@feltdb/core 0.9.1 → 0.10.0

package/dist/create/server-source/crates/feltdb/tests/storage_independent_versioned_object_substrate.rs

@@ -0,0 +1,328 @@
+use feltdb::{
+    ConflictClass, DurableObjectStore, LocalObjectStore, MaterializationProjection, PathComponent,
+    Reachability, S3CompatibleBucket, S3CompatibleObjectStore, StateId, StateTopology,
+    SubstrateError, VersionedObjectSubstrate,
+};
+use serde_json::json;
+use std::sync::{Arc, Barrier};
+use std::thread;
+use tempfile::TempDir;
+
+#[derive(Debug, PartialEq, Eq)]
+struct Snapshot {
+    revisions: Vec<(String, Option<String>, String)>,
+    refs: Vec<(String, String, String, u64)>,
+    relationship: String,
+    has_common_ancestor: bool,
+    diff_len: usize,
+    conflict: ConflictClass,
+    materialized: String,
+    reachability_revisions: Vec<String>,
+    reachability_objects: Vec<String>,
+}
+
+fn workload<S: DurableObjectStore>(substrate: &VersionedObjectSubstrate<S>) -> Snapshot {
+    let a = substrate
+        .create_revision("graph:item", json!({"n":"A"}).to_string(), None, "auth".into())
+        .unwrap();
+    let b = substrate
+        .create_revision(
+            "graph:item",
+            json!({"n":"B"}).to_string(),
+            Some(a.id.clone()),
+            "auth".into(),
+        )
+        .unwrap();
+    let c = substrate
+        .create_revision(
+            "graph:item",
+            json!({"n":"C","shared":true}).to_string(),
+            Some(b.id.clone()),
+            "auth".into(),
+        )
+        .unwrap();
+    let d = substrate
+        .create_revision(
+            "graph:item",
+            json!({"n":"D","shared":true}).to_string(),
+            Some(b.id.clone()),
+            "auth".into(),
+        )
+        .unwrap();
+
+    substrate
+        .create_ref("heads", "main", c.id.clone(), "auth".into())
+        .unwrap();
+    substrate
+        .create_ref("heads", "feature", d.id.clone(), "auth".into())
+        .unwrap();
+
+    let revisions = substrate.list_revisions().unwrap();
+    let mut topology = StateTopology::new();
+    for revision in &revisions {
+        topology.add_revision(revision.clone());
+    }
+
+    let conflict = substrate
+        .conflict_classification(&b.id, &c.id, &d.id)
+        .unwrap()
+        .overall;
+    let reconciled = substrate.reconcile(&b.id, &c.id, &d.id, "reconciler").unwrap();
+    let materialized = substrate
+        .materialize(
+            &reconciled.id,
+            &MaterializationProjection::select(vec![vec![PathComponent::Key("n".into())]]),
+        )
+        .unwrap()
+        .to_string();
+
+    let reachability = substrate.reachability().unwrap();
+
+    let mut revisions_snapshot = substrate
+        .list_revisions()
+        .unwrap()
+        .into_iter()
+        .map(|r| {
+            (
+                r.id.as_hex().to_string(),
+                r.parent_id.map(|p| p.as_hex().to_string()),
+                r.content_id.as_hex().to_string(),
+            )
+        })
+        .collect::<Vec<_>>();
+    revisions_snapshot.sort();
+
+    let refs_snapshot = substrate
+        .list_refs(None)
+        .unwrap()
+        .into_iter()
+        .map(|r| {
+            (
+                r.namespace,
+                r.name,
+                r.target.as_hex().to_string(),
+                r.version,
+            )
+        })
+        .collect::<Vec<_>>();
+
+    let relationship = format!("{:?}", topology.relationship(&c.id, &d.id));
+    let has_common_ancestor = topology.common_ancestor(&c.id, &d.id).is_some();
+    let diff_len = feltdb::SemanticDiff::compute(
+        &serde_json::from_str::<serde_json::Value>(&c.content).unwrap(),
+        &serde_json::from_str::<serde_json::Value>(&d.content).unwrap(),
+    )
+    .changes
+    .len();
+
+    Snapshot {
+        revisions: revisions_snapshot,
+        refs: refs_snapshot,
+        relationship,
+        has_common_ancestor,
+        diff_len,
+        conflict,
+        materialized,
+        reachability_revisions: reachability
+            .revisions
+            .iter()
+            .map(|id| id.as_hex().to_string())
+            .collect(),
+        reachability_objects: reachability
+            .objects
+            .iter()
+            .map(|id| id.as_hex().to_string())
+            .collect(),
+    }
+}
+
+#[test]
+fn local_and_s3_compatible_backends_produce_identical_version_semantics() {
+    let local_dir = TempDir::new().unwrap();
+    let local = VersionedObjectSubstrate::new(LocalObjectStore::new(local_dir.path()).unwrap());
+
+    let bucket = S3CompatibleBucket::default();
+    let s3 = VersionedObjectSubstrate::new(S3CompatibleObjectStore::new(bucket));
+
+    let local_snapshot = workload(&local);
+    let s3_snapshot = workload(&s3);
+    assert_eq!(local_snapshot, s3_snapshot);
+}
+
+#[test]
+fn durable_survives_cache_loss_but_cache_never_becomes_authority() {
+    let local_dir = TempDir::new().unwrap();
+    let backend = LocalObjectStore::new(local_dir.path()).unwrap();
+
+    let service = VersionedObjectSubstrate::new(backend.clone());
+    let a = service
+        .create_revision("docs:1", json!({"v":1}).to_string(), None, "auth".into())
+        .unwrap();
+    let b = service
+        .create_revision(
+            "docs:1",
+            json!({"v":2}).to_string(),
+            Some(a.id.clone()),
+            "auth".into(),
+        )
+        .unwrap();
+    service
+        .create_ref("heads", "main", b.id.clone(), "auth".into())
+        .unwrap();
+
+    let restart = VersionedObjectSubstrate::new(backend.clone());
+    let restored = restart.get_revision(&b.id).unwrap();
+    assert_eq!(restored.id, b.id);
+
+    // Populate cache then remove durable object; reads must fail closed.
+    let _ = restart.get_object(&b.content_id).unwrap();
+    backend.delete(&format!("object:{}", b.content_id.as_hex())).unwrap();
+    let failed = restart.get_revision(&b.id);
+    assert!(matches!(failed, Err(SubstrateError::NotFound(_))));
+}
+
+#[test]
+fn shared_history_gc_parity_across_backends_and_restart() {
+    fn scenario<S: DurableObjectStore>(backend: S) -> (Reachability, Reachability) {
+        let substrate = VersionedObjectSubstrate::new(backend.clone());
+        let a = substrate
+            .create_revision("graph:item", json!({"n":"A"}).to_string(), None, "auth".into())
+            .unwrap();
+        let b = substrate
+            .create_revision(
+                "graph:item",
+                json!({"n":"B"}).to_string(),
+                Some(a.id.clone()),
+                "auth".into(),
+            )
+            .unwrap();
+        let c = substrate
+            .create_revision(
+                "graph:item",
+                json!({"n":"C"}).to_string(),
+                Some(b.id.clone()),
+                "auth".into(),
+            )
+            .unwrap();
+        let d = substrate
+            .create_revision(
+                "graph:item",
+                json!({"n":"D"}).to_string(),
+                Some(b.id.clone()),
+                "auth".into(),
+            )
+            .unwrap();
+        substrate
+            .create_ref("heads", "main", c.id.clone(), "auth".into())
+            .unwrap();
+        substrate
+            .create_ref("heads", "feature", d.id.clone(), "auth".into())
+            .unwrap();
+
+        substrate.delete_ref("heads", "feature", Some(1)).unwrap();
+        let after_gc = substrate.collect_unreachable().unwrap();
+        assert!(after_gc.revisions.iter().any(|id| id == &b.id));
+        assert!(after_gc.revisions.iter().any(|id| id == &c.id));
+        assert!(!after_gc.revisions.iter().any(|id| id == &d.id));
+
+        let restarted = VersionedObjectSubstrate::new(backend);
+        let after_restart = restarted.reachability().unwrap();
+        (after_gc, after_restart)
+    }
+
+    let local_dir = TempDir::new().unwrap();
+    let (local_gc, local_restart) = scenario(LocalObjectStore::new(local_dir.path()).unwrap());
+    assert_eq!(local_gc, local_restart);
+
+    let bucket = S3CompatibleBucket::default();
+    let (s3_gc, s3_restart) = scenario(S3CompatibleObjectStore::new(bucket));
+    assert_eq!(s3_gc, s3_restart);
+    assert_eq!(local_gc, s3_gc);
+}
+
+#[test]
+fn concurrent_ref_cas_allows_only_one_winner_across_backends() {
+    fn run<S: DurableObjectStore>(backend: S) {
+        let substrate = Arc::new(VersionedObjectSubstrate::new(backend));
+        let a = substrate
+            .create_revision("docs:1", json!({"v":1}).to_string(), None, "auth".into())
+            .unwrap();
+        let b = substrate
+            .create_revision(
+                "docs:1",
+                json!({"v":2}).to_string(),
+                Some(a.id.clone()),
+                "auth".into(),
+            )
+            .unwrap();
+        let c = substrate
+            .create_revision(
+                "docs:1",
+                json!({"v":3}).to_string(),
+                Some(b.id.clone()),
+                "auth".into(),
+            )
+            .unwrap();
+        substrate
+            .create_ref("heads", "main", b.id.clone(), "auth".into())
+            .unwrap();
+
+        let barrier = Arc::new(Barrier::new(2));
+        let left = {
+            let substrate = Arc::clone(&substrate);
+            let barrier = Arc::clone(&barrier);
+            let c = c.id.clone();
+            thread::spawn(move || {
+                barrier.wait();
+                substrate.cas_move_ref("heads", "main", 1, c, "left".into())
+            })
+        };
+        let right = {
+            let substrate = Arc::clone(&substrate);
+            let barrier = Arc::clone(&barrier);
+            let a = a.id.clone();
+            thread::spawn(move || {
+                barrier.wait();
+                substrate.cas_move_ref("heads", "main", 1, a, "right".into())
+            })
+        };
+
+        let one = left.join().unwrap();
+        let two = right.join().unwrap();
+        let wins = usize::from(one.is_ok()) + usize::from(two.is_ok());
+        assert_eq!(wins, 1);
+    }
+
+    let local_dir = TempDir::new().unwrap();
+    run(LocalObjectStore::new(local_dir.path()).unwrap());
+    run(S3CompatibleObjectStore::new(S3CompatibleBucket::default()));
+}
+
+#[test]
+fn duplicate_object_writes_and_restart_are_stable() {
+    fn run<S: DurableObjectStore>(backend: S) {
+        let substrate = VersionedObjectSubstrate::new(backend.clone());
+        let one = substrate.store_object(r#"{"same":true}"#).unwrap();
+        let two = substrate.store_object(r#"{"same":true}"#).unwrap();
+        assert_eq!(one, two);
+
+        let restarted = VersionedObjectSubstrate::new(backend);
+        let value = restarted.get_object(&one).unwrap();
+        assert_eq!(value, r#"{"same":true}"#);
+    }
+
+    let local_dir = TempDir::new().unwrap();
+    run(LocalObjectStore::new(local_dir.path()).unwrap());
+    run(S3CompatibleObjectStore::new(S3CompatibleBucket::default()));
+}
+
+#[test]
+fn ref_is_not_published_when_target_is_not_durable() {
+    let local_dir = TempDir::new().unwrap();
+    let backend = LocalObjectStore::new(local_dir.path()).unwrap();
+    let substrate = VersionedObjectSubstrate::new(backend.clone());
+
+    let fake = StateId::from_hex("a".repeat(64));
+    let create = substrate.create_ref("heads", "broken", fake, "auth".into());
+    assert!(matches!(create, Err(SubstrateError::NotFound(_))));
+}

package/dist/create/server-source/crates/feltdb/tests/workload_envelope_contract.rs

@@ -339,9 +339,26 @@ fn a_transaction_commits_under_a_barrier_regardless_of_the_mode() {
 fn the_retention_envelope_has_the_measured_shape() {
     let directory = TempDir::new().unwrap();
 
-    let unbounded = run(directory.path(), WORKLOADS[0], DurabilityMode::Flushed);
-    let keep5 = run(directory.path(), WORKLOADS[1], DurabilityMode::Flushed);
-    let keep50 = run(directory.path(), WORKLOADS[2], DurabilityMode::Flushed);
+    // This binary runs its envelope cases concurrently. Use the best of three
+    // complete, isolated samples so scheduler and filesystem contention cannot
+    // invert a wall-clock ordering while retaining the frozen workload shape.
+    let sample = |workload: Workload| {
+        (0..3)
+            .map(|index| {
+                let sample_directory = directory.path().join(format!(
+                    "retention-{}-{index}",
+                    workload.name
+                ));
+                std::fs::create_dir_all(&sample_directory).unwrap();
+                run(&sample_directory, workload, DurabilityMode::Flushed)
+            })
+            .min_by_key(|measurement| measurement.elapsed)
+            .unwrap()
+    };
+
+    let unbounded = sample(WORKLOADS[0]);
+    let keep5 = sample(WORKLOADS[1]);
+    let keep50 = sample(WORKLOADS[2]);
 
     assert_eq!(unbounded.revisions, 301, "unbounded keeps everything");
     assert_eq!(keep5.revisions, 5);

package/dist/create/server-source/crates/feltdb-server/src/app_state.rs

@@ -18,9 +18,11 @@ pub struct BoundedQueryCursor {
 
 use crate::{
     application_contract::ApplicationContractStore, artifacts::ArtifactStore, audit::AuditLog,
-    auth::KeyStore, causal::CausalStore, clock::LeaseClock, cluster::ClusterStore,
+    auth::KeyStore, canonical_principals::CanonicalPrincipalAuthority,
+    causal::CanonicalEventAuthority,
+    clock::LeaseClock, cluster::ClusterStore,
     connections::ConnectionStore, content::ContentStore, identity::IdentityStore,
-    leases::LeaseStore, metrics::Metrics, portable_bundle::BundleStore, principals::PrincipalStore,
+    leases::LeaseStore, metrics::Metrics, portable_bundle::BundleStore,
     providers::ProviderStore, releases::ReleaseStore, sessions::SessionVerifier,
     tenancy::TenancyStore,
 };
@@ -49,13 +51,21 @@ pub struct AppState {
     pub peer_client: reqwest::Client,
     pub peer_token: Option<Arc<str>>,
     pub lifecycle_lock: Arc<tokio::sync::Mutex<()>>,
+    /// Bounds concurrent schema snapshots before canonical commit admission.
+    ///
+    /// State-contract transactions inspect a full authority snapshot before
+    /// entering the database's atomic commit. Keeping that interval exclusive
+    /// prevents an unbounded request burst from retaining one snapshot per
+    /// request. The database's guarded transaction remains the atomic commit
+    /// arbiter; this semaphore only bounds pre-commit working memory.
+    pub state_transaction_admission: Arc<tokio::sync::Semaphore>,
     pub worker_enabled: bool,
     pub leases: LeaseStore,
     pub content: ContentStore,
     pub artifacts: ArtifactStore,
     pub bundles: BundleStore,
     pub releases: ReleaseStore,
-    pub causal: CausalStore,
+    pub events: CanonicalEventAuthority,
     pub providers: ProviderStore,
     pub contracts: ApplicationContractStore,
     pub advertise_url: Option<Arc<str>>,
@@ -64,7 +74,7 @@ pub struct AppState {
     pub backup_artifacts: Arc<Vec<(String, PathBuf)>>,
     pub tenancy: TenancyStore,
     pub sessions: SessionVerifier,
-    pub principals: PrincipalStore,
+    pub principals: CanonicalPrincipalAuthority,
     pub connections: ConnectionStore,
     pub identities: IdentityStore,
     pub applications: ApplicationStore,

package/dist/create/server-source/crates/feltdb-server/src/backup.rs

@@ -50,10 +50,6 @@ pub fn server_artifacts(data: &Path, keys: &Path, audit: &Path) -> Vec<(String,
             "application-runtimes.json".into(),
             data.with_extension("application-runtimes.json"),
         ),
-        (
-            "principals.json".into(),
-            data.with_extension("principals.json"),
-        ),
         (
             "connections.json".into(),
             data.with_extension("connections.json"),