@mcp-b/do-runtime 0.3.6 → 0.5.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import { a as hasUserErrorDetail, c as setUserErrorDetail, d as tryCurrentSlice, f as CanceledError, i as captureGateStack, m as OutputGate, n as IoContext, o as isExceptionFromInputGateBroken, p as InputGate, r as atCheckpointEnd, s as requireInputLock, t as BrokenActorError, u as tryCurrentIoContext } from "./chunks/io-context-RmmjNtwm.js";
 import { RpcTarget as RpcTarget$1 } from "./cloudflare-workers.js";
-import { a as getInt64, c as isNull, i as getBlob, o as getText, r as SqliteDatabase, s as hasCurrentSqliteTable } from "./chunks/sqlite-DFg92Tgt.js";
+import { a as SqliteDatabase, c as getText, l as hasCurrentSqliteTable, o as getBlob, s as getInt64, t as ensureRuntimeStorageVersion, u as isNull } from "./chunks/sqlite-migrations-DsWmLP_B.js";
 import { ALARM_RETRY_MAX_TRIES, ALARM_RETRY_START_SECONDS, AlarmScheduler, RETRY_BACKOFF_MAX, RETRY_JITTER_FACTOR, alarmRetryDelayMs } from "./server/alarm-scheduler.js";
 import { deserialize, serialize } from "@ungap/structured-clone";
 import { RpcTarget, newMessagePortRpcSession } from "capnweb";
@@ -999,14 +999,24 @@ function notSerializableType(value) {
 *     `abstract` in the types — JSG nested types have no JS constructor — so the
 *     faithful shape is a constructor that refuses. `sql.Cursor` exists for
 *     `instanceof`, which is all upstream exposes it for.
-*  3. **The regulator is ported whole; what is missing is the authorizer that
-*     calls it.** All three callbacks are here and none of them needed the
+*  3. **The regulator is ported whole, and that is not the whole authorizer.**
+*     Four of its five members are here as callbacks, and none needed the
 *     authorizer to compute anything — `isAllowedName` is a prefix test,
-*     `isAllowedTrigger` is `return true`, `allowTransactions` throws. What the
-*     authorizer supplied was the *identifiers*, not the decisions. With no
-*     authorizer the statement text is the only source, so `exec` tokenizes it
+*     `isAllowedTrigger` is `return true`, `allowTransactions` throws,
+*     `shouldAddQueryStats` is a constant. The fifth, `onError`, is not a
+*     callback at all in this port: it is every `throw new Error(message)`
+*     below, which is all its upstream body does with a refusal message.
+*     For those, what the authorizer supplied was the *identifiers*:
+*     with none, the statement text is the only source, so `exec` tokenizes it
 *     and runs `isAllowedName` over every identifier-shaped token. That is
 *     deliberately STRICTER than upstream — see `SQL_RESERVED_PREFIX_MESSAGE`.
+*
+*     But the authorizer also makes decisions no callback ever sees, and those
+*     do NOT arrive with the regulator: `SQLITE_ATTACH` / `SQLITE_DETACH`, the
+*     `SQLITE_CREATE_TEMP_*` family and the `temp` schema, `SQLITE_PRAGMA`, and
+*     the `SQLITE_CREATE_VTABLE` module list. Each is refused from the text in
+*     `refuseUnauthorizedForms` and `requireAllowedPragmas`. `SQLITE_FUNCTION`
+*     is the one still unported — see the README divergence row.
 *  4. **`ingest` stays at upstream's SQLite seam.** `SqliteDatabase.ingest()`
 *     executes every complete statement and returns the partial tail, using the
 *     same compiled boundaries and regulator as `exec`.
@@ -1039,8 +1049,15 @@ var SQL_RESERVED_PREFIX_MESSAGE = "not authorized: a SQL statement may not name
 * `SQLITE_SAVEPOINT`. The same set `util/sqlite.ts` classifies, read here from
 * the leading keyword because the untrusted path has to refuse them before the
 * trusted one applies them.
+*
+* `;` counts as leading trivia here and in every other leading-keyword refusal
+* below. A statement boundary comes from the backend, and `node:sqlite` reports
+* an empty leading statement as part of the span it compiled: the `sourceSQL`
+* for `;ATTACH ...` is the whole string, so an anchor of `^\s*` would read the
+* keyword as `;` and let the compiled ATTACH through. The browser backend cuts
+* the same input at the first `;` and refuses the empty statement instead.
 */
-var TRANSACTION_CONTROL = /^\s*(?:BEGIN|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i;
+var TRANSACTION_CONTROL = /^[\s;]*(?:BEGIN|COMMIT|END|ROLLBACK|SAVEPOINT|RELEASE)\b/i;
 /** Cheap pre-test, so the tokenizer below runs only on a statement that could fail it. */
 var RESERVED_PREFIX_HINT = /_cf_/i;
 /** A SQL identifier. Double-quoted and bracketed forms are still identifiers, so only the
@@ -1057,7 +1074,15 @@ var IDENTIFIER = /[A-Za-z_][A-Za-z0-9_$]*/g;
 */
 var NOT_CODE = /'(?:[^']|'')*'|--[^\n]*|\/\*[\s\S]*?\*\//g;
 /**
-* ← `SqlStorageRegulator` (`sql.h:15-22`, `sql.c++:143-173`), whole.
+* Comments are never code. String literals STAY, for both of this regex's callers: pragma
+* arguments may be quoted, and SQLite's misquoting feature reads a single-quoted string as an
+* identifier — `CREATE TABLE 'temp'.t(x)` really creates a temp-schema table — so the checks
+* that read identifier positions must still see it. `NOT_CODE` blanks literals, which is right
+* for the token scans and would be a bypass for these callers.
+*/
+var NOT_COMMENT = /--[^\n]*|\/\*[\s\S]*?\*\//g;
+/**
+* ← `SqlStorageRegulator` (`sql.h:15-22`, `sql.c++:141-165`), whole.
 *
 * Upstream reaches these through the SQLite authorizer while a statement is
 * being compiled. `exec` calls them from the statement text instead, which is
@@ -1119,6 +1144,340 @@ function refuseTransactionControl(statement) {
 	if (TRANSACTION_CONTROL.test(code)) SqlStorageRegulator.allowTransactions();
 }
 /**
+* ← the message a `SQLITE_DENY` from the authorizer surfaces to JavaScript,
+* byte-identical so a caller matching on it ports unchanged.
+*/
+var SQL_NOT_AUTHORIZED_MESSAGE = "not authorized: SQLITE_AUTH";
+/**
+* The forms neither the regulator nor any callback sees: the authorizer's own
+* action codes, plus `VACUUM`, which SQLite itself refuses by precondition.
+*
+* Porting `SqlStorageRegulator` whole (point 3 in the file header) carried over its members, but
+* not the authorizer's own action codes: `SQLITE_ATTACH`, `SQLITE_DETACH`, `SQLITE_CREATE_TEMP_*`
+* and `SQLITE_CREATE_VTABLE` consult no callback, so nothing here refused them. Every form below
+* was measured on real workerd through the conformance oracle, not inferred.
+*
+* `ATTACH` and `DETACH` are also the isolation boundary rather than a fidelity detail: both
+* backends open a real file, so on `node:sqlite` an `ATTACH` reads another actor's database and
+* a `VACUUM INTO` writes anywhere the process can. The reserved-name scan does not cover it,
+* because that scan tokenizes the SUBMITTED statement — `other._cf_KV` is caught, and every
+* application table in the same attached database is not.
+*/
+var DATABASE_ATTACHMENT = /^[\s;]*(?:ATTACH|DETACH)\b/i;
+/**
+* ← the `SQLITE_CREATE_TEMP_*` denials (`sqlite.c++:1323`) and the `dbName == temp` rule
+* (`sqlite.c++:1073`), which permits a temp-schema database name only `READ` and `UPDATE`.
+* Upstream's own reason to deny them applies here unchanged: a temporary table makes SQLite
+* open a separate temporary file that the storage engine knows nothing about.
+*
+* Two spellings, one refusal each by its own upstream path: `CREATE TEMP TABLE t(x)` is the
+* keyword and hits the action codes; `CREATE TABLE temp.t(x)` is the schema qualifier and hits
+* the `dbName` rule — and the qualifier was the live gap, where the table was created, written
+* and read back here while workerd refused it outright. The qualifier accepts every quoting
+* SQLite does, single quotes included, with or without whitespace after the keyword (measured:
+* workerd refuses `CREATE TABLE 'temp'.t(x)` and `CREATE TABLE"temp".t(x)` the same way), and
+* is matched only in the object-name position, so an application table merely NAMED `tempest`
+* or `temporary_log` is untouched. The keyword spelling needs no qualifier arm of its own here:
+* `TEMP_SCHEMA` already refuses every `CREATE TEMP…` before this pattern is consulted.
+*
+* The rest of the `dbName` rule goes unported on purpose: with no way to create a temp-schema
+* object, `INSERT`/`DELETE`/`DROP` against one die in SQLite as `no such table`, and the one
+* silent form measures identically — workerd allows `DROP TABLE IF EXISTS temp.ghost` too.
+*/
+var TEMP_SCHEMA = /^[\s;]*CREATE\s+(?:TEMP|TEMPORARY)\b/i;
+var TEMP_QUALIFIED = /^[\s;]*CREATE\s+(?:UNIQUE\s+|VIRTUAL\s+)?(?:TABLE|VIEW|TRIGGER|INDEX)\s*(?:IF\s+NOT\s+EXISTS\s*)?(?:"temp"|'temp'|`temp`|\[temp\]|temp)\s*\./i;
+/**
+* ← `SQLITE_CREATE_VTABLE` (`sqlite.c++:1298-1316`): a virtual table is native-code callbacks, so
+* upstream allows exactly four modules — FTS5 and its `fts5vocab` companion, R*Tree and its
+* `rtree_i32` variant — and denies every other module SQLite was compiled with.
+*
+* `dbstat` is why this is not only fidelity: it reports a row per table with page counts and
+* byte sizes, so `SELECT name FROM d` enumerates `_cf_KV` and the rest of the runtime's own
+* tables without the statement ever naming them — around `requireAllowedNames`, which can only
+* see the text it was given.
+*
+* The table name and the module accept every quoting SQLite does — double quotes, backticks,
+* brackets, and the misquoting feature's single-quoted string, with or without whitespace
+* before them — because the module has to be read from PAST the name, and a guessed name
+* boundary is a bypass in both directions: an unparseable name skipped the check, and
+* `"a USING fts5 b" USING dbstat` read its module out of the quoted name. Measured: workerd
+* refuses both, refuses `CREATE VIRTUAL TABLE"d"USING dbstat`, resolves `USING "dbstat"` to
+* the same denial, and allows `USING 'fts5'`. A `CREATE VIRTUAL TABLE` whose module the
+* pattern cannot read is refused outright — the deliberately stricter direction the
+* unparseable-PRAGMA fallback below already takes.
+*/
+var SQL_IDENTIFIER_SOURCE = /"(?:[^"]|"")*"|'(?:[^']|'')*'|`(?:[^`]|``)*`|\[[^\]]*\]|[A-Za-z_\u0080-\uffff][A-Za-z0-9_$\u0080-\uffff]*/.source;
+var VIRTUAL_TABLE = /^[\s;]*CREATE\s+VIRTUAL\s+TABLE\b/i;
+var VIRTUAL_TABLE_MODULE = new RegExp(String.raw`^[\s;]*CREATE\s+VIRTUAL\s+TABLE\s*(?:IF\s+NOT\s+EXISTS\s*)?(?:${SQL_IDENTIFIER_SOURCE})\s*(?:\.\s*(?:${SQL_IDENTIFIER_SOURCE})\s*)?USING\s*(${SQL_IDENTIFIER_SOURCE})`, "i");
+var ALLOWED_VIRTUAL_TABLE_MODULES = /* @__PURE__ */ new Set([
+	"fts5",
+	"fts5vocab",
+	"rtree",
+	"rtree_i32"
+]);
+/**
+* `VACUUM` has no action code of its own, so the authorizer never sees it. What refuses it
+* upstream is SQLite's own `cannot VACUUM from within a transaction` precondition, against the
+* transaction a Durable Object always has open — and that message is what the oracle returned,
+* for `VACUUM`, `VACUUM main` and `VACUUM INTO` alike. Byte-identical for the same reason
+* `SQL_NOT_AUTHORIZED_MESSAGE` is: a caller matching on it ports unchanged.
+*
+* Refused here unconditionally rather than by transaction state, which is a divergence only in
+* mechanism: this runtime never runs a statement where upstream would have allowed it.
+*/
+var VACUUM_STATEMENT = /^[\s;]*VACUUM\b/i;
+var SQL_VACUUM_REFUSED_MESSAGE = "cannot VACUUM from within a transaction: SQLITE_ERROR";
+/** Refuse the authorizer-only forms against one SQLite-decided statement boundary. */
+function refuseUnauthorizedForms(statement) {
+	const code = statement.replace(NOT_COMMENT, " ");
+	if (VACUUM_STATEMENT.test(code)) throw new Error(SQL_VACUUM_REFUSED_MESSAGE);
+	if (DATABASE_ATTACHMENT.test(code) || TEMP_SCHEMA.test(code) || TEMP_QUALIFIED.test(code)) throw new Error(SQL_NOT_AUTHORIZED_MESSAGE);
+	if (VIRTUAL_TABLE.test(code)) {
+		const moduleName = VIRTUAL_TABLE_MODULE.exec(code)?.[1];
+		if (moduleName === void 0 || !ALLOWED_VIRTUAL_TABLE_MODULES.has(unquoted(moduleName).toLowerCase())) throw new Error(SQL_NOT_AUTHORIZED_MESSAGE);
+	}
+}
+/** Cheap pre-test; `PRAGMA` and the `pragma_` functions both contain it. */
+var PRAGMA_HINT = /pragma/i;
+/** `PRAGMA [schema.]name`, then `= value`, `(argument)`, or nothing. */
+var PRAGMA_STATEMENT = /^[\s;]*PRAGMA\s+(?:[A-Za-z_][A-Za-z0-9_$]*\s*\.\s*)?([A-Za-z_][A-Za-z0-9_$]*)(?:\s*=\s*([\s\S]+?)|\s*\(\s*([\s\S]*?)\s*\))?\s*;?\s*$/i;
+/**
+* ← `ALLOWED_PRAGMAS` (`util/sqlite.c++:543-571`) and `PragmaSignature` (`:528-535`),
+* verbatim. `table_list`, `table_info`, and `table_xinfo` are special-cased
+* ahead of the table in the authorizer, exactly as upstream's `SQLITE_PRAGMA`
+* case does (`util/sqlite.c++:1194-1273`).
+*/
+var ALLOWED_PRAGMAS = /* @__PURE__ */ new Map([
+	["data_version", "NO_ARG"],
+	["page_size", "NO_ARG"],
+	["case_sensitive_like", "BOOLEAN"],
+	["foreign_keys", "BOOLEAN"],
+	["defer_foreign_keys", "BOOLEAN"],
+	["ignore_check_constraints", "BOOLEAN"],
+	["legacy_alter_table", "BOOLEAN"],
+	["recursive_triggers", "BOOLEAN"],
+	["reverse_unordered_selects", "BOOLEAN"],
+	["foreign_key_check", "OPTIONAL_OBJECT_NAME"],
+	["foreign_key_list", "OBJECT_NAME"],
+	["index_info", "OBJECT_NAME"],
+	["index_list", "OBJECT_NAME"],
+	["index_xinfo", "OBJECT_NAME"],
+	["quick_check", "NULL_NUMBER_OR_OBJECT_NAME"],
+	["optimize", "NULL_OR_NUMBER"]
+]);
+/** Upstream compares the eight literal forms as PREFIXES, case-insensitively. */
+var BOOLEAN_PRAGMA_VALUE = /^(?:true|false|yes|no|on|off|1|0)/i;
+/**
+* The pragmas SQLite ships (https://www.sqlite.org/pragma.html), so a
+* `pragma_X` identifier can be told apart: `X` here means the table-valued
+* pragma function and follows the allowlist; any other `pragma_`-prefixed
+* identifier is an ordinary application name, which upstream's authorizer
+* distinguishes by resolution and the conformance suite pins.
+*/
+var SQLITE_PRAGMA_NAMES = /* @__PURE__ */ new Set([
+	"analysis_limit",
+	"application_id",
+	"auto_vacuum",
+	"automatic_index",
+	"busy_timeout",
+	"cache_size",
+	"cache_spill",
+	"case_sensitive_like",
+	"cell_size_check",
+	"checkpoint_fullfsync",
+	"collation_list",
+	"compile_options",
+	"data_version",
+	"database_list",
+	"defer_foreign_keys",
+	"encoding",
+	"foreign_key_check",
+	"foreign_key_list",
+	"foreign_keys",
+	"freelist_count",
+	"full_column_names",
+	"fullfsync",
+	"function_list",
+	"hard_heap_limit",
+	"ignore_check_constraints",
+	"incremental_vacuum",
+	"index_info",
+	"index_list",
+	"index_xinfo",
+	"integrity_check",
+	"journal_mode",
+	"journal_size_limit",
+	"legacy_alter_table",
+	"legacy_file_format",
+	"locking_mode",
+	"max_page_count",
+	"mmap_size",
+	"module_list",
+	"optimize",
+	"page_count",
+	"page_size",
+	"pragma_list",
+	"query_only",
+	"quick_check",
+	"read_uncommitted",
+	"recursive_triggers",
+	"reverse_unordered_selects",
+	"schema_version",
+	"secure_delete",
+	"short_column_names",
+	"shrink_memory",
+	"soft_heap_limit",
+	"synchronous",
+	"table_info",
+	"table_list",
+	"table_xinfo",
+	"temp_store",
+	"threads",
+	"trusted_schema",
+	"user_version",
+	"wal_autocheckpoint",
+	"wal_checkpoint",
+	"writable_schema"
+]);
+/** kj's `tryParseAs` is decimal; keep the same acceptance. */
+var DECIMAL = /^[+-]?\d+$/;
+/**
+* One layer of SQL quoting, any of the four forms — a pragma argument, or the module token
+* `VIRTUAL_TABLE_MODULE` captured. Doubled inner quotes stay doubled, which cannot change a
+* verdict here: no allowlisted comparison target contains a quote character.
+*/
+function unquoted(argument) {
+	const first = argument[0];
+	const last = argument[argument.length - 1];
+	if (argument.length >= 2) {
+		if ((first === "'" || first === "\"" || first === "`") && last === first) return argument.slice(1, -1);
+		if (first === "[" && last === "]") return argument.slice(1, -1);
+	}
+	return argument;
+}
+/** ← the `SQLITE_PRAGMA` authorizer case (`util/sqlite.c++:1194-1273`), whole. */
+function isAllowedPragma(name, argument) {
+	const pragma = name.toLowerCase();
+	if (pragma === "table_list") return true;
+	if (pragma === "table_info" || pragma === "table_xinfo") {
+		if (argument === void 0) return false;
+		return SqlStorageRegulator.isAllowedName(unquoted(argument));
+	}
+	const signature = ALLOWED_PRAGMAS.get(pragma);
+	if (signature === void 0) return false;
+	switch (signature) {
+		case "NO_ARG": return argument === void 0;
+		case "BOOLEAN": return argument === void 0 || BOOLEAN_PRAGMA_VALUE.test(unquoted(argument));
+		case "OBJECT_NAME": return argument !== void 0 && SqlStorageRegulator.isAllowedName(unquoted(argument));
+		case "OPTIONAL_OBJECT_NAME": return argument === void 0 || SqlStorageRegulator.isAllowedName(unquoted(argument));
+		case "NULL_OR_NUMBER": return argument === void 0 || DECIMAL.test(argument);
+		case "NULL_NUMBER_OR_OBJECT_NAME": return argument === void 0 || DECIMAL.test(argument) || SqlStorageRegulator.isAllowedName(unquoted(argument));
+	}
+}
+/**
+* The text-level stand-in for the authorizer's `SQLITE_PRAGMA` case, against
+* one SQLite-decided statement boundary. Load-bearing beyond fidelity:
+* `user_version` is where runtime storage versioning keeps its per-file stamp
+* (`util/sqlite-migrations.ts`), and `writable_schema` would let application
+* SQL rewrite `sqlite_master` out from under the `_cf_` reservation.
+*
+* The `pragma_` table-valued functions reach the same authorizer path
+* upstream, so they follow the same allowlist here — by pragma NAME only. An
+* argument the text cannot see (a string literal or a binding) goes unchecked
+* where upstream's authorizer sees the resolved value; a `_cf_` name smuggled
+* that way reads schema whose shape is public source anyway, while identifier
+* arguments stay covered by `requireAllowedNames`. The README divergence row
+* records this.
+*/
+function requireAllowedPragmas(statement) {
+	if (!PRAGMA_HINT.test(statement)) return;
+	const code = statement.replace(NOT_COMMENT, " ");
+	const direct = code.match(PRAGMA_STATEMENT);
+	if (direct !== null) {
+		const [, name = "", assigned, called] = direct;
+		const argument = (assigned ?? called)?.trim();
+		if (!isAllowedPragma(name, argument === "" ? void 0 : argument)) throw new Error(SQL_NOT_AUTHORIZED_MESSAGE);
+		return;
+	}
+	if (/^[\s;]*PRAGMA\b/i.test(code)) throw new Error(SQL_NOT_AUTHORIZED_MESSAGE);
+	const literalFree = code.replace(NOT_CODE, " ");
+	for (const [token] of literalFree.matchAll(IDENTIFIER)) {
+		if (token.length <= 7 || token.slice(0, 7).toLowerCase() !== "pragma_") continue;
+		const name = token.slice(7).toLowerCase();
+		if (!SQLITE_PRAGMA_NAMES.has(name)) continue;
+		if (name !== "table_list" && name !== "table_info" && name !== "table_xinfo" && !ALLOWED_PRAGMAS.has(name)) throw new Error(SQL_NOT_AUTHORIZED_MESSAGE);
+	}
+}
+/** Everything the untrusted path refuses at one statement boundary. */
+function regulateUntrustedStatement(statement) {
+	refuseTransactionControl(statement);
+	refuseUnauthorizedForms(statement);
+	requireAllowedPragmas(statement);
+}
+/** ← `JSG_INHERIT_INTRINSIC(v8::kIteratorPrototype)` (`jsg/iterator.h:1044`). */
+var IteratorPrototype = Object.getPrototypeOf(Object.getPrototypeOf([][Symbol.iterator]()));
+/**
+* ← the `JSG_ITERATOR` types (`jsg/iterator.h:1036-1050`): `next` and
+* self-iterability on `%IteratorPrototype%` — which is what carries the ES
+* iterator helpers; `raw().toArray()` is what Drizzle's durable-sqlite driver
+* calls — and NOTHING else. No `return`, no `throw` (only the async variant
+* registers `return_`, `:1069-1085`), so `IteratorClose` after a `break`, a
+* partial destructuring, or a `take()` is a no-op and a retained iterator
+* resumes. Results are `JSG_STRUCT(done, value)` in that key order
+* (`jsg/iterator.h:706-710`).
+*/
+var RawIterator = class {
+	#pull;
+	constructor(pull) {
+		this.#pull = pull;
+	}
+	next() {
+		const raw = this.#pull();
+		if (raw === void 0) return {
+			done: true,
+			value: void 0
+		};
+		return {
+			done: false,
+			value: asRawRow([...raw])
+		};
+	}
+	[Symbol.iterator]() {
+		return this;
+	}
+};
+Object.setPrototypeOf(RawIterator.prototype, IteratorPrototype);
+Object.defineProperty(RawIterator.prototype, Symbol.toStringTag, {
+	value: "RawIterator",
+	configurable: true
+});
+/** ← `RowIterator`, shaped exactly as `RawIterator` above. */
+var RowIterator = class {
+	#pull;
+	constructor(pull) {
+		this.#pull = pull;
+	}
+	next() {
+		const row = this.#pull();
+		if (row === void 0) return {
+			done: true,
+			value: void 0
+		};
+		return {
+			done: false,
+			value: row
+		};
+	}
+	[Symbol.iterator]() {
+		return this;
+	}
+};
+Object.setPrototypeOf(RowIterator.prototype, IteratorPrototype);
+Object.defineProperty(RowIterator.prototype, Symbol.toStringTag, {
+	value: "RowIterator",
+	configurable: true
+});
+/**
 * ← `SqlStorage::Cursor`.
 *
 * `rowsRead` is the one counter that is not upstream's. Upstream reads
@@ -1130,20 +1489,30 @@ function refuseTransactionControl(statement) {
 * undercounts any query that scans more rows than it returns.
 */
 var Cursor = class {
-	columnNames;
+	#columnNames;
 	#rawRows;
 	#rowsWritten;
 	#position = 0;
 	constructor(state) {
 		if (state === void 0) throw new Error(CURSOR_NOT_CONSTRUCTIBLE_MESSAGE);
-		this.columnNames = state.columnNames;
+		this.#columnNames = state.columnNames;
 		this.#rawRows = state.rawRows;
 		this.#rowsWritten = state.rowsWritten;
 	}
+	/**
+	* ← `JSG_READONLY_PROTOTYPE_PROPERTY(columnNames)` (`sql.h:210`): a
+	* prototype accessor, not an own field, so a cursor JSON-stringifies to `{}`.
+	*/
+	get columnNames() {
+		return this.#columnNames;
+	}
 	/** ← `Cursor::next`, whose `RowIterator::Next` is this exact shape. */
 	next() {
 		const row = this.#nextRow();
-		if (row === void 0) return { done: true };
+		if (row === void 0) return {
+			done: true,
+			value: void 0
+		};
 		return {
 			done: false,
 			value: row
@@ -1168,45 +1537,16 @@ var Cursor = class {
 		}
 		return row;
 	}
-	/** ← `Cursor::raw`, which shares this cursor's position rather than restarting. */
+	/**
+	* ← `Cursor::raw`, which shares this cursor's position rather than
+	* restarting. The iterator's shape is `RawIterator`'s whole doc comment.
+	*/
 	raw() {
-		const iterator = {
-			[Symbol.iterator]() {
-				return iterator;
-			},
-			next: () => {
-				const raw = this.#nextRaw();
-				if (raw === void 0) return {
-					done: true,
-					value: void 0
-				};
-				return {
-					done: false,
-					value: asRawRow([...raw])
-				};
-			}
-		};
-		return iterator;
+		return new RawIterator(() => this.#nextRaw());
 	}
-	/** ← `JSG_ITERABLE(rows)`. */
+	/** ← `JSG_ITERABLE(rows)`, yielding through the same shared position. */
 	[Symbol.iterator]() {
-		const iterator = {
-			[Symbol.iterator]() {
-				return iterator;
-			},
-			next: () => {
-				const row = this.#nextRow();
-				if (row === void 0) return {
-					done: true,
-					value: void 0
-				};
-				return {
-					done: false,
-					value: row
-				};
-			}
-		};
-		return iterator;
+		return new RowIterator(() => this.#nextRow());
 	}
 	get rowsRead() {
 		return this.#position;
@@ -1226,12 +1566,17 @@ var Cursor = class {
 		const raw = this.#nextRaw();
 		if (raw === void 0) return void 0;
 		const row = {};
-		this.columnNames.forEach((name, index) => {
+		this.#columnNames.forEach((name, index) => {
 			row[name] = raw[index] ?? null;
 		});
 		return asRow(row);
 	}
 };
+/** ← the jsg resource-type tag every workerd API object carries (`resource.h`). */
+Object.defineProperty(Cursor.prototype, Symbol.toStringTag, {
+	value: "Cursor",
+	configurable: true
+});
 /**
 * ← `SqlStorage::Statement`, which upstream describes as "supported only for
 * backwards compatibility ... it is actually just a wrapper around `exec()`".
@@ -1261,7 +1606,7 @@ var SqlStorage = class {
 		const db = this.#owner.getSqliteDb();
 		const sqlBindings = bindings.map(toSqlBindingValue);
 		requireAllowedNames(query);
-		const result = db.run({ regulate: refuseTransactionControl }, query, ...sqlBindings);
+		const result = db.run({ regulate: regulateUntrustedStatement }, query, ...sqlBindings);
 		return new Cursor({
 			columnNames: [...result.columnNames],
 			rawRows: result.rawRows.map((row) => row.map(toSqlStorageValue)),
@@ -1294,7 +1639,7 @@ var SqlStorage = class {
 	ingest(query) {
 		requireInputLock(this.#ctx, "sql.ingest()");
 		requireAllowedNames(query);
-		return this.#owner.getSqliteDb().ingest(query, refuseTransactionControl);
+		return this.#owner.getSqliteDb().ingest(query, regulateUntrustedStatement);
 	}
 	/** ← `SqlStorage::setMaxPageCountForTest`, which is what its name says. */
 	setMaxPageCountForTest(count) {
@@ -1459,6 +1804,26 @@ var OP_PUT_ALARM = "setAlarm()";
 var OP_DELETE = "delete()";
 var OP_DELETE_ALARM = "deleteAlarm()";
 var OP_ROLLBACK = "rollback()";
+/** ← `actor-state.c++:455`, verbatim: the one message both overloads' misuse produces. */
+var PUT_OVERLOAD_MESSAGE = "put() may only be called with a single key-value pair and optional options as put(key, value, options) or with multiple key-value pairs and optional options as put(entries, options)";
+/**
+* ← the `kj::OneOf<kj::String, jsg::Dict<…>>` unwrap on put()'s first parameter: `jsg::Dict`
+* takes any JS object except an Array — functions and Maps included — and `kj::String` takes
+* everything else by coercion. A type predicate, so the overload split narrows without a cast.
+*/
+function isEntriesArgument(value) {
+	return (typeof value === "object" || typeof value === "function") && value !== null && !Array.isArray(value);
+}
+/**
+* ← the struct wrapper (`jsg/struct.h:246-258`), which is NOT the Dict wrapper: `PutOptions` is
+* all-optional fields, so `null` unwraps to default options, and any object does — arrays and
+* functions included, because the wrapper checks `IsObject()` with no Array exclusion. Only a
+* non-null primitive fails to unwrap. Measured on real workerd: `put({k: 1}, null)`, `…, [])`
+* and `…, function () {})` all write, and `put({k: 1}, "v")` alone is the overload error.
+*/
+function isPutOptions(value) {
+	return value === null || typeof value === "object" || typeof value === "function";
+}
 /** The key immediately after `k` in byte order is `k` plus this. */
 var NULL_CHARACTER = "\0";
 /** ← the `0xff` upstream strips from the tail of a prefix, in UTF-16 code units. */
@@ -1662,10 +2027,11 @@ var DurableObjectStorageOperations = class {
 	}
 	put(keyOrEntries, valueOrOptions, maybeOptions) {
 		requireInputLock(this.ctx, OP_PUT);
-		if (typeof keyOrEntries === "string") {
+		if (!isEntriesArgument(keyOrEntries)) {
 			if (valueOrOptions === void 0) throw new TypeError("put() called with undefined value.");
-			return this.#putOne(keyOrEntries, valueOrOptions, { ...maybeOptions });
+			return this.#putOne(`${keyOrEntries}`, valueOrOptions, { ...maybeOptions });
 		}
+		if (valueOrOptions !== void 0 && !isPutOptions(valueOrOptions)) throw new TypeError(PUT_OVERLOAD_MESSAGE);
 		return this.#putMultiple(keyOrEntries, { ...valueOrOptions });
 	}
 	delete(keyOrKeys, maybeOptions) {
@@ -5827,9 +6193,13 @@ var ActorContainerImpl = class {
 * `state`.
 */
 async function createActorContainer(options) {
-	const db = new SqliteDatabase(await options.ports.sql.open(ACTOR_DATABASE_NAME));
+	const actorDb = await options.ports.sql.open(ACTOR_DATABASE_NAME);
+	ensureRuntimeStorageVersion(actorDb, ACTOR_DATABASE_NAME);
+	const db = new SqliteDatabase(actorDb);
 	if (options.facet !== void 0) return new ActorContainerImpl(options, db, void 0, options.facet.tree);
-	const tree = new ActorTree(await options.ports.sql.open(FACET_DATABASE_NAME), options.ports.facets);
+	const facetDb = await options.ports.sql.open(FACET_DATABASE_NAME);
+	ensureRuntimeStorageVersion(facetDb, FACET_DATABASE_NAME);
+	const tree = new ActorTree(facetDb, options.ports.facets);
 	return new ActorContainerImpl(options, db, tree, tree);
 }
 //#endregion