@kedge/cli 0.0.0-stage → 0.10.0

package/src/schema.ts

@@ -0,0 +1,72 @@
+// The store's composed schema, built the way D1 applies it: each migration
+// file in one transaction, in lock order, into an in-memory SQLite. Doctor and
+// generate read objects from it rather than from SQL text, so a name inside a
+// comment or a string can't count as an object (docs/proposals/p0.8-cli-agent-kit.md §4.2).
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { BREAK, statementTexts } from "@kedge/core";
+import { byCodePoint } from "./order";
+
+export interface SchemaObject {
+  type: "table" | "index" | "trigger" | "view" | "constraint";
+  name: string;
+  table: string;
+  sql: string;
+}
+
+export interface Schema {
+  db: DatabaseSync;
+  objects: SchemaObject[];
+}
+
+/** Applies each file as one transaction, as D1 does, so a deferred obligation is checked at its commit. */
+export function applyMigrations(db: DatabaseSync, texts: readonly string[]): void {
+  for (const text of texts) {
+    db.exec("BEGIN");
+    try {
+      for (const part of text.split(BREAK)) for (const s of statementTexts(part)) db.exec(`${s};`);
+      db.exec("COMMIT");
+    } catch (e) {
+      db.exec("ROLLBACK");
+      throw e;
+    }
+  }
+}
+
+/** Named constraints in a table's CREATE statement (`CONSTRAINT <name>`), quoted or not. */
+export function namedConstraints(createSql: string): string[] {
+  return [...createSql.matchAll(/\bCONSTRAINT\s+["`[]?([A-Za-z0-9_]+)/gi)].map((m) => m[1] as string);
+}
+
+/** RAISE codes in an object's SQL: the text before the first `:` or space, which the error map keys on. */
+export function raiseCodes(sql: string): string[] {
+  return [
+    ...new Set(
+      [...sql.matchAll(/\bRAISE\s*\(\s*(?:ABORT|FAIL|ROLLBACK)\s*,\s*'([^']*)'/gi)].map(
+        (m) => (m[1] as string).split(/[: ]/)[0] as string,
+      ),
+    ),
+  ];
+}
+
+export function schemaOf(texts: readonly string[]): Schema {
+  const db = new DatabaseSync(":memory:");
+  applyMigrations(db, texts);
+  const rows = db
+    .prepare("SELECT type, name, tbl_name AS tbl, sql FROM sqlite_master WHERE name NOT LIKE 'sqlite_%'")
+    .all() as { type: SchemaObject["type"]; name: string; tbl: string; sql: string | null }[];
+  const objects: SchemaObject[] = [];
+  for (const r of rows) {
+    objects.push({ type: r.type, name: r.name, table: r.tbl, sql: r.sql ?? "" });
+    if (r.type === "table")
+      for (const c of namedConstraints(r.sql ?? ""))
+        objects.push({ type: "constraint", name: c, table: r.name, sql: r.sql ?? "" });
+  }
+  return { db, objects: objects.sort((a, b) => byCodePoint(a.name, b.name)) };
+}
+
+/** The store's composed migrations, in lock order. */
+export function composedTexts(cwd: string, lock: { entries: readonly { file: string }[] }): string[] {
+  return lock.entries.map((e) => readFileSync(join(cwd, "migrations", e.file), "utf8"));
+}

package/src/smoke.ts

@@ -0,0 +1,218 @@
+// `kedge smoke` (docs/proposals/p0.10-agent-path.md §6.3): a scripted checkout
+// through the public API with the storefront's key, then Phase 0's staff
+// placement, standing in for payment (D-035), with a CLI session holding
+// `order:place`. It never places a second order by accident: each run has a
+// name the caller keeps, recorded in `.kedge/state.db` before its cart exists,
+// and three moments are each committed before the request they guard: the
+// completion's exact body (a rerun sends it unchanged, never a fresh price),
+// the order's id and token together, and the number once it's read back. A
+// rerun resumes; a finished run answers its order again, writing nothing.
+import type { DatabaseSync } from "node:sqlite";
+import { NeedsPerson } from "./cf";
+import { type SessionDeps, withCliSession } from "./cli-session";
+import { DeployRefused } from "./deploy";
+import { ENV, identityOf, keysSaveHeld } from "./keys-save";
+import { stateDb, withStoreLock } from "./local-state";
+import { storeRequest } from "./store-api";
+import type { StoreTarget } from "./target";
+
+/** The product `kedge seed --sample apparel` makes first, and the currency it's priced in. */
+export const SMOKE_PRODUCT = { handle: "linen-shirt", currency: "USD" } as const;
+
+interface Run {
+  name: string;
+  store: string;
+  storefront_id: string;
+  cart_id: string | null;
+  cart_token: string | null;
+  completion: string | null;
+  order_id: string | null;
+  order_token: string | null;
+  number: string | null;
+  abandoned: string | null;
+}
+
+export interface SmokeDeps {
+  cwd: string;
+  fetch: typeof fetch;
+  session: SessionDeps;
+  log: (s: string) => void;
+  now?: () => number;
+}
+
+export interface SmokeResult {
+  run: string;
+  order_id: string;
+  number: string;
+  status: string;
+}
+
+const table = (db: DatabaseSync) =>
+  db.exec(`CREATE TABLE IF NOT EXISTS smoke_run (
+    name TEXT PRIMARY KEY, store TEXT NOT NULL, storefront_id TEXT NOT NULL,
+    cart_id TEXT, cart_token TEXT, completion TEXT, order_id TEXT, order_token TEXT, number TEXT, abandoned TEXT,
+    created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`);
+
+/** The smoke run `name` on `target`: resumed, or answered again once it has its number. */
+export async function smoke(target: StoreTarget, name: string, d: SmokeDeps): Promise<SmokeResult> {
+  return withStoreLock(d.cwd, "smoke", async () => {
+    const db = stateDb(d.cwd);
+    try {
+      table(db);
+      return await run(db, target, name, d);
+    } finally {
+      db.close();
+    }
+  });
+}
+
+async function run(db: DatabaseSync, target: StoreTarget, name: string, d: SmokeDeps): Promise<SmokeResult> {
+  const now = d.now ?? Date.now;
+  const store = identityOf(target);
+  const get = () => db.prepare("SELECT * FROM smoke_run WHERE name = ?").get(name) as unknown as Run | undefined;
+  const set = (a: Partial<Run>) => {
+    const cols = Object.keys(a);
+    db.prepare(`UPDATE smoke_run SET ${cols.map((c) => `${c} = ?`).join(", ")}, updated_at = ? WHERE name = ?`).run(
+      ...cols.map((c) => (a as Record<string, string | null>)[c] ?? null),
+      now(),
+      name,
+    );
+  };
+
+  let r = get();
+  // A finished run answers its order again, sending nothing: a retried command can't place a second one.
+  if (r?.number && r.order_id) {
+    if (r.store !== store) throw new DeployRefused(`smoke run ${name} belongs to another store (${r.store})`);
+    return { run: name, order_id: r.order_id, number: r.number, status: "open" };
+  }
+  if (r?.abandoned)
+    throw new DeployRefused(`smoke run ${name} was abandoned: ${r.abandoned}. Start another with --run <new name>`);
+
+  // The storefront's key, through the same check `keys create --save` makes every time: a saved key that's
+  // this store's and still works, or a replacement on its recorded storefront (codex code r13).
+  const saved = await keysSaveHeld(
+    target,
+    { kind: "publishable", name: "web", origins: [] },
+    {
+      cwd: d.cwd,
+      fetch: d.fetch,
+      session: d.session,
+      log: d.log,
+    },
+  );
+  const key = saved[ENV.publishable];
+  const storefront = saved[ENV.storefront];
+  if (!key || !storefront) throw new DeployRefused("no storefront key was saved for this store");
+
+  if (!r) {
+    const t = now();
+    db.prepare("INSERT INTO smoke_run (name, store, storefront_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?)").run(
+      name,
+      store,
+      storefront,
+      t,
+      t,
+    );
+    r = get() as Run;
+  }
+  // A cart admits only its own storefront's key: a record for another store or storefront is refused, not reused.
+  if (r.store !== store || r.storefront_id !== storefront)
+    throw new DeployRefused(
+      `smoke run ${name} was made for ${r.store === store ? `storefront ${r.storefront_id}` : r.store}: start another with --run <new name>`,
+    );
+
+  const shop = { "x-kedge-key": key };
+  const req = async (method: string, path: string, headers: Record<string, string>, body?: unknown) => {
+    const res = await storeRequest(d.fetch, new URL(path, target.url), {
+      method,
+      headers: { ...headers, ...(body === undefined ? {} : { "content-type": "application/json" }) },
+      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+    });
+    return res;
+  };
+  const refused = (what: string, res: { status: number; body: Record<string, unknown> }) =>
+    new DeployRefused(
+      `${what} answered ${res.status} ${String((res.body.error as { code?: string } | undefined)?.code ?? "")}`.trim(),
+    );
+
+  if (!r.order_id) {
+    if (!r.completion) {
+      // Disposable until it's marked completing: a cart from a stopped run is abandoned with its lines.
+      const p = await req("GET", `/store/products/${SMOKE_PRODUCT.handle}?currency=${SMOKE_PRODUCT.currency}`, shop);
+      if (p.status === 404)
+        throw new DeployRefused(`the store has no ${SMOKE_PRODUCT.handle}: run kedge seed --sample apparel first`);
+      if (!p.ok) throw refused("reading the sample product", p);
+      const variant = (p.body.variants as { id?: string }[] | undefined)?.[0]?.id;
+      if (!variant) throw new DeployRefused(`${SMOKE_PRODUCT.handle} has no variant to buy`);
+      const cart = await req("POST", "/store/carts", shop, {
+        currency_code: SMOKE_PRODUCT.currency,
+        email: smokeEmail(target.url),
+      });
+      if (!cart.ok) throw refused("creating the cart", cart);
+      const id = String(cart.body.id);
+      const token = String(cart.body.token);
+      const withCart = { ...shop, "x-cart-token": token };
+      const line = await req("POST", `/store/carts/${id}/lines`, withCart, { variant_id: variant, quantity: 1 });
+      if (!line.ok) throw refused("adding the line", line);
+      const total = (line.body.totals as { total?: { amount?: number } } | null)?.total?.amount;
+      if (typeof total !== "number") throw new DeployRefused("the cart answered no total to complete it with");
+      // Moment 1: the exact completion, before it's sent. It's what every rerun sends.
+      set({ cart_id: id, cart_token: token, completion: JSON.stringify({ expected_total: total }) });
+      r = get() as Run;
+    }
+    // Moment 2: the recorded body, unchanged, with the same token; a completed cart answers the same order.
+    const done = await req(
+      "POST",
+      `/store/carts/${r.cart_id}/complete`,
+      { ...shop, "x-cart-token": r.cart_token as string },
+      JSON.parse(r.completion as string),
+    );
+    const code = (done.body.error as { code?: string } | undefined)?.code;
+    if (code === "CART_TOTAL_CHANGED") {
+      // That refusal creates no order: this run ends, and another prices afresh.
+      set({ abandoned: "the cart's price changed before it completed (CART_TOTAL_CHANGED)" });
+      throw new DeployRefused(
+        `smoke run ${name}: the price changed before completion, so nothing was ordered. Start another with --run <new name>`,
+      );
+    }
+    if (!done.ok || typeof done.body.id !== "string" || typeof done.body.token !== "string")
+      throw refused("completing the cart", done);
+    // Moment 3: the order's id and token, together.
+    set({ order_id: done.body.id, order_token: done.body.token });
+    r = get() as Run;
+  }
+
+  // Placement stands in for payment in Phase 0 (D-035); placing an open order again changes nothing.
+  const orderId = r.order_id as string;
+  await withCliSession(target, ["order:place"], d.session, async (auth) => {
+    const placed = await req("POST", `/admin/orders/${orderId}/place`, auth, {});
+    if (!placed.ok) throw refused("placing the order", placed);
+  });
+  const read = await req("GET", `/store/orders/${orderId}`, { ...shop, "x-order-token": r.order_token as string });
+  if (!read.ok) throw refused("reading the order back", read);
+  const status = String(read.body.status);
+  // The API answers the number as an integer (research/29's first run): kept as text, as shown.
+  const raw = read.body.number;
+  const number = typeof raw === "number" || (typeof raw === "string" && raw) ? String(raw) : null;
+  if (status !== "open" || !number)
+    throw new DeployRefused(
+      `the order is ${status}${number ? ` (${number})` : ", with no number"}, so it isn't placed`,
+    );
+  set({ number });
+  d.log(`order ${number} is open (smoke run ${name})`);
+  return { run: name, order_id: orderId, number, status };
+}
+
+/** `smoke@<the store's host>`, which names it as a test in the admin; a bare host gets `.test` to be an address. */
+export function smokeEmail(url: string): string {
+  const host = new URL(url).hostname;
+  return `smoke@${host.includes(".") ? host : `${host}.test`}`;
+}
+
+/** Whether `url` is a store a smoke run writes to only by someone's choice (§6.3). */
+export function needsLive(target: StoreTarget, live: boolean): void {
+  if (target.kind === "production" && !live)
+    throw new NeedsPerson(
+      `${target.url} is the live store: a test order there is its owner's call, and stays as its first order until P1's order actions can cancel it. With their yes, run this again with --live`,
+    );
+}

package/src/sqlite-verify.ts

@@ -0,0 +1,333 @@
+// Verifies plugin SQL against the real schema with SQLite's own authorizer.
+// The token rules (plugin-sql-rules.ts) guess which tables a statement
+// touches; SQLite knows. Five codex rounds found syntax the guesses missed
+// (quoted names, schema qualifiers, parenthesised tables, CTEs, renames), so
+// at build time `kedge generate` compiles every statement a plugin will run
+// against core's and the plugins' migrations in an in-memory database, and
+// checks each table SQLite reports reading or writing, through views and
+// triggers included. Nothing is executed except migrations. The token rules
+// still run at runtime, where Workers has no SQLite authorizer.
+import { DatabaseSync } from "node:sqlite";
+import {
+  acquireSql,
+  BREAK,
+  createEntitySql,
+  entityTriggersSql,
+  type FactTable,
+  factGuardSql,
+  factTables,
+  type LintIssue,
+  PERMANENT_IDENTITIES,
+  type PluginDefinition,
+  splitStatements,
+  statementTexts,
+  type Token,
+  tokenize,
+} from "@kedge/core";
+
+// SQLite authorizer action codes (sqlite.org/c3ref/c_alter_table.html).
+const A = {
+  CREATE_INDEX: 1,
+  CREATE_TABLE: 2,
+  CREATE_TRIGGER: 7,
+  CREATE_VIEW: 8,
+  DELETE: 9,
+  DROP_INDEX: 10,
+  DROP_TABLE: 11,
+  DROP_TRIGGER: 16,
+  DROP_VIEW: 17,
+  INSERT: 18,
+  PRAGMA: 19,
+  READ: 20,
+  SELECT: 21,
+  UPDATE: 23,
+  ALTER_TABLE: 26,
+  REINDEX: 27,
+  ANALYZE: 28,
+  FUNCTION: 31,
+  RECURSIVE: 33,
+} as const;
+
+type Access = [action: number, a: string | null, b: string | null, db: string | null, source: string | null];
+
+const SYSTEM = /^sqlite_(master|schema|sequence|temp_master|temp_schema|stat\d)$/;
+
+/**
+ * Judges one statement's accesses. `own` is the owner's namespace. A source
+ * (the view or trigger an access happens inside) that isn't a `plg_` object
+ * is core's: a read view, a core trigger, or a guard core generated, fired by
+ * the plugin's write. Plugin triggers and views must be `plg_<name>_…`, so a
+ * plugin can't pass its own SQL off as core's.
+ */
+function judge(
+  accesses: readonly Access[],
+  own: (name: string) => boolean,
+  ddl: boolean,
+  add: (rule: string, message: string) => void,
+): void {
+  for (const [action, a, b, , source] of accesses) {
+    const coreSource = source !== null && !source.startsWith("plg_");
+    switch (action) {
+      case A.SELECT:
+      case A.FUNCTION:
+      case A.RECURSIVE:
+        break;
+      case A.PRAGMA:
+        // SQLite runs these itself to validate an ALTER TABLE ADD COLUMN; a plugin can't write a PRAGMA (token rules).
+        if (
+          ddl &&
+          ["quick_check", "integrity_check", "table_info", "table_xinfo", "foreign_key_list"].includes(a ?? "")
+        )
+          break;
+        add("forbidden-statement", `PRAGMA ${a} isn't allowed in plugin SQL`);
+        break;
+      case A.READ:
+        if (ddl && (a ?? "").startsWith("pragma_")) break; // the same internal validation
+        // Permanent identities are read by the foreign keys a plugin row may hold to them.
+        if (!a || own(a) || coreSource || /^kedge_v\d+_/.test(a) || SYSTEM.test(a) || PERMANENT_IDENTITIES.has(a))
+          break;
+        add("core-table", `reads "${a}"${source ? ` (in ${source})` : ""}; read core only through kedge_vN_ views`);
+        break;
+      case A.INSERT:
+      case A.UPDATE:
+      case A.DELETE:
+        if (!a || own(a) || coreSource || (ddl && SYSTEM.test(a)) || a === "sqlite_sequence") break;
+        add("foreign-write", `writes "${a}"${source ? ` (in ${source})` : ""}; plugin SQL writes only its own tables`);
+        break;
+      case A.CREATE_TABLE:
+      case A.CREATE_VIEW:
+      case A.DROP_TABLE:
+      case A.DROP_VIEW:
+      case A.ALTER_TABLE:
+        if (!ddl) add("ddl-outside-migration", "DDL belongs in a migration");
+        // ALTER reports (db, table); the others (name, null).
+        if (!own((action === A.ALTER_TABLE ? b : a) ?? ""))
+          add("prefix", `"${action === A.ALTER_TABLE ? b : a}" isn't the owner's`);
+        break;
+      case A.CREATE_INDEX:
+      case A.CREATE_TRIGGER:
+      case A.DROP_INDEX:
+      case A.DROP_TRIGGER:
+        if (!ddl) add("ddl-outside-migration", "DDL belongs in a migration");
+        // (name, table): both the owner's. SQLite names a UNIQUE's own index sqlite_autoindex_<table>_n.
+        if (!(own(a ?? "") || (a ?? "").startsWith(`sqlite_autoindex_${b}_`)) || !own(b ?? ""))
+          add("core-ddl", `"${a}" on "${b}" isn't the owner's object on the owner's table`);
+        break;
+      case A.REINDEX:
+      case A.ANALYZE:
+        if (!ddl) add("ddl-outside-migration", "DDL belongs in a migration");
+        break;
+      default:
+        add("forbidden-statement", `SQLite action ${action} isn't allowed in plugin SQL`);
+    }
+  }
+}
+
+/** A trigger body's statements, made compilable on their own: NEW./OLD. columns and RAISE(...) become NULL. */
+function triggerBodies(sql: string): string[] {
+  const out: string[] = [];
+  for (const st of splitStatements(tokenize(sql))) {
+    const words = st.filter((t) => t.kind === "word").map((t) => (t as { upper: string }).upper);
+    if (words[0] !== "CREATE" || !words.slice(0, 4).includes("TRIGGER")) continue;
+    const begin = st.findIndex((t) => t.kind === "word" && (t as { upper: string }).upper === "BEGIN");
+    const body = st.slice(begin + 1, -1); // up to the final END
+    out.push(...bodyStatements(sql, body));
+  }
+  return out;
+}
+
+/**
+ * Rebuilds a trigger body's statements from the source text, keeping what
+ * sits between tokens (so `!=` stays one operator), with NEW./OLD. columns
+ * and RAISE(...) replaced by NULL so each compiles on its own.
+ */
+function bodyStatements(sql: string, body: readonly Token[]): string[] {
+  const stmts: string[] = [];
+  let cur = "";
+  let last = body[0]?.start ?? 0;
+  const emit = (text: string, start: number, end: number) => {
+    cur += sql.slice(last, start) + text;
+    last = end;
+  };
+  for (let i = 0; i < body.length; i++) {
+    const t = body[i] as Token;
+    const up = t.kind === "word" ? (t as { upper: string }).upper : "";
+    if ((up === "NEW" || up === "OLD") && body[i + 1]?.text === "." && body[i + 2]) {
+      emit("NULL", t.start, (body[i + 2] as Token).end);
+      i += 2;
+      continue;
+    }
+    if (up === "RAISE" && body[i + 1]?.text === "(") {
+      let depth = 0;
+      let j = i + 1;
+      for (; j < body.length; j++) {
+        if (body[j]?.text === "(") depth++;
+        if (body[j]?.text === ")" && --depth === 0) break;
+      }
+      emit("NULL", t.start, (body[Math.min(j, body.length - 1)] as Token).end);
+      i = j;
+      continue;
+    }
+    if (t.text === ";") {
+      cur += sql.slice(last, t.start);
+      if (cur.trim()) stmts.push(cur.trim());
+      cur = "";
+      last = t.end;
+      continue;
+    }
+    emit(sql.slice(t.start, t.end), t.start, t.end);
+  }
+  if (cur.trim()) stmts.push(cur.trim());
+  return stmts;
+}
+
+export interface VerifyInput {
+  /** Core's migration files, in order. */
+  coreSql: readonly string[];
+  plugins: readonly {
+    // biome-ignore lint/suspicious/noExplicitAny: each plugin brings its own options type
+    definition: PluginDefinition<any>;
+    /** The SQL the plugin builds at runtime, from the linter's sample inputs. */
+    runtime: readonly { where: string; sql: string; context?: string }[];
+    historicalFacts?: readonly FactTable[];
+  }[];
+}
+
+/** Compiles every plugin statement against the real schema and judges what SQLite says it touches. */
+export function verifyWithSqlite(input: VerifyInput): (LintIssue & { plugin: string })[] {
+  const db = new DatabaseSync(":memory:");
+  const issues: (LintIssue & { plugin: string })[] = [];
+  // One transaction per migration, as D1 applies one: a migration's marker
+  // (p0.5 §7.1) is a deferred obligation checked at its commit, not per statement.
+  const run = (text: string) => {
+    db.exec("BEGIN");
+    for (const part of text.split(BREAK)) for (const s of statementTexts(part)) db.exec(`${s};`);
+    db.exec("COMMIT");
+  };
+  for (const text of input.coreSql) run(text);
+  // Generated entity tables are core's SQL, installed as is, so plugin SQL
+  // that reads one compiles (codex code r2). Fields are never removed (§4.3),
+  // so the current declaration's table has every column history gave it.
+  // Their triggers too, so SQLite compiles every generated one (codex code r7).
+  for (const p of input.plugins)
+    for (const [entity, def] of Object.entries(p.definition.entities ?? {}))
+      run(
+        [
+          ...createEntitySql(p.definition.name, entity, def),
+          ...entityTriggersSql(p.definition.name, entity, def, ""),
+        ].join(BREAK),
+      );
+
+  let accesses: Access[] = [];
+  const reportedKeys = new Set<string>();
+  const record = (action: number, a: string | null, b: string | null, dbName: string | null, source: string | null) => {
+    accesses.push([action, a ?? null, b ?? null, dbName ?? null, source ?? null]);
+    return 0;
+  };
+  db.setAuthorizer(record);
+  const names = () =>
+    new Set(
+      (db.prepare("SELECT name, tbl_name FROM sqlite_master").all() as { name: string; tbl_name: string }[]).map(
+        (r) => `${r.name}\u0000${r.tbl_name}`,
+      ),
+    );
+  let facts = new Set<string>();
+  const check = (plugin: string, where: string, text: string, ddl: boolean, execute: boolean) => {
+    const own = (name: string) => name.startsWith(`plg_${plugin}_`);
+    accesses = [];
+    try {
+      if (execute) {
+        // The authorizer doesn't report where a rename lands, so compare the
+        // schema: every object a migration statement leaves behind is the owner's.
+        db.setAuthorizer(null);
+        const before = names();
+        db.setAuthorizer(record);
+        db.exec(`${text};`);
+        db.setAuthorizer(null);
+        for (const n of names()) {
+          if (before.has(n)) continue;
+          const [name = "", table = ""] = n.split("\u0000");
+          if (!(own(name) || name.startsWith(`sqlite_autoindex_${table}_`)) || !own(table))
+            issues.push({
+              plugin,
+              rule: "prefix",
+              message: `leaves "${name}" on "${table}" outside ${`plg_${plugin}_`}…`,
+              at: where,
+            });
+        }
+        // Every foreign key from the owner's tables to core, however it was
+        // declared (CREATE TABLE or ADD COLUMN), is NO ACTION: core rebuilds its
+        // tables, and SQLite fires CASCADE and SET NULL on that drop.
+        const tables = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all() as { name: string }[];
+        for (const { name } of tables.filter((t) => own(t.name))) {
+          const fks = db.prepare(`SELECT "table", on_update, on_delete FROM pragma_foreign_key_list(?)`).all(name) as {
+            table: string;
+            on_update: string;
+            on_delete: string;
+          }[];
+          for (const fk of fks) {
+            if (own(fk.table)) continue;
+            const key = `${plugin}:${name}:${fk.table}`;
+            if ((fk.on_update !== "NO ACTION" || fk.on_delete !== "NO ACTION") && !reportedKeys.has(key)) {
+              reportedKeys.add(key);
+              issues.push({
+                plugin,
+                rule: "core-fk-action",
+                message: `${name} → ${fk.table} must be NO ACTION`,
+                at: where,
+              });
+            }
+          }
+        }
+        db.setAuthorizer(record);
+      } else db.prepare(text);
+    } catch (e) {
+      issues.push({
+        plugin,
+        rule: "invalid-sql",
+        message: `doesn't compile against the schema: ${(e as Error).message}`,
+        at: where,
+      });
+      return;
+    }
+    judge(accesses, own, ddl, (rule, message) =>
+      issues.push({ plugin, rule, message, at: `${where}: ${text.slice(0, 60)}` }),
+    );
+    // A fact table, current or once declared, holds facts that back money and
+    // pending releases. SQLite runs no DELETE trigger on DROP TABLE, so a
+    // rebuild that drops or renames one could lose them unseen; until core has
+    // a controlled way to move facts, it is refused.
+    for (const [action, a, b] of accesses) {
+      // ALTER TABLE is one action for ADD COLUMN and RENAME alike; only a rename moves the table.
+      const renames = /^\s*ALTER\s+TABLE\b[\s\S]*\bRENAME\b/i.test(text);
+      const table = action === A.DROP_TABLE ? a : action === A.ALTER_TABLE && renames ? b : null;
+      if (table && facts.has(table))
+        issues.push({
+          plugin,
+          rule: "fact-table-change",
+          message: `"${table}" holds plugin facts; it can't be dropped or renamed`,
+          at: where,
+        });
+    }
+  };
+
+  for (const p of input.plugins) {
+    const def = p.definition;
+    facts = new Set(factTables(def, p.historicalFacts ?? []).map((f) => f.table));
+    for (const m of def.migrations ?? []) {
+      for (const s of statementTexts(m.sql)) check(def.name, m.id, s, true, true);
+      for (const s of triggerBodies(m.sql)) check(def.name, `${m.id} trigger body`, s, false, false);
+    }
+    // Core-owned SQL is installed as is, then the plugin's runtime SQL is compiled against all of it.
+    db.setAuthorizer(null);
+    run([...factGuardSql(def, p.historicalFacts ?? []), ...acquireSql(def)].join(BREAK));
+    db.setAuthorizer(record);
+    for (const [key, body] of Object.entries(def.acquire ?? {})) {
+      for (const s of bodyStatements(body as string, tokenize(body as string)))
+        check(def.name, `acquire ${key}`, s, false, false);
+    }
+    // Acquire bodies were checked above, with NEW. columns made compilable.
+    for (const r of p.runtime) if (r.context !== "acquire") check(def.name, r.where, r.sql, false, false);
+  }
+  return issues;
+}

package/src/store-api.ts

@@ -0,0 +1,36 @@
+// Requests to a store's own API, as the CLI makes them (p0.10 §5): a write
+// with no answer, or one that can't be read, is an unknown outcome.
+import { UnknownOutcome } from "./cf";
+import { DeployRefused } from "./deploy";
+
+/**
+ * One request to a store's API. A write sent with no answer back, or with an
+ * answer that can't be read, may have committed: its outcome is unknown, never
+ * a failure (p0.10 §5, codex code r8), and says so under `--json`. A readable
+ * refusal is the caller's to word.
+ */
+export async function storeRequest(
+  f: typeof fetch,
+  url: URL,
+  init: RequestInit,
+): Promise<{ status: number; ok: boolean; body: Record<string, unknown> }> {
+  const what = `${init.method ?? "GET"} ${url.pathname}`;
+  const write = (init.method ?? "GET") !== "GET";
+  let r: Response;
+  try {
+    r = await f(url, init);
+  } catch {
+    if (write) throw new UnknownOutcome(what, "the store");
+    throw new DeployRefused(`${what}: the store didn't answer`);
+  }
+  let body: Record<string, unknown>;
+  try {
+    body = (await r.json()) as Record<string, unknown>;
+  } catch {
+    // A refusal Kedge words is JSON; an unreadable success, or a 5xx from in front of the Worker, isn't proof of either.
+    if (write && (r.ok || r.status >= 500))
+      throw new UnknownOutcome(`${what} (answered ${r.status}, unreadable)`, "the store");
+    throw new DeployRefused(`${what} answered ${r.status}, not JSON`);
+  }
+  return { status: r.status, ok: r.ok, body };
+}