@lunora/do 1.0.0-alpha.16 → 1.0.0-alpha.18

package/dist/index.d.mts

@@ -5846,8 +5846,12 @@ declare abstract class ShardDO {
   * subscriber counts are folded live from each socket's attachment via
   * {@link summarizeFanoutTopics}; the running per-path cost counters are the
   * in-memory {@link ShardDO.fanout} tallies, sharing `metrics.sinceMs` as the
-  * "since this instance woke" epoch. Read-only: touches no SQLite and mutates
-  * no socket state.
+  * "since this instance woke" epoch. Touches no SQLite and mutates no socket
+  * state; it does call `relay.relayCount()`, which advances the promotion
+  * latch — safe here because that transition is a pure, monotonic function of
+  * the live socket count (DOs are single-threaded), so a metrics poll only ever
+  * drives the latch to the same state the routing path would compute for the
+  * same count, never a divergent one.
   */
   private collectFanoutMetrics;
   /** Resolve a `getAuditLog` admin read, parsing the optional `limit`/`sinceSeq` cursor args and ensuring the reserved table first. */
@@ -6593,8 +6597,11 @@ interface WhereSqlStrategy {
   fieldRef: FieldRefSql;
   /**
   * Dialect `contains` rendering given the field reference and the (already
-  * bound) search term. Absent ⇒ the portable `… LIKE '%' || term || '%'`
-  * concat form (SQLite/Postgres); MySQL supplies a `CONCAT(...)` variant.
+  * bound, already wildcard-escaped) search term. Absent ⇒ the portable
+  * `… LIKE '%' || term || '%' ESCAPE '\'` concat form (SQLite/Postgres); MySQL
+  * supplies a `CONCAT(...)` variant. The term is escaped by
+  * {@link compileContains}, so an implementation MUST pair it with
+  * `ESCAPE '\'` for the literal-match to hold.
   */
   likeContains?: (reference: SQL, term: SQL) => SQL;
   /**

package/dist/index.d.ts

@@ -5846,8 +5846,12 @@ declare abstract class ShardDO {
   * subscriber counts are folded live from each socket's attachment via
   * {@link summarizeFanoutTopics}; the running per-path cost counters are the
   * in-memory {@link ShardDO.fanout} tallies, sharing `metrics.sinceMs` as the
-  * "since this instance woke" epoch. Read-only: touches no SQLite and mutates
-  * no socket state.
+  * "since this instance woke" epoch. Touches no SQLite and mutates no socket
+  * state; it does call `relay.relayCount()`, which advances the promotion
+  * latch — safe here because that transition is a pure, monotonic function of
+  * the live socket count (DOs are single-threaded), so a metrics poll only ever
+  * drives the latch to the same state the routing path would compute for the
+  * same count, never a divergent one.
   */
   private collectFanoutMetrics;
   /** Resolve a `getAuditLog` admin read, parsing the optional `limit`/`sinceSeq` cursor args and ensuring the reserved table first. */
@@ -6593,8 +6597,11 @@ interface WhereSqlStrategy {
   fieldRef: FieldRefSql;
   /**
   * Dialect `contains` rendering given the field reference and the (already
-  * bound) search term. Absent ⇒ the portable `… LIKE '%' || term || '%'`
-  * concat form (SQLite/Postgres); MySQL supplies a `CONCAT(...)` variant.
+  * bound, already wildcard-escaped) search term. Absent ⇒ the portable
+  * `… LIKE '%' || term || '%' ESCAPE '\'` concat form (SQLite/Postgres); MySQL
+  * supplies a `CONCAT(...)` variant. The term is escaped by
+  * {@link compileContains}, so an implementation MUST pair it with
+  * `ESCAPE '\'` for the literal-match to hold.
   */
   likeContains?: (reference: SQL, term: SQL) => SQL;
   /**

package/dist/index.mjs

@@ -3,15 +3,15 @@ export { AGGREGATE_SQL_FUNCTION, aggregateSqlFunction, matchesStaticWhere, norma
 export { aggregateTableName, coerceAggregateNumber, encodeAggregateKey, foldAggregateTally, readAggregateValue } from './packem_shared/aggregateTableName-CxNqY1Sl.mjs';
 export { CountRlsUnsupportedError, mergeWhere, planAggregateLookup, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy } from './packem_shared/CountRlsUnsupportedError-28ZvvwKS.mjs';
 export { AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, ensureAuthMetricsTables, readAuthMetrics, recordAuthEvent } from './packem_shared/AUTH_METRICS_BUCKETS_TABLE-CiHHYeJi.mjs';
-export { NotUniqueError, assertValidClientId, createShardCtxDb, normalizeIdStructurally } from './packem_shared/NotUniqueError-BXn2j5vu.mjs';
+export { NotUniqueError, assertValidClientId, createShardCtxDb, normalizeIdStructurally } from './packem_shared/NotUniqueError-Do5h_jiW.mjs';
 export { DATA_MIGRATION_STATE_TABLE, readMigrationStatus, runDataMigration } from './packem_shared/DATA_MIGRATION_STATE_TABLE-DfPxn8I0.mjs';
 export { SCAN_DEP, createDependencyTracker, depKey } from './packem_shared/SCAN_DEP-DLJF8dsj.mjs';
 export { renderSql } from './packem_shared/renderSql-D6eUcn2N.mjs';
 export { diffExternalSource } from './packem_shared/diffExternalSource-Cx9HUPJj.mjs';
-export { materializeExternalRows, readExternalSourceBaseline, runExternalSourceTick } from './packem_shared/materializeExternalRows-uKBx9H0s.mjs';
-export { isSourceDue, liftSourceId, pullExternalSourceTick } from './packem_shared/isSourceDue-BMTJv65e.mjs';
+export { materializeExternalRows, readExternalSourceBaseline, runExternalSourceTick } from './packem_shared/materializeExternalRows-Bj6EXy50.mjs';
+export { isSourceDue, liftSourceId, pullExternalSourceTick } from './packem_shared/isSourceDue-9mJRJ9Ld.mjs';
 export { FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, ensureFunctionMetricsTables, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, recordFunctionMetric } from './packem_shared/FUNCTION_METRICS_BUCKETS_TABLE-UDNVD7FS.mjs';
-export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, FLAGS_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, facetColumn, listTables, readTablePage, selectMatchingIds } from './packem_shared/ADMIN_FUNCTIONS-fMl1vyt1.mjs';
+export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, FLAGS_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, facetColumn, listTables, readTablePage, selectMatchingIds } from './packem_shared/ADMIN_FUNCTIONS-BvGiv2u6.mjs';
 export { LogBuffer } from './packem_shared/LogBuffer-B_Ezju_N.mjs';
 export { MAIL_RETENTION, MAIL_TABLE, clearCapturedMail, ensureMailTable, readCapturedMail, recordCapturedMail } from './packem_shared/MAIL_RETENTION-CPpgl-dX.mjs';
 export { default as NotFoundError } from './packem_shared/NotFoundError-CMuMZt81.mjs';
@@ -19,20 +19,20 @@ export { armRestore, readBookmark } from './packem_shared/armRestore-BJk53Ro8.mj
 export { applySelect, buildSeekWhere, decodeCursor, encodeCursor, normalizeOrderKeys, softDeleteScope } from './packem_shared/applySelect-BvZdFUBT.mjs';
 export { RANK_TIEBREAK, encodePartitionKey, matchesRankStaticWhere, rankTableName, resolveRankPartition, sortColumnName } from './packem_shared/RANK_TIEBREAK-CXhdcA1o.mjs';
 export { ReactiveCache, reactiveCacheKey } from './packem_shared/ReactiveCache-BYlSGY0N.mjs';
-export { serveRelationFanout } from './packem_shared/serveRelationFanout-EZLD9-O3.mjs';
+export { serveRelationFanout } from './packem_shared/serveRelationFanout-BuSmWawx.mjs';
 export { DEFAULT_MAX_RELATION_KEYS, assertFlatPredicate, assertShapeShardable, containsRelationPredicate, isRelationPredicate, resolveRelationPredicates } from './packem_shared/DEFAULT_MAX_RELATION_KEYS-DU-Y4-LJ.mjs';
 export { applyOnDelete, fanOutScalarCounts, resolveWith, runRowValidators } from './packem_shared/applyOnDelete-BQ-8ZlZ1.mjs';
 export { RLS_UNWRAP_SYMBOL, RlsRequiredError, guardWriter } from './packem_shared/RLS_UNWRAP_SYMBOL-EtGQdC9d.mjs';
 export { buildFtsMatch, ftsTableName, scoreDocument, stringifySearchText, tokenizeSearch } from './packem_shared/buildFtsMatch-BLEMawrp.mjs';
 export { M as MIN_ADMIN_TOKEN_LENGTH, a as MIN_AUTH_SECRET_LENGTH, b as buildSecurityAudit } from './packem_shared/security-audit-CucgBice.mjs';
 export { SESSION_DO_TTL_DEFAULT, SessionDO } from './packem_shared/SESSION_DO_TTL_DEFAULT-ilPZsVwu.mjs';
-export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-CtTkRXH0.mjs';
+export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-DHNOI0RZ.mjs';
 export { SHARD_REGISTRY_DO_NAME, ShardRegistryDO } from './packem_shared/SHARD_REGISTRY_DO_NAME-BsAbi5Mn.mjs';
 export { MAX_SQL_ROWS, assertReadonly, runReadonlySql } from './packem_shared/MAX_SQL_ROWS-dDcFE1YZ.mjs';
 export { createSystemReader } from './packem_shared/createSystemReader-8CzSZP9V.mjs';
 export { ConflictError } from './packem_shared/ConflictError-C0STs6bU.mjs';
 export { hasTrigger, runTriggers } from './packem_shared/hasTrigger-5N6_Fx0A.mjs';
-export { compileWhereSql } from './packem_shared/compileWhereSql-CXrhFA3G.mjs';
+export { compileWhereSql } from './packem_shared/compileWhereSql-MW_Lk8nJ.mjs';
 export { CDC_LOG_TABLE, applyCdcChanges, readCdcChanges, trimCdcChanges } from './packem_shared/CDC_LOG_TABLE-DSycmnDf.mjs';
 export { backfillAggregateIndexes, backfillRankIndexes } from './packem_shared/backfillAggregateIndexes-BZsOqDXP.mjs';
 export { runShardMigrations } from './packem_shared/runShardMigrations-nIwoQeOK.mjs';

package/dist/packem_shared/{ADMIN_FUNCTIONS-fMl1vyt1.mjs → ADMIN_FUNCTIONS-BvGiv2u6.mjs}

@@ -1,3 +1,5 @@
+const quoteIdentifier = (name) => `"${name.replaceAll('"', '""')}"`;
+
 const ADMIN_FUNCTION_PREFIX = "__lunora_admin__:";
 const RELATION_FUNCTION_PREFIX = "__lunora_relation__:";
 const FLAGS_FUNCTION_PREFIX = "__lunora_flags__:";
@@ -95,7 +97,6 @@ const expandDocumentRows = (columns, rows) => {
 };
 const escapeLike = (value) => value.replaceAll(/[\\%_]/g, (character) => `\\${character}`);
 const isInternalTable = (name) => name.startsWith("sqlite_") || name.startsWith("_cf_") || name.startsWith("__miniflare") || name.startsWith("__lunora") || name.includes("__fts_");
-const quoteIdentifier = (name) => `"${name.replaceAll('"', '""')}"`;
 const clamp = (value, min, max) => Math.min(Math.max(value, min), max);
 const countRows = (sql, quotedTable) => {
   const row = sql.exec(`SELECT COUNT(*) AS c FROM ${quotedTable}`).one();

package/dist/packem_shared/{NotUniqueError-BXn2j5vu.mjs → NotUniqueError-Do5h_jiW.mjs}

@@ -19,11 +19,11 @@ import { guardWriter } from './RLS_UNWRAP_SYMBOL-EtGQdC9d.mjs';
 import { createSystemReader } from './createSystemReader-8CzSZP9V.mjs';
 import { ConflictError } from './ConflictError-C0STs6bU.mjs';
 import { runTriggers } from './hasTrigger-5N6_Fx0A.mjs';
-import { compileWhereSql } from './compileWhereSql-CXrhFA3G.mjs';
+import { compileWhereSql } from './compileWhereSql-MW_Lk8nJ.mjs';
 export { backfillAggregateIndexes, backfillRankIndexes } from './backfillAggregateIndexes-BZsOqDXP.mjs';
 export { C as CLIENT_WATERMARK_TABLE, G as GLOBAL_SHAPE_SNAPSHOT_TABLE, I as IDEMPOTENCY_TABLE, c as advanceClientWatermark, d as deleteGlobalShapeSnapshot, e as deleteGlobalShapeSnapshotsForConnection, m as migrateClientWatermark, b as migrateGlobalShapeSnapshot, r as readClientWatermark, f as readGlobalShapeSnapshot, g as readIdempotent, t as trimIdempotent, w as writeGlobalShapeSnapshot, h as writeIdempotent } from './ctx-db-idempotency-BdcNpvY4.mjs';
 export { runShardMigrations } from './runShardMigrations-nIwoQeOK.mjs';
-export { a as selectShapeMemberIds, s as selectShapeRows } from './ctx-db-shapes-BQapRFjB.mjs';
+export { a as selectShapeMemberIds, s as selectShapeRows } from './ctx-db-shapes-0RaIOy7J.mjs';
 
 const rankIndexFieldsUnchanged = (index, previous, next) => {
   const fields = [...index.partitionBy ?? [], ...index.sortBy.map((key) => key.field), ...index.where ? Object.keys(index.where) : []];

package/dist/packem_shared/{ROOT_DO_SIZE_WARN_BYTES-CtTkRXH0.mjs → ROOT_DO_SIZE_WARN_BYTES-DHNOI0RZ.mjs}

@@ -5,7 +5,7 @@ import { recordAuthEvent, readAuthMetrics } from './AUTH_METRICS_BUCKETS_TABLE-C
 import { DATA_MIGRATION_STATE_TABLE, readMigrationStatus } from './DATA_MIGRATION_STATE_TABLE-DfPxn8I0.mjs';
 import { SCAN_DEP, createDependencyTracker, tableFromDepKey } from './SCAN_DEP-DLJF8dsj.mjs';
 import { readFunctionMetricsTotals, readFunctionMetricIndexHits, recordFunctionMetric, mergeScanAttribution, readFunctionMetrics, readFunctionMetricBuckets } from './FUNCTION_METRICS_BUCKETS_TABLE-UDNVD7FS.mjs';
-import { createFanoutCounters, ADMIN_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, selectMatchingIds, ADMIN_FUNCTIONS, findStorageReferences, listTables, summarizeSubscriptions, summarizeFanoutTopics, readTablePage, facetColumn, FLAGS_FUNCTION_PREFIX, recordFanoutPass, MAX_PAGE_SIZE } from './ADMIN_FUNCTIONS-fMl1vyt1.mjs';
+import { createFanoutCounters, ADMIN_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, selectMatchingIds, ADMIN_FUNCTIONS, findStorageReferences, listTables, summarizeSubscriptions, summarizeFanoutTopics, readTablePage, facetColumn, FLAGS_FUNCTION_PREFIX, recordFanoutPass, MAX_PAGE_SIZE } from './ADMIN_FUNCTIONS-BvGiv2u6.mjs';
 import { LogBuffer } from './LogBuffer-B_Ezju_N.mjs';
 import { recordCapturedMail, clearCapturedMail, readCapturedMail, MAIL_TABLE } from './MAIL_RETENTION-CPpgl-dX.mjs';
 import { readBookmark, armRestore } from './armRestore-BJk53Ro8.mjs';
@@ -17,7 +17,7 @@ import { runReadonlySql } from './MAX_SQL_ROWS-dDcFE1YZ.mjs';
 import { ConflictError } from './ConflictError-C0STs6bU.mjs';
 import { e as deleteGlobalShapeSnapshotsForConnection, g as readIdempotent, h as writeIdempotent, t as trimIdempotent, r as readClientWatermark, m as migrateClientWatermark, c as advanceClientWatermark, d as deleteGlobalShapeSnapshot, f as readGlobalShapeSnapshot, w as writeGlobalShapeSnapshot } from './ctx-db-idempotency-BdcNpvY4.mjs';
 import { CDC_LOG_TABLE, readCdcChanges, readCdcCursor, readCdcEpoch, minCdcSeq, bumpCdcEpoch } from './CDC_LOG_TABLE-DSycmnDf.mjs';
-import { a as selectShapeMemberIds, s as selectShapeRows } from './ctx-db-shapes-BQapRFjB.mjs';
+import { a as selectShapeMemberIds, s as selectShapeRows } from './ctx-db-shapes-0RaIOy7J.mjs';
 
 const MAX_BATCH_ENTRIES = 500;
 
@@ -196,7 +196,22 @@ const parseRelayName = (name) => {
 };
 
 const shapeRoutingKey = (name, args) => stableStringify({ args: args ?? {}, name });
-const DEFAULT_PROMOTION_THRESHOLDS = { tUp: 8e3 };
+const DEFAULT_PROMOTION_THRESHOLDS = { tDown: 4e3, tUp: 8e3 };
+const nextPromotionState = (current, subscribers, thresholds = DEFAULT_PROMOTION_THRESHOLDS) => {
+  if (thresholds.tDown >= thresholds.tUp) {
+    throw new Error(`invalid promotion thresholds: tDown (${String(thresholds.tDown)}) must be < tUp (${String(thresholds.tUp)})`);
+  }
+  if (current === "owned") {
+    return subscribers >= thresholds.tUp ? "promoted" : "owned";
+  }
+  return subscribers < thresholds.tDown ? "owned" : "promoted";
+};
+const clampPromotionThresholds = (tUp, tDownRaw) => {
+  if (tDownRaw < tUp) {
+    return { tDown: tDownRaw, tUp };
+  }
+  return { tDown: Math.min(Math.max(1, Math.floor(tUp / 2)), tUp - 1), tUp };
+};
 
 const projectColumns = (document_, columns) => {
   if (!columns) {
@@ -232,11 +247,12 @@ const diffGlobalMembership = (rows, previous, options) => {
   }
   return { next, rowsPatch };
 };
-const buildPokeFrames = (parts, meta) => {
+const encodeRowsPatch = (rowsPatch) => rowsPatch.map((op) => op.value === void 0 ? op : { ...op, value: encodeWire(op.value) });
+const buildPokeFrames = (parts, meta, options = {}) => {
   const { baseCheckpoint, checkpoint, epoch, lastMutationId, pokeId } = meta;
   const frames = [JSON.stringify({ baseCheckpoint, epoch, pokeId, type: "pokeStart" })];
   for (const part of parts) {
-    const rowsPatch = part.rowsPatch.map((op) => op.value === void 0 ? op : { ...op, value: encodeWire(op.value) });
+    const rowsPatch = options.preEncoded ? part.rowsPatch : encodeRowsPatch(part.rowsPatch);
     frames.push(
       JSON.stringify({
         pokeId,
@@ -253,6 +269,30 @@ const buildPokeFrames = (parts, meta) => {
 
 const DEFAULT_RELAY_FAN = 2;
 const DEFAULT_MAX_RELAYS = 8;
+const RELAY_SECRET_KEY = "LUNORA_RELAY_SECRET";
+const RELAY_SIGNATURE_HEADER = "x-lunora-relay-sig";
+const relaySecretOf = (env) => {
+  const value = env?.[RELAY_SECRET_KEY];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+};
+const constantTimeEqual$1 = (a, b) => {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let mismatch = 0;
+  for (let index = 0; index < a.length; index += 1) {
+    const charA = a.charCodeAt(index);
+    const charB = b.charCodeAt(index);
+    mismatch |= charA ^ charB;
+  }
+  return mismatch === 0;
+};
+const signRelayBody = async (secret, body) => {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(body));
+  return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+};
 const envPositiveInt = (env, key, fallback) => {
   const raw = env?.[key];
   let parsed = Number.NaN;
@@ -289,9 +329,23 @@ class RelayLink {
    * to `relay.ts` without a case here is a COMPILE error, not a runtime mis-route.
    */
   async handleControl(request) {
+    let raw;
+    try {
+      raw = await request.text();
+    } catch {
+      return new Response("bad request", { status: 400 });
+    }
+    const secret = relaySecretOf(this.host.env());
+    if (secret !== void 0) {
+      const supplied = request.headers.get(RELAY_SIGNATURE_HEADER);
+      const expected = await signRelayBody(secret, raw);
+      if (supplied === null || !constantTimeEqual$1(supplied, expected)) {
+        return new Response("forbidden", { status: 403 });
+      }
+    }
     let message;
     try {
-      message = await request.json();
+      message = JSON.parse(raw);
     } catch {
       return new Response("bad request", { status: 400 });
     }
@@ -356,10 +410,16 @@ class RelayLink {
       return void 0;
     }
     const stub = typeof namespace.getByName === "function" ? namespace.getByName(targetName) : namespace.get(namespace.idFromName(targetName));
+    const body = JSON.stringify(message);
+    const headers = { "content-type": "application/json", "x-lunora-shard-binding": this.host.shardBinding() ?? "" };
+    const secret = relaySecretOf(this.host.env());
+    if (secret !== void 0) {
+      headers[RELAY_SIGNATURE_HEADER] = await signRelayBody(secret, body);
+    }
     try {
       return await stub.fetch("https://relay.internal/_lunora/relay", {
-        body: JSON.stringify(message),
-        headers: { "content-type": "application/json", "x-lunora-shard-binding": this.host.shardBinding() ?? "" },
+        body,
+        headers,
         method: "POST"
       });
     } catch {
@@ -376,6 +436,8 @@ class OwnerRelay extends RelayLink {
   relayShapeRegistry = /* @__PURE__ */ new Map();
   /** NON-uniform (identity-scoped) relay shapes, one entry per relay socket, keyed `relayIndex:connectionId:subId`. Each is served live by a per-socket proxy poke. */
   relayShapeProxies = /* @__PURE__ */ new Map();
+  /** The owner's current promotion state (plan 075 Phase 4), carried across `relayCount()` calls so hysteresis has memory — a shard hovering near the threshold can't flap. */
+  promotionState = "owned";
   constructor(host, ownerKey) {
     super(host, { ownerKey });
   }
@@ -406,13 +468,22 @@ class OwnerRelay extends RelayLink {
   }
   /**
    * How many relays the runtime should spread new connections across for this shard
-   * (plan 075 Phase 2). `0` keeps every connection on the owner. The owner promotes
-   * once its live socket count crosses `LUNORA_RELAY_THRESHOLD`, fanning to a fixed
-   * `LUNORA_RELAY_FAN` (capped by `LUNORA_MAX_RELAYS`, the cost ceiling).
+   * (plan 075 Phase 2, hysteresis added in Phase 4). `0` keeps every connection on
+   * the owner. The owner promotes once its live socket count reaches
+   * `LUNORA_RELAY_THRESHOLD` (`tUp`), fanning to a fixed `LUNORA_RELAY_FAN` (capped
+   * by `LUNORA_MAX_RELAYS`, the cost ceiling), and only collapses back to
+   * owner-served once subscribers drain below `LUNORA_RELAY_COLLAPSE_THRESHOLD`
+   * (`tDown`) — the band between the two holds the current state so a shard
+   * hovering near the threshold can't flap. {@link clampPromotionThresholds}
+   * guarantees a valid `tDown < tUp` band even under a misconfigured collapse
+   * threshold. Advances the promotion latch, so it is not a pure read.
    */
   relayCount() {
-    const threshold = envPositiveInt(this.host.env(), "LUNORA_RELAY_THRESHOLD", DEFAULT_PROMOTION_THRESHOLDS.tUp);
-    if (this.host.getWebSockets().length < threshold) {
+    const subscribers = this.host.getWebSockets().length;
+    const tUp = envPositiveInt(this.host.env(), "LUNORA_RELAY_THRESHOLD", DEFAULT_PROMOTION_THRESHOLDS.tUp);
+    const tDownRaw = envPositiveInt(this.host.env(), "LUNORA_RELAY_COLLAPSE_THRESHOLD", DEFAULT_PROMOTION_THRESHOLDS.tDown);
+    this.promotionState = nextPromotionState(this.promotionState, subscribers, clampPromotionThresholds(tUp, tDownRaw));
+    if (this.promotionState === "owned") {
       return 0;
     }
     const maxRelays = envPositiveInt(this.host.env(), "LUNORA_MAX_RELAYS", DEFAULT_MAX_RELAYS);
@@ -497,7 +568,10 @@ class OwnerRelay extends RelayLink {
         epoch,
         fromCursor,
         name: entry.name,
-        rowsPatch,
+        // Wire-encode before the poke crosses the owner→relay `JSON.stringify`
+        // hop (`requestRelayMessage`); the relay re-frames it with
+        // `preEncoded` so a `bytes`/`bigint` shape column isn't dropped/truncated.
+        rowsPatch: encodeRowsPatch(rowsPatch),
         type: "relay_shape_poke"
       };
       for (const index of relays) {
@@ -541,7 +615,9 @@ class OwnerRelay extends RelayLink {
         epoch,
         fromCursor,
         name: entry.name,
-        rowsPatch,
+        // Wire-encode before the owner→relay `JSON.stringify` hop (see the
+        // cohort-multicast path); the relay re-frames it with `preEncoded`.
+        rowsPatch: encodeRowsPatch(rowsPatch),
         targetConnectionId: entry.connectionId,
         type: "relay_shape_poke"
       };
@@ -647,8 +723,9 @@ class OwnerRelay extends RelayLink {
    * sound against the cross-identity row-leak (review). Resolves under the anonymous
    * multicast identity (the base) plus two `Proxy`-backed identities that return a
    * distinct value for ANY accessed claim, requires all to agree on table + where +
-   * columns, rejects any table with an RLS read policy or a masked projected column,
-   * and fails closed if the claims are enumerated (a wholesale copy the proxy can't
+   * columns, rejects any table with an RLS read policy or ANY masked column
+   * defined (even if unprojected — see {@link OwnerRelay.tableHasAnyMask}), and
+   * fails closed if the claims are enumerated (a wholesale copy the proxy can't
    * differentiate).
    */
   probeShapeRelayUniform(name, args) {
@@ -664,7 +741,7 @@ class OwnerRelay extends RelayLink {
     if (this.host.rlsMetadata().policies.some((policy) => policy.on === "read" && policy.table === base.table)) {
       return false;
     }
-    if (this.shapeColumnsMasked(base.table, base.columns)) {
+    if (this.tableHasAnyMask(base.table)) {
       return false;
     }
     const baseWhere = stableStringify(base.effectiveWhere);
@@ -702,17 +779,18 @@ class OwnerRelay extends RelayLink {
     });
     return matches && !enumerated;
   }
-  /** Whether any column the shape projects from `table` is masked — a masked value is identity-dependent, so the shape can't be relay-uniform. */
-  shapeColumnsMasked(table, columns) {
-    const masked = this.host.maskMetadata().columns.filter((entry) => entry.table === table);
-    if (masked.length === 0) {
-      return false;
-    }
-    if (columns === void 0) {
-      return true;
-    }
-    const projected = new Set(columns);
-    return masked.some((entry) => projected.has(entry.column));
+  /**
+   * Whether `table` has ANY masked column defined (L7). Deliberately conservative:
+   * we disqualify a shape from relay-multicast if its table declares any mask at
+   * all, even when the current query doesn't project the masked column. A masked
+   * value is identity-dependent, and keying uniformity off the *projected* set
+   * meant a later column addition (or a `select` change) could silently widen a
+   * cohort to include an identity-dependent value. Refusing on any table-level
+   * mask removes that footgun; the cost is a few extra shapes falling back to the
+   * per-identity path, which is always correct.
+   */
+  tableHasAnyMask(table) {
+    return this.host.maskMetadata().columns.some((entry) => entry.table === table);
   }
 }
 class RelayMember extends RelayLink {
@@ -861,13 +939,19 @@ class RelayMember extends RelayLink {
         if (memo?.cursor !== poke.fromCursor || memo.epoch !== poke.epoch || shapeRoutingKey(sub.name, sub.args) !== routingKey) {
           continue;
         }
-        const frames = buildPokeFrames([{ rowsPatch: poke.rowsPatch, shapeId: subId }], {
-          baseCheckpoint: void 0,
-          checkpoint: poke.checkpoint,
-          epoch: poke.epoch,
-          lastMutationId: void 0,
-          pokeId: this.host.nextPokeId()
-        });
+        const frames = buildPokeFrames(
+          [{ rowsPatch: poke.rowsPatch, shapeId: subId }],
+          {
+            baseCheckpoint: void 0,
+            checkpoint: poke.checkpoint,
+            epoch: poke.epoch,
+            lastMutationId: void 0,
+            pokeId: this.host.nextPokeId()
+          },
+          // `poke.rowsPatch` was wire-encoded by the owner before it crossed
+          // the hub — don't double-encode it here.
+          { preEncoded: true }
+        );
         for (const frame of frames) {
           trySendFrame(ws, frame);
         }
@@ -4651,8 +4735,12 @@ class ShardDO {
    * subscriber counts are folded live from each socket's attachment via
    * {@link summarizeFanoutTopics}; the running per-path cost counters are the
    * in-memory {@link ShardDO.fanout} tallies, sharing `metrics.sinceMs` as the
-   * "since this instance woke" epoch. Read-only: touches no SQLite and mutates
-   * no socket state.
+   * "since this instance woke" epoch. Touches no SQLite and mutates no socket
+   * state; it does call `relay.relayCount()`, which advances the promotion
+   * latch — safe here because that transition is a pure, monotonic function of
+   * the live socket count (DOs are single-threaded), so a metrics poll only ever
+   * drives the latch to the same state the routing path would compute for the
+   * same count, never a divergent one.
    */
   collectFanoutMetrics() {
     const summary = summarizeFanoutTopics(this.state.getWebSockets().map((ws) => this.readAttachment(ws)));

package/dist/packem_shared/{compileWhereSql-CXrhFA3G.mjs → compileWhereSql-MW_Lk8nJ.mjs}

@@ -11,9 +11,10 @@ const isOperatorObject = (value) => {
   const keys = Object.keys(value);
   return keys.length > 0 && keys.every((key) => OPERATOR_KEY_SET.has(key));
 };
+const escapeLikeTerm = (value) => typeof value === "string" ? value.replaceAll(/[\\%_]/g, (character) => `\\${character}`) : value;
 const compileContains = (reference, value, strategy) => {
-  const term = sql`${strategy.serialize(value)}`;
-  return strategy.likeContains ? strategy.likeContains(reference, term) : sql`${reference} LIKE '%' || ${term} || '%'`;
+  const term = sql`${strategy.serialize(escapeLikeTerm(value))}`;
+  return strategy.likeContains ? strategy.likeContains(reference, term) : sql`${reference} LIKE '%' || ${term} || '%' ESCAPE '\\'`;
 };
 const compileComparator = (reference, operator, comparator, value, strategy) => {
   if (value === null) {

package/dist/packem_shared/{ctx-db-shapes-BQapRFjB.mjs → ctx-db-shapes-0RaIOy7J.mjs}

@@ -1,7 +1,7 @@
 import { sql } from 'drizzle-orm';
 import { r as runDrizzle } from './do-exec-5eQy5cEi.mjs';
 import { D as DOC_COLUMN, r as rowToDocument, j as jsonPathSql } from './do-sql-BCHCWtrD.mjs';
-import { compileWhereSql } from './compileWhereSql-CXrhFA3G.mjs';
+import { compileWhereSql } from './compileWhereSql-MW_Lk8nJ.mjs';
 import { s as serializeSqlValue } from './serialize-sql-BlRUoiQe.mjs';
 
 const shapeWhereStrategy = { fieldRef: jsonPathSql, serialize: serializeSqlValue };

package/dist/packem_shared/{isSourceDue-BMTJv65e.mjs → isSourceDue-9mJRJ9Ld.mjs}

@@ -1,4 +1,4 @@
-import { runExternalSourceTick } from './materializeExternalRows-uKBx9H0s.mjs';
+import { runExternalSourceTick } from './materializeExternalRows-Bj6EXy50.mjs';
 
 const liftSourceId = (row, options = {}) => {
   const { idColumn = "id", map } = options;

package/dist/packem_shared/{materializeExternalRows-uKBx9H0s.mjs → materializeExternalRows-Bj6EXy50.mjs}

@@ -1,5 +1,5 @@
 import { applyCdcChanges } from './CDC_LOG_TABLE-DSycmnDf.mjs';
-import { s as selectShapeRows } from './ctx-db-shapes-BQapRFjB.mjs';
+import { s as selectShapeRows } from './ctx-db-shapes-0RaIOy7J.mjs';
 import { diffExternalSource, projectExternalSourceRow } from './diffExternalSource-Cx9HUPJj.mjs';
 import { stableStringify } from './stableStringify-MydiuScU.mjs';
 

package/dist/packem_shared/{serveRelationFanout-EZLD9-O3.mjs → serveRelationFanout-BuSmWawx.mjs}

@@ -1,4 +1,4 @@
-import { RELATION_FUNCTION_PREFIX } from './ADMIN_FUNCTIONS-fMl1vyt1.mjs';
+import { RELATION_FUNCTION_PREFIX } from './ADMIN_FUNCTIONS-BvGiv2u6.mjs';
 
 const serveRelationFanout = async (schema, database, functionPath, args) => {
   const table = typeof args["table"] === "string" ? args["table"] : "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/do",
-  "version": "1.0.0-alpha.16",
+  "version": "1.0.0-alpha.18",
   "description": "Lunora Durable Objects: ShardDO (SQLite, OCC, hibernated WebSocket subscriptions) and SessionDO",
   "keywords": [
     "cloudflare",