@feltdb/core 0.15.0 → 0.16.1

package/dist/create/server-source/Cargo.toml

@@ -1,18 +1,7 @@
 [workspace]
-members = ["crates/feltdb", "crates/feltdb-client", "crates/feltdb-server", "crates/feltdb-wasm"]
-# The deterministic contracts' WASM implementations are their own
-# dependency-free workspaces: they are only ever built for
-# wasm32-unknown-unknown, and a second implementation that inherited this
-# workspace's dependencies would stop being an independent one.
-exclude = [
-    "crates/feltdb-public-api-check",
-    "crates/feltdb-trigger-contract-wasm",
-    "crates/feltdb-state-diff-contract-wasm",
-    "crates/feltdb-state-conflict-contract-wasm",
-    "crates/feltdb-agent-transition-contract-wasm",
-]
+members = ["crates/feltdb-server", "crates/feltdb-wasm", "crates/feltdb-client"]
 resolver = "2"
 
 [workspace.package]
-version = "0.3.0"
+version = "0.4.2"
 edition = "2021"

package/dist/create/server-source/crates/feltdb-client/Cargo.toml

@@ -16,7 +16,7 @@ exclude = ["tests/", "target/"]
 # The wire types are the server's own: the request and response documents are defined once, in
 # `feltdb`, and both sides serialize the same structs. Exact, because the modules they come from are
 # not yet covered by `feltdb`'s compatibility policy; the workspace releases both at one version.
-feltdb = { version = "=0.3.0", path = "../feltdb" }
+feltdb = { version = "=0.4.2" }
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

package/dist/create/server-source/crates/feltdb-server/Cargo.toml

@@ -24,7 +24,7 @@ hmac = "0.12"
 # Exact: the server uses `unstable-internals`, which carries no semver promise, so a release of
 # this crate is built against the one `feltdb` release it was tested with. The workspace shares one
 # version, so this moves with every release (a mismatch fails to resolve, it cannot drift silently).
-feltdb = { version = "=0.3.0", path = "../feltdb", features = ["unstable-internals"] }
+feltdb = { version = "=0.4.2", features = ["unstable-internals"] }
 futures-core = "0.3"
 rand = "0.8"
 ring = "0.17"

package/dist/create/server-source/crates/feltdb-server/src/main.rs

@@ -1094,12 +1094,22 @@ async fn push_sync(
             });
             continue;
         }
-        let target_revision = state
+        // The production contract, never one the client names: with nothing promoted there is
+        // no contract to write under.
+        let Some(target_revision) = state
             .applications
             .pointers(&operation.application_id)
             .get("production")
             .cloned()
-            .unwrap_or_else(|| operation.application_revision.clone());
+        else {
+            rejections.push(SyncRejection {
+                operation_id: operation.operation_id,
+                code: "SYNC_SCHEMA_MISMATCH".into(),
+                message: "application environment has no active contract".into(),
+                retryable: false,
+            });
+            continue;
+        };
         let Some(revision) = state.applications.revision(
             &operation.tenant_id,
             &operation.application_id,
@@ -1228,6 +1238,24 @@ async fn push_sync(
             .acquire()
             .await
             .expect("transaction admission is never closed");
+        // A promotion between resolving the contract and taking the permit: refuse, write nothing.
+        if ensure_revision_current(
+            &state,
+            &operation.application_id,
+            "production",
+            &revision.revision_id,
+            true,
+        )
+        .is_err()
+        {
+            rejections.push(SyncRejection {
+                operation_id: operation.operation_id,
+                code: "SYNC_SCHEMA_MISMATCH".into(),
+                message: "the production contract changed; nothing was written".into(),
+                retryable: false,
+            });
+            continue;
+        }
         match execute_transaction(&state.db, &schema, &transaction, None) {
             Ok(committed) => {
                 let position = state
@@ -1490,6 +1518,16 @@ struct WorkloadControlRequest {
     reason: Option<String>,
 }
 #[derive(Deserialize)]
+struct WorkloadDecisionRequest {
+    /// A `workload:approve` grant whose subject is the authenticated caller.
+    grant: feltdb::authorization::SignedGrant,
+    /// The `input_hash` of the work the decider reviewed.
+    input_hash: String,
+    /// Required for a rejection; recorded with the decision.
+    #[serde(default)]
+    reason: Option<String>,
+}
+#[derive(Deserialize)]
 struct WorkerHeartbeatRequest {
     heartbeat: WorkerHeartbeat,
     grant: feltdb::authorization::SignedGrant,
@@ -1554,8 +1592,16 @@ fn workload_error(error: feltdb::workload::WorkloadError) -> ApiError {
         | "WORKLOAD_RETRY_EXHAUSTED"
         | "WORKLOAD_RESULT_CONFLICT"
         | "WORKLOAD_TIMED_OUT"
+        | "WORKLOAD_APPROVAL_PENDING"
+        | "WORKLOAD_REJECTED"
+        | "WORKLOAD_APPROVAL_DECIDED"
+        | "WORKLOAD_APPROVAL_STALE"
+        | "WORKLOAD_APPROVAL_NOT_ACTIONABLE"
+        | "WORKLOAD_APPROVAL_NOT_REQUIRED"
         | "WORKLOAD_CONFLICT" => StatusCode::CONFLICT,
-        "WORKLOAD_UNAUTHORIZED" | "WORKLOAD_CAPABILITY_DENIED" => StatusCode::FORBIDDEN,
+        "WORKLOAD_UNAUTHORIZED"
+        | "WORKLOAD_CAPABILITY_DENIED"
+        | "WORKLOAD_APPROVER_NOT_PERMITTED" => StatusCode::FORBIDDEN,
         "WORKLOAD_STORAGE_FAILURE" => StatusCode::SERVICE_UNAVAILABLE,
         _ => StatusCode::UNPROCESSABLE_ENTITY,
     };
@@ -2082,6 +2128,99 @@ async fn retry_workload(
         .map_err(workload_error)?;
     Ok(StatusCode::NO_CONTENT)
 }
+async fn approve_workload(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(id): Path<String>,
+    Json(input): Json<WorkloadDecisionRequest>,
+) -> Result<(HeaderMap, Json<Value>), ApiError> {
+    decide_workload(
+        &state,
+        &principal,
+        &id,
+        input,
+        feltdb::workload::ApprovalOutcome::Approved,
+    )
+}
+async fn reject_workload(
+    State(state): State<AppState>,
+    Extension(principal): Extension<Principal>,
+    Path(id): Path<String>,
+    Json(input): Json<WorkloadDecisionRequest>,
+) -> Result<(HeaderMap, Json<Value>), ApiError> {
+    decide_workload(
+        &state,
+        &principal,
+        &id,
+        input,
+        feltdb::workload::ApprovalOutcome::Rejected,
+    )
+}
+/// Commit an approval decision. The caller must be the Durable Work
+/// authority's client, authenticate as the grant's subject, and hold
+/// `workload:approve` for this workload; the store then applies the
+/// workload's approval policy (permitted kinds and approvers, never the
+/// requester) and binds the decision to the reviewed input.
+fn decide_workload(
+    state: &AppState,
+    principal: &Principal,
+    id: &str,
+    input: WorkloadDecisionRequest,
+    outcome: feltdb::workload::ApprovalOutcome,
+) -> Result<(HeaderMap, Json<Value>), ApiError> {
+    require_work_authority(state)?;
+    let workload = state
+        .workloads
+        .lock()
+        .map_err(|_| {
+            ApiError(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "workload store unavailable".into(),
+            )
+        })?
+        .fresh(id)
+        .map_err(workload_error)?
+        .clone();
+    let decider = grant_subject(principal);
+    workload_decision(
+        state,
+        decider.clone(),
+        &workload.tenant_id,
+        &workload.application_id,
+        format!("flow://{}/workloads/{id}", workload.application_id),
+        "workload:approve",
+        &input.grant,
+    )?;
+    let mut store = state.workloads.lock().map_err(|_| {
+        ApiError(
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "workload store unavailable".into(),
+        )
+    })?;
+    let (decision, replayed) = store
+        .decide(
+            id,
+            &decider,
+            outcome,
+            input.reason.as_deref(),
+            &input.grant.grant.id,
+            &input.input_hash,
+            unix_seconds_i64(),
+        )
+        .map_err(workload_error)?;
+    let state_now = store.get(id).map_err(workload_error)?.state;
+    let mut headers = HeaderMap::new();
+    if replayed {
+        headers.insert(
+            "idempotent-replay",
+            axum::http::HeaderValue::from_static("true"),
+        );
+    }
+    Ok((
+        headers,
+        Json(json!({"decision": decision, "state": state_now})),
+    ))
+}
 async fn workload_history(
     State(state): State<AppState>,
     Extension(principal): Extension<Principal>,
@@ -4610,6 +4749,7 @@ async fn promote_environment(
     Path((application_id, environment)): Path<(String, String)>,
     Json(input): Json<MoveEnvironmentRequest>,
 ) -> Result<Json<Value>, ApiError> {
+    let _drain = drain_state_commits(&state).await;
     Ok(Json(move_environment(
         &state,
         &principal,
@@ -4628,6 +4768,7 @@ async fn rollback_environment(
     Path((application_id, environment)): Path<(String, String)>,
     Json(input): Json<RollbackEnvironmentRequest>,
 ) -> Result<Json<Value>, ApiError> {
+    let _drain = drain_state_commits(&state).await;
     Ok(Json(move_environment(
         &state,
         &principal,
@@ -4646,6 +4787,7 @@ async fn promote_application_revision(
     Path((application_id, revision_id)): Path<(String, String)>,
     Json(input): Json<PromoteRevisionRequest>,
 ) -> Result<Json<Value>, ApiError> {
+    let _drain = drain_state_commits(&state).await;
     Ok(Json(move_environment(
         &state,
         &principal,
@@ -4752,6 +4894,97 @@ fn runtime_inventory(
         enforce_availability: true,
     })
 }
+/// The contract a state request runs under: the revision promoted to `environment`, and
+/// only that one.
+///
+/// A client names the revision it discovered. Any other revision (one a later promotion
+/// superseded, or one committed but never promoted) is refused with `REVISION_NOT_ACTIVE`,
+/// naming the active one, before anything is read or written. Accepting it would apply a
+/// contract that is not the environment's: fields a newer contract removed, policies it
+/// tightened, or a revision whose promotion was never approved. The client re-discovers and
+/// sends its next request under the active revision; nothing is retried under another contract.
+fn active_revision_contract(
+    state: &AppState,
+    actor: &str,
+    application_id: &str,
+    revision_id: &str,
+    environment: &str,
+) -> Result<ApplicationRuntimeContract, ApiError> {
+    application_scope(state, actor, application_id, "application:revision:read")?;
+    let active = state
+        .applications
+        .pointers(application_id)
+        .get(environment)
+        .cloned()
+        .ok_or(ApiError(
+            StatusCode::NOT_FOUND,
+            "application environment has no active contract".into(),
+        ))?;
+    if active != revision_id {
+        return Err(revision_not_active(revision_id, &active, environment));
+    }
+    revision_contract(state, actor, application_id, revision_id, environment)
+}
+/// A revision runtime runs in an environment that has a promoted contract only as that
+/// contract. An environment nothing is promoted to (a preview) runs any committed revision.
+fn runtime_revision_contract(
+    state: &AppState,
+    actor: &str,
+    application_id: &str,
+    revision_id: &str,
+    environment: &str,
+) -> Result<ApplicationRuntimeContract, ApiError> {
+    application_scope(state, actor, application_id, "application:revision:read")?;
+    if let Some(active) = state.applications.pointers(application_id).get(environment) {
+        if active != revision_id {
+            return Err(revision_not_active(revision_id, active, environment));
+        }
+    }
+    revision_contract(state, actor, application_id, revision_id, environment)
+}
+/// Commits that write application state each hold one of these permits.
+const STATE_TRANSACTION_PERMITS: u32 = 2;
+/// Hold every commit permit while an environment's contract pointer moves: the move waits for
+/// commits in flight, and no commit starts until it is done. With `ensure_revision_current`
+/// checked under a permit, a commit and a promotion are ordered: a commit never lands under a
+/// contract a promotion has already replaced.
+async fn drain_state_commits(state: &AppState) -> tokio::sync::SemaphorePermit<'_> {
+    state
+        .state_transaction_admission
+        .acquire_many(STATE_TRANSACTION_PERMITS)
+        .await
+        .expect("transaction admission is never closed")
+}
+/// Re-check, while holding a commit permit, that `revision_id` is still the environment's
+/// contract (`require_promoted`: an environment with nothing promoted refuses too).
+fn ensure_revision_current(
+    state: &AppState,
+    application_id: &str,
+    environment: &str,
+    revision_id: &str,
+    require_promoted: bool,
+) -> Result<(), ApiError> {
+    match state.applications.pointers(application_id).get(environment) {
+        Some(active) if active != revision_id => Err(revision_not_active(revision_id, active, environment)),
+        None if require_promoted => Err(ApiError(
+            StatusCode::NOT_FOUND,
+            "application environment has no active contract".into(),
+        )),
+        _ => Ok(()),
+    }
+}
+fn revision_not_active(requested: &str, active: &str, environment: &str) -> ApiError {
+    ApiError::structured(
+        StatusCode::CONFLICT,
+        json!({
+            "code": "REVISION_NOT_ACTIVE",
+            "message": format!("revision {requested} is not the contract active in {environment}; {active} is. Nothing was read or written. Whether to send the request again under the active revision is the caller's decision."),
+            "requested_revision_id": requested,
+            "active_revision_id": active,
+            "environment": environment,
+        }),
+    )
+}
 fn revision_contract(
     state: &AppState,
     actor: &str,
@@ -7299,7 +7532,7 @@ async fn run_revision_runtime(
         &application_id,
         "application:runtime:run",
     )?;
-    let contract = revision_contract(
+    let contract = runtime_revision_contract(
         &state,
         &principal.key_id,
         &application_id,
@@ -7364,7 +7597,7 @@ async fn run_runtime_action(
     Json(input): Json<Value>,
 ) -> Result<Json<Value>, ApiError> {
     application_scope(&state, &principal.key_id, &application_id, "state:write")?;
-    let contract = revision_contract(
+    let contract = runtime_revision_contract(
         &state,
         &principal.key_id,
         &application_id,
@@ -7463,6 +7696,7 @@ async fn run_runtime_action(
         .acquire()
         .await
         .expect("transaction admission is never closed");
+    ensure_revision_current(&state, &application_id, &environment.environment, &contract.revision_id, false)?;
     Ok(Json(json!(execute_transaction(
         &state.db,
         &contract.state.schema,
@@ -7494,7 +7728,7 @@ async fn run_runtime_query(
     Query(environment): Query<RuntimeEnvironmentRequest>,
 ) -> Result<Json<Value>, ApiError> {
     application_scope(&state, &principal.key_id, &application_id, "state:read")?;
-    let contract = revision_contract(
+    let contract = runtime_revision_contract(
         &state,
         &principal.key_id,
         &application_id,
@@ -7596,7 +7830,7 @@ async fn run_runtime_workflow(
     Json(input): Json<StartRun>,
 ) -> Result<(StatusCode, Json<Value>), ApiError> {
     application_scope(&state, &principal.key_id, &application_id, "workflows:run")?;
-    let contract = revision_contract(
+    let contract = runtime_revision_contract(
         &state,
         &principal.key_id,
         &application_id,
@@ -7853,7 +8087,7 @@ async fn get_state_version(
         &target.application_id,
         "state:read",
     )?;
-    let contract = revision_contract(
+    let contract = active_revision_contract(
         &state,
         &principal.key_id,
         &target.application_id,
@@ -7895,7 +8129,7 @@ async fn execute_canonical_query(
         "state:read",
     )?;
     require_bound_tenant(&headers, &tenant)?;
-    let contract = revision_contract(
+    let contract = active_revision_contract(
         &state,
         &principal.key_id,
         &input.application_id,
@@ -8204,7 +8438,7 @@ async fn capture_canonical_read_basis(
         "state:read",
     )?;
     require_bound_tenant(&headers, &tenant)?;
-    let contract = revision_contract(
+    let contract = active_revision_contract(
         &state,
         &principal.key_id,
         &input.application_id,
@@ -8235,7 +8469,7 @@ async fn execute_canonical_transaction(
         "state:write",
     )?;
     require_bound_tenant(&headers, &tenant)?;
-    let contract = revision_contract(
+    let contract = active_revision_contract(
         &state,
         &principal.key_id,
         &input.application_id,
@@ -8324,6 +8558,7 @@ async fn execute_canonical_transaction(
         .acquire()
         .await
         .expect("transaction admission is never closed");
+    ensure_revision_current(&state, &input.application_id, &input.environment, &contract.revision_id, true)?;
     let result = execute_transaction_with_collection_policies(
         &state.db,
         &contract.state.schema,
@@ -9057,7 +9292,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         peer_client,
         peer_token,
         lifecycle_lock: Arc::new(tokio::sync::Mutex::new(())),
-        state_transaction_admission: Arc::new(tokio::sync::Semaphore::new(2)),
+        state_transaction_admission: Arc::new(tokio::sync::Semaphore::new(STATE_TRANSACTION_PERMITS as usize)),
         worker_enabled: config.worker_enabled,
         work_authority: config.work_authority,
         work_authority_conflict: Arc::new(std::sync::atomic::AtomicBool::new(false)),
@@ -9535,6 +9770,14 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             "/v1/workloads/{id}/retry",
             axum::routing::post(retry_workload),
         )
+        .route(
+            "/v1/workloads/{id}/approve",
+            axum::routing::post(approve_workload),
+        )
+        .route(
+            "/v1/workloads/{id}/reject",
+            axum::routing::post(reject_workload),
+        )
         .route("/v1/workloads/{id}/history", get(workload_history))
         .route("/v1/workloads/{id}/result", get(workload_result))
         .route("/v1/workloads/{id}/eligible-workers", get(eligible_workers))
@@ -13813,7 +14056,7 @@ async fn search_collection(
     Path(collection): Path<String>,
     Json(request): Json<SearchRequest>,
 ) -> Result<Json<Vec<RecordResponse>>, ApiError> {
-    validate_segment(&collection)?;
+    validate_collection_name(&collection)?;
     authorize_capability_read(&state, &CapabilityAccess::Principal(&principal), &collection)?;
     if request.query.len() > 512 || request.limit == 0 || request.limit > 500 {
         return Err(ApiError(
@@ -15031,19 +15274,16 @@ async fn execute_bounded_query(
     let request: BoundedQueryRequest = serde_json::from_value(request)
         .map_err(|error| bounded_query_error("INVALID_QUERY", error.to_string()))?;
     let execution = bounded_query_execution(&headers)?;
-    validate_segment(&request.collection)?;
+    validate_collection_name(&request.collection)?;
     if request.limit == 0 || request.limit > MAX_BOUNDED_QUERY_LIMIT {
         return Err(bounded_query_error(
             "INVALID_QUERY",
             format!("limit must be between 1 and {MAX_BOUNDED_QUERY_LIMIT}"),
         ));
     }
-    if request.order_by.is_empty() {
-        return Err(bounded_query_error(
-            "INVALID_QUERY",
-            "orderBy must contain at least one field",
-        ));
-    }
+    // `orderBy` is optional, as on every embedded runtime: the record id is always the
+    // final tie-breaker below, so with no ordering field the order is record id
+    // (adrs/canonical-durable-state-api.md, Q1).
     for order in &request.order_by {
         if order.field.trim().is_empty() || !matches!(order.direction.as_str(), "asc" | "desc") {
             return Err(bounded_query_error(
@@ -15442,7 +15682,7 @@ async fn list_records(
             "system collection requires proposal service".into(),
         ));
     }
-    validate_segment(&collection)?;
+    validate_collection_name(&collection)?;
     let rows = state.db.list_collection(&collection)?;
     Ok(Json(rows.into_iter().map(record_response).collect()))
 }
@@ -15823,7 +16063,7 @@ async fn create_record(
             "system collection requires proposal service".into(),
         ));
     }
-    validate_segment(&collection)?;
+    validate_collection_name(&collection)?;
     let id = record
         .id
         .take()
@@ -17554,11 +17794,103 @@ async fn state_reconciliation_execute(
 }
 
 fn record_key(collection: &str, id: &str) -> Result<String, ApiError> {
-    validate_segment(collection)?;
-    validate_segment(id)?;
+    validate_collection_name(collection)?;
+    // An agent-state record's id is FeltDB's own (its transition contract defines it);
+    // every other record keeps the plain segment rule.
+    if is_agent_state_collection(collection) {
+        if !feltdb::agent_transition_contract::agent_state_record_id_ok(id) {
+            return Err(ApiError(
+                StatusCode::BAD_REQUEST,
+                "invalid collection or record identifier".to_string(),
+            ));
+        }
+    } else {
+        validate_segment(id)?;
+    }
     Ok(format!("{collection}:{id}"))
 }
 
+/// A collection name on the namespace data API: a plain segment, or one of FeltDB's own
+/// agent-state collections (`_feltdb.AgentTask`, `_feltdb.AgentCheckpoint`, …), which
+/// FeltDB's client writes for `openAgentState`. Exactly `_feltdb.Agent` followed by ASCII
+/// letters: no other reserved (`_feltdb.Composition…`) or dotted name is accepted, and
+/// record ids, namespaces, fields and workers keep `validate_segment`. Authorization and
+/// namespace isolation do not depend on the name.
+fn validate_collection_name(value: &str) -> Result<(), ApiError> {
+    if validate_segment(value).is_ok() || is_agent_state_collection(value) {
+        return Ok(());
+    }
+    Err(ApiError(
+        StatusCode::BAD_REQUEST,
+        "invalid collection or record identifier".to_string(),
+    ))
+}
+
+fn is_agent_state_collection(value: &str) -> bool {
+    value
+        .strip_prefix(feltdb::agent_transition_contract::AGENT_COLLECTION_PREFIX)
+        .is_some_and(|rest| {
+            !rest.is_empty()
+                && rest.len() <= 64
+                && rest.bytes().all(|byte| byte.is_ascii_alphabetic())
+        })
+}
+
+#[cfg(test)]
+mod collection_name_tests {
+    use super::{is_agent_state_collection, record_key, validate_collection_name};
+
+    #[test]
+    fn agent_state_collections_and_plain_names_only() {
+        for ok in [
+            "_feltdb.AgentTask",
+            "_feltdb.AgentCheckpoint",
+            "_feltdb.AgentHandoff",
+            "_feltdb.AgentMemory",
+            "_feltdb.AgentIntent",
+            "tasks",
+            "a-b_c",
+        ] {
+            assert!(validate_collection_name(ok).is_ok(), "{ok}");
+        }
+        for refused in [
+            "",
+            "_feltdb.Agent",
+            "_feltdb.CompositionContract",
+            "_feltdb.StateChange",
+            "_feltdb.AgentTask.x",
+            "_feltdb.Agent..x",
+            "_feltdb.Agent1",
+            "_FELTDB.AgentTask",
+            "a.b",
+            "../x",
+            "_feltdb.AgentTask/x",
+        ] {
+            assert!(validate_collection_name(refused).is_err(), "{refused}");
+        }
+        assert!(!is_agent_state_collection("_feltdb.Agent"));
+    }
+
+    #[test]
+    fn record_ids_follow_their_collection() {
+        assert_eq!(
+            record_key("_feltdb.AgentCheckpoint", "task-1.v2").unwrap(),
+            "_feltdb.AgentCheckpoint:task-1.v2"
+        );
+        assert!(record_key("_feltdb.AgentIntent", "task-1~key").is_ok());
+        for refused in ["a:b", "..", ".", ""] {
+            assert!(
+                record_key("_feltdb.AgentTask", refused).is_err(),
+                "{refused}"
+            );
+        }
+        assert!(record_key("_feltdb.AgentTask", &"x".repeat(258)).is_err());
+        for refused in ["a.b", "a~b", "a:b"] {
+            assert!(record_key("tasks", refused).is_err(), "plain {refused}");
+        }
+    }
+}
+
 fn validate_segment(value: &str) -> Result<(), ApiError> {
     if value.is_empty()
         || value.len() > 128

package/dist/create/server-source/crates/feltdb-server/tests/rust_client.rs

@@ -347,8 +347,17 @@ async fn the_bounded_query_pages_in_a_total_order() {
         .collect();
     assert_eq!(values, vec![json!(4), json!(2), json!(0)]);
 
+    // No ordering field: record-id order, as on the embedded runtimes.
+    let unordered = client.query(&BoundedQuery::new("items", 10)).await.unwrap();
+    let ids: Vec<_> = unordered
+        .records
+        .iter()
+        .map(|record| record["recordId"].clone())
+        .collect();
+    assert_eq!(ids, vec![json!("i-0"), json!("i-1"), json!("i-2"), json!("i-3"), json!("i-4")]);
+
     let invalid = client
-        .query(&BoundedQuery::new("items", 10))
+        .query(&BoundedQuery::new("items", 0))
         .await
         .unwrap_err();
     assert_eq!(invalid.code(), Some("INVALID_QUERY"));

package/dist/create/server-source/crates/feltdb-wasm/Cargo.toml

@@ -9,7 +9,7 @@ publish = false
 crate-type = ["cdylib"]
 
 [dependencies]
-feltdb = { path = "../feltdb", features = ["unstable-internals"] }
+feltdb = { version = "=0.4.2", features = ["unstable-internals"] }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
 serde = { version = "1", features = ["derive"] }

package/dist/db.d.ts

@@ -19,7 +19,7 @@ import { type RuntimeSnapshotHandle, type SnapshotDefinition } from './runtime-s
 import type { FlowSpec } from './flowspec.js';
 import { SyncController, type SyncConfig } from './sync-contract.js';
 import { type FeltDBDeploymentConfig, type FeltDBDeploymentMode, type FeltDBDeploymentResolution } from './deployment.js';
-import { WorkloadClient } from './workload.js';
+import { WorkloadClient, type DurableWorkSupport } from './workload.js';
 import { MeshClient, WorkerClient, WorkerPoolClient } from './worker.js';
 import { ArtifactClient } from './artifact.js';
 import { BundleClient } from './bundle.js';
@@ -95,6 +95,11 @@ export interface FeltDBRuntimeCapabilities {
     offline: boolean;
     /** `storeContent` / `acquireContent` are available. */
     content: boolean;
+    /**
+     * Durable Work (`db.workloads`): `supported` when this runtime talks to a feltdb-server, `requires-server` when it is embedded and
+     * every operation refuses with `CONTRACT_UNSUPPORTED` until a server is configured, `unsupported` when no server can provide it.
+     */
+    durableWork: DurableWorkSupport;
 }
 export interface FeltDBCapabilitySurface {
     (): FeltDBRuntimeCapabilities;
@@ -283,6 +288,11 @@ export declare class StateFirstDB {
     readonly authorityScope?: AuthorityScope;
     private tenantFactory?;
     private localActorSession?;
+    /**
+     * Durable Work. Server-backed runtimes talk to the authority with their own credentials; embedded runtimes (memory, file, browser) have
+     * no Durable Work engine, so each operation refuses with `CONTRACT_UNSUPPORTED` and a pointer to `feltdb-server`
+     * (see `capabilities().durableWork`).
+     */
     readonly workloads: WorkloadClient;
     readonly artifacts: ArtifactClient;
     readonly bundle: BundleClient;