlobal('fetch', workerFetch);
+
+    const databaseFetch = vi.fn();
+    const { buildFunctionContext } = await import('../lib/functions.js');
+
+    const ctx = buildFunctionContext({
+      request: new Request('http://localhost/api/functions/save-room-signal'),
+      auth: null,
+      databaseNamespace: {
+        idFromName: vi.fn(() => 'shared-id'),
+        get: vi.fn(() => ({ fetch: databaseFetch })),
+      } as unknown as DurableObjectNamespace,
+      authNamespace: {
+        idFromName: vi.fn(() => 'auth-id'),
+        get: vi.fn(() => ({ fetch: vi.fn() })),
+      } as unknown as DurableObjectNamespace,
+      d1Database: {} as D1Database,
+      env: {
+        DATABASE: {} as DurableObjectNamespace,
+        AUTH: {} as DurableObjectNamespace,
+        AUTH_DB: {} as D1Database,
+        DB_D1_SHARED: {} as D1Database,
+      } as never,
+      executionCtx: { waitUntil: vi.fn() } as unknown as ExecutionContext,
+      config: {
+        databases: {
+          shared: {
+            tables: {
+              signals: {
+                schema: {
+                  title: { type: 'string', required: true },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    await expect(
+      ctx.admin.db('shared', 'shadow').table('signals').getList(),
+    ).rejects.toThrow("instanceId is not allowed for single-instance namespace 'shared'");
+    expect(handleD1Request).not.toHaveBeenCalled();
+    expect(workerFetch).not.toHaveBeenCalled();
+    expect(databaseFetch).not.toHaveBeenCalled();
+  });
 });