@feltdb/core 0.9.0 → 0.10.0

package/dist/authority-scope.d.ts

@@ -5,6 +5,8 @@ export interface TenantAuthorityScope {
 }
 export interface PlatformAuthorityScope {
     kind: 'platform';
+    /** Tenants this platform session may explicitly select. Empty means none. */
+    tenantIds?: readonly string[];
 }
 export type AuthorityScope = TenantAuthorityScope | PlatformAuthorityScope;
 export declare function normalizeAuthorityScope(scope: AuthorityScope | undefined): AuthorityScope;

package/dist/authority-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authority-scope.d.ts","sourceRoot":"","sources":["../src/authority-scope.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG,sBAAsB,CAAC;AAE3E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,GAAG,cAAc,CAyBzF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAK/D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAGvF;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI,CAI3F"}
+{"version":3,"file":"authority-scope.d.ts","sourceRoot":"","sources":["../src/authority-scope.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,UAAU,CAAC;IACjB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG,sBAAsB,CAAC;AAE3E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,GAAG,cAAc,CA+BzF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAK/D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAGvF;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI,CAI3F"}

package/dist/authority-scope.js

@@ -3,8 +3,13 @@ export function normalizeAuthorityScope(scope) {
     if (!scope) {
         throw new FeltDBServiceError('An explicit tenant or platform authority scope is required', FeltDBErrorCode.AUTHORITY_SCOPE_REQUIRED);
     }
-    if (scope.kind === 'platform')
-        return { kind: 'platform' };
+    if (scope.kind === 'platform') {
+        const tenantIds = [...new Set((scope.tenantIds ?? []).map(value => value.trim()))];
+        if (tenantIds.some(value => !value)) {
+            throw new FeltDBServiceError('Platform tenantIds must be non-empty strings', FeltDBErrorCode.AUTHORITY_SCOPE_INVALID);
+        }
+        return { kind: 'platform', tenantIds };
+    }
     if (scope.kind !== 'tenant' || typeof scope.tenantId !== 'string' || !scope.tenantId.trim()) {
         throw new FeltDBServiceError('Tenant authority requires a non-empty tenantId', FeltDBErrorCode.AUTHORITY_SCOPE_REQUIRED);
     }

package/dist/cli/commands.js

@@ -5,7 +5,7 @@ import fs from 'fs';
 import path from 'path';
 import http from 'http';
 import net from 'net';
-import { createRequire } from 'module';
+import { createRequire } from 'node:module';
 import { spawn, spawnSync } from 'child_process';
 import { randomBytes } from 'crypto';
 import { createInterface } from 'node:readline/promises';
@@ -15,7 +15,7 @@ import { collectRepositoryEvidence } from './repository-evidence.js';
 import { discoverWorkspace, ensureWorkspaceGitIgnored, generatePairingToken, persistPairingToken, displayWorkspaceStatus, initializeWorkspace, startPairingDiscoveryServer } from './workspace-integration.js';
 import { applicationUrlCandidate, detectApplication, discoverApplicationUrl } from './application.js';
 import { resolveApplicationLifecycle, startManagedApplication, waitForManagedApplication } from './application-lifecycle.js';
-import { createDevelopmentSession, developmentSessionEnvironment, developmentSessionSummary, transitionDevelopmentSession } from './development-session.js';
+import { createDevelopmentSession, developmentSessionEnvironment, developmentSessionSummary, developmentStudioArguments, transitionDevelopmentSession } from './development-session.js';
 import { openApplication, openStudio } from './browser-opening.js';
 import { publishApplication } from './publish-engine.js';
 import { applyFlowProposalAtomic, assertProposalSourcePlan, describeProposal, loadLocalDevelopmentContract, repositoryContext, reviewFlowProposal, syncGeneratedSource } from './source-sync.js';
@@ -23,6 +23,7 @@ import { configureAiModel, generateConfiguredFlowProposal, publicAiModelConfigur
 import { proposalService } from './proposal-client.js';
 import { resolveManagedAuthorityEnvironment } from './managed-environment.js';
 import { readManagedProjectState } from './managed-project.js';
+import { resolveCanonicalStudioArtifact } from './studio-artifact.js';
 function loadProjectEnvironment(file = path.resolve('.env.local')) {
     if (!fs.existsSync(file))
         return;
@@ -1127,6 +1128,14 @@ async function handleDev(args) {
             port: authorityPort,
             proposalContext: () => loadLocalDevelopmentContract(projectDir),
             intentObservations: () => collectRepositoryEvidence(projectDir),
+            runtimeContext: {
+                namespace: runtimeNamespace || config.namespace,
+                runtime: config.runtime,
+                storage: config.storage,
+                distributed: Boolean(config.distributed),
+                applicationLifecycle,
+                applicationUrl: appUrl,
+            },
         });
         process.env.VITE_FELTDB_URL = localAuthority.endpoint;
         const connectionsPath = path.join(projectDir, '.feltdb', 'connections.json');
@@ -1277,20 +1286,7 @@ async function handleDev(args) {
     }
     const open = !args.includes('--no-open');
     try {
-        const studio = handleStudio([
-            '--port', studioPort,
-            '--namespace', developmentSession.namespace,
-            '--runtime', developmentSession.runtime,
-            '--workspace-id', developmentSession.workspaceId,
-            '--session-id', developmentSession.sessionId,
-            '--project-id', developmentSession.projectId,
-            '--authority-url', developmentSession.authorityUrl,
-            '--pairing-url', developmentSession.pairingUrl,
-            '--lifecycle', developmentSession.lifecycle,
-            ...(developmentSession.applicationUrl ? ['--app-url', developmentSession.applicationUrl] : []),
-            ...((developmentSession.runtime === 'self-hosted' || developmentSession.runtime === 'managed') ? ['--connect', developmentSession.authorityUrl] : []),
-            '--no-open',
-        ], studioUrl => {
+        const studio = handleStudio(developmentStudioArguments(developmentSession, studioPort), studioUrl => {
             developmentSession.studioUrl = studioUrl;
             transitionDevelopmentSession(developmentSession, 'READY');
             console.log(`\n${developmentSessionSummary(developmentSession)}\n`);
@@ -1640,13 +1636,15 @@ async function handleStudio(args, onReady) {
     else {
         console.log(`Studio Server: http://localhost:${port}\n`);
     }
-    const require = createRequire(import.meta.url);
-    const packageFile = require.resolve('@feltdb/core/package.json');
-    const root = path.join(path.dirname(packageFile), 'dist', 'studio-app');
-    if (!fs.existsSync(path.join(root, 'index.html'))) {
-        console.log('⚠️  Studio application artifacts not found.');
+    let studioArtifact;
+    try {
+        studioArtifact = resolveCanonicalStudioArtifact();
+    }
+    catch (error) {
+        console.log(`⚠️  ${error instanceof Error ? error.message : String(error)}`);
         return;
     }
+    const root = studioArtifact.root;
     const canonicalFlow = path.resolve(process.cwd(), 'feltdb.flow');
     const projectFlow = fs.existsSync(canonicalFlow) ? canonicalFlow : undefined;
     const studioMutationToken = randomBytes(24).toString('hex');

package/dist/cli/development-session.js

@@ -41,6 +41,22 @@ export function developmentSessionEnvironment(session) {
         VITE_FELTDB_NAMESPACE: session.namespace,
     };
 }
+export function developmentStudioArguments(session, port) {
+    return [
+        '--port', port,
+        '--namespace', session.namespace,
+        '--runtime', session.runtime,
+        '--workspace-id', session.workspaceId,
+        '--session-id', session.sessionId,
+        '--project-id', session.projectId,
+        '--authority-url', session.authorityUrl,
+        '--pairing-url', session.pairingUrl,
+        '--lifecycle', session.lifecycle,
+        ...(session.applicationUrl ? ['--app-url', session.applicationUrl] : []),
+        '--connect', session.authorityUrl,
+        '--no-open',
+    ];
+}
 export function developmentSessionSummary(session) {
     const rows = [
         ['Session', session.sessionId], ['Workspace', session.workspaceId], ['Project', session.projectId], ['Namespace', session.namespace],

package/dist/cli/studio-artifact.js

@@ -0,0 +1,33 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+export const CANONICAL_STUDIO_ARTIFACT_CONTRACT = 'feltdb.studio.app.v1';
+// Kept non-contiguous so Core assembly's package-import rewrite cannot mutate
+// this artifact identity from its source package into an import subpath.
+export const CANONICAL_STUDIO_ARTIFACT_SOURCE = '@feltdb/' + 'studio';
+/** Resolve the one Studio application shipped by the installed Core package. */
+export function resolveCanonicalStudioArtifact(options = {}) {
+    const require = createRequire(import.meta.url);
+    const resolvePackage = options.resolvePackage || (specifier => require.resolve(specifier));
+    const packageFile = resolvePackage('@feltdb/core/package.json');
+    const root = path.join(path.dirname(packageFile), 'dist', 'studio-app');
+    const index = path.join(root, 'index.html');
+    const identityFile = path.join(root, 'feltdb-studio.json');
+    if (!fs.existsSync(index) || !fs.existsSync(identityFile)) {
+        throw new Error(`The installed @feltdb/core package does not contain the canonical FeltDB Studio artifact (${root})`);
+    }
+    let identity;
+    try {
+        identity = JSON.parse(fs.readFileSync(identityFile, 'utf8'));
+    }
+    catch (error) {
+        throw new Error(`The canonical FeltDB Studio artifact identity is unreadable (${identityFile}): ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (identity.contract !== CANONICAL_STUDIO_ARTIFACT_CONTRACT
+        || identity.source !== CANONICAL_STUDIO_ARTIFACT_SOURCE
+        || typeof identity.version !== 'string' || !identity.version
+        || identity.entrypoint !== 'src/main.tsx') {
+        throw new Error(`The installed Studio artifact is not the canonical @feltdb/core/studio application (${identityFile})`);
+    }
+    return { root, index, identity };
+}

package/dist/create/package-versions.js

@@ -1,4 +1,4 @@
 // One release train keeps generated applications installable. The repository
 // validation script checks these values against every workspace manifest.
-export const FELTDB_PACKAGE_VERSION = '0.9.0';
+export const FELTDB_PACKAGE_VERSION = '0.10.0';
 export const feltdbPackageRange = `^${FELTDB_PACKAGE_VERSION}`;

package/dist/create/server-source/crates/feltdb/src/acceptance_tests.rs

@@ -1460,9 +1460,12 @@ mod convergence_acceptance_tests {
     use crate::FeltDb;
     use serde::{Deserialize, Serialize};
     use std::path::PathBuf;
+    use std::sync::atomic::{AtomicU64, Ordering};
     use std::time::SystemTime;
     use std::time::UNIX_EPOCH;
 
+    static TEMP_FILE_SEQUENCE: AtomicU64 = AtomicU64::new(0);
+
     #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
     struct Task {
         title: String,
@@ -1475,7 +1478,11 @@ mod convergence_acceptance_tests {
             .duration_since(UNIX_EPOCH)
             .expect("time")
             .as_nanos();
-        std::env::temp_dir().join(format!("feltdb-convergence-test-{nanos}.data"))
+        let sequence = TEMP_FILE_SEQUENCE.fetch_add(1, Ordering::Relaxed);
+        std::env::temp_dir().join(format!(
+            "feltdb-convergence-test-{}-{nanos}-{sequence}.data",
+            std::process::id()
+        ))
     }
 
     /// Test convergence: Two instances make concurrent mutations on same key

package/dist/create/server-source/crates/feltdb/src/application.rs

@@ -1203,6 +1203,22 @@ impl ApplicationStore {
             records: Arc::new(RwLock::new(records)),
         })
     }
+
+    /// Return every tenant scope asserted by canonical application definition
+    /// records for one stable application identity. Callers must reject zero
+    /// or multiple distinct tenants; ordering is never ownership evidence.
+    pub fn tenant_ownership_candidates(&self, application_id: &str) -> Vec<String> {
+        let Ok(records) = self.records.read() else {
+            return Vec::new();
+        };
+        records
+            .revisions
+            .iter()
+            .map(|value| (&value.application_id, &value.tenant_id))
+            .filter(|(candidate, _)| candidate.as_str() == application_id)
+            .map(|(_, tenant)| tenant.clone())
+            .collect()
+    }
     fn persist(&self, r: &RevisionRecords) -> Result<(), String> {
         if let Some(parent) = self.path.parent() {
             fs::create_dir_all(parent).map_err(|e| e.to_string())?;

package/dist/create/server-source/crates/feltdb/src/bin/feltdb_node.rs

@@ -744,11 +744,12 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
                                 link.peer.clone(),
                                 envelope.envelope_id.sequence,
                             );
-                            if link.io.send(message.clone()).await.is_ok() {
-                                delivered.push(link.peer.clone());
-                            } else if connect_with_retry(link, 3).await
-                                && link.io.send(message).await.is_ok()
-                            {
+                            // Forwarding, like re-sending, is an explicit
+                            // recovery operation. Prefer a fresh connection so
+                            // a peer restart cannot leave this write accepted
+                            // by a stale local socket and delivered nowhere.
+                            let _ = connect_with_retry(link, 3).await;
+                            if link.io.send(message).await.is_ok() {
                                 delivered.push(link.peer.clone());
                             }
                         }
@@ -793,19 +794,16 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
                                 link.peer.clone(),
                                 envelope.envelope_id.sequence,
                             );
-                            // The peer this is aimed at may have restarted
-                            // since the link was established, which is the
-                            // whole point of re-sending. Reconnect and retry,
-                            // as `execute-tx` does.
-                            match link.io.send(message.clone()).await {
-                                Ok(()) => delivered.push(link.peer.clone()),
-                                Err(_) => {
-                                    if connect_with_retry(link, 3).await
-                                        && link.io.send(message).await.is_ok()
-                                    {
-                                        delivered.push(link.peer.clone());
-                                    }
-                                }
+                            // Re-sending is the recovery primitive used after a
+                            // peer restart. A write to the old TCP socket can
+                            // still return success after the peer has exited,
+                            // because that only confirms acceptance by the
+                            // local kernel. Try to establish a fresh connection
+                            // first. If the peer never restarted, the connect
+                            // attempt leaves the established stream untouched.
+                            let _ = connect_with_retry(link, 3).await;
+                            if link.io.send(message).await.is_ok() {
+                                delivered.push(link.peer.clone());
                             }
                         }
                         println!(
@@ -961,12 +959,13 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
                 let mut delivered = Vec::new();
                 for link in &send_links {
+                    // Acknowledgements are durable recovery evidence and are
+                    // commonly rebroadcast after a peer restart. Refresh the
+                    // connection first for the same reason as explicit
+                    // envelope replay.
+                    let _ = connect_with_retry(link, 3).await;
                     if link.io.send_acknowledgement(ack.clone()).await.is_ok() {
                         delivered.push(link.peer.clone());
-                    } else if connect_with_retry(link, 3).await
-                        && link.io.send_acknowledgement(ack.clone()).await.is_ok()
-                    {
-                        delivered.push(link.peer.clone());
                     }
                 }
                 println!(