@mooloo-ai/eutaxy 0.0.0-stage → 0.2.0

package/dist/cloudflare.mjs

@@ -0,0 +1,847 @@
+import { i as canonicalJson } from "./src-s6uYyC0B.mjs";
+import { a as Run, d as validateScenario, i as CrashSignal, l as settleOn, m as getPath, o as installScriptedFetch, s as patchGlobals, t as explore, u as defaultBounds } from "./src-BrCsF5RZ.mjs";
+import { t as describeVerdict } from "./verdict-evEM5Gxx.mjs";
+import { n as cloudflareRegressionTest } from "./src-B66we2mG.mjs";
+// packages/cloudflare/src/check.ts
+/** Explore a scenario on a platform and return its verdict. */
+function check(spec, platform, options = { seed: spec.name }) {
+	return explore(spec, platform, options);
+}
+/** For use from a test: passes only when the scenario is BOUNDED. */
+async function expectHolds(spec, platform, options) {
+	const verdict = await check(spec, platform, options);
+	if (verdict.kind !== "BOUNDED") throw new Error(describeVerdict(verdict));
+}
+// packages/cloudflare/src/json.ts
+/** Reduce any runtime value to JSON data for the effect log; never throws. */
+function toJson(value, depth = 0) {
+	if (value === null || value === void 0) return null;
+	switch (typeof value) {
+		case "boolean":
+		case "string": return value;
+		case "number": return Number.isFinite(value) ? value : String(value);
+		case "bigint": return value.toString();
+		case "object": {
+			if (depth > 8) return "<nested>";
+			if (Array.isArray(value)) return value.map((v) => toJson(v, depth + 1));
+			if (value instanceof ArrayBuffer) return `<bytes ${value.byteLength}>`;
+			if (ArrayBuffer.isView(value)) return `<bytes ${value.byteLength}>`;
+			if (value instanceof Date) return value.toISOString();
+			const out = {};
+			for (const k of Object.keys(value).sort()) out[k] = toJson(value[k], depth + 1);
+			return out;
+		}
+		default: return `<${typeof value}>`;
+	}
+}
+// packages/cloudflare/src/d1.ts
+/**
+* The D1 binding proxy. Every statement execution is an effect point: the
+* engine decides the fault, the real Miniflare-backed D1 performs the query,
+* and the log records call, result and fault in the documented shape.
+*/
+const WRITE = [
+	"crash_before",
+	"crash_after",
+	"ambiguous",
+	"error"
+];
+const READ = [
+	"crash_before",
+	"crash_after",
+	"error"
+];
+function point(ctx, target, op, args, allowed) {
+	return {
+		invocation: ctx.currentInvocation(),
+		target,
+		op,
+		args,
+		allowed
+	};
+}
+function metaOf(result) {
+	return {
+		changes: result.meta.changes ?? 0,
+		lastRowId: result.meta.last_row_id ?? null
+	};
+}
+var StatementProxy = class StatementProxy {
+	real;
+	target;
+	ctx;
+	sql;
+	params;
+	constructor(real, target, ctx, sql, params) {
+		this.real = real;
+		this.target = target;
+		this.ctx = ctx;
+		this.sql = sql;
+		this.params = params;
+	}
+	/** The real statement, for `batch()`. */
+	get statement() {
+		return this.real;
+	}
+	args() {
+		return {
+			sql: this.sql,
+			params: toJson(this.params)
+		};
+	}
+	bind(...values) {
+		return new StatementProxy(this.real.bind(...values), this.target, this.ctx, this.sql, values);
+	}
+	run() {
+		return this.ctx.hooks.effect(point(this.ctx, this.target, "run", this.args(), WRITE), () => this.real.run(), (r) => metaOf(r));
+	}
+	all() {
+		return this.ctx.hooks.effect(point(this.ctx, this.target, "all", this.args(), READ), () => this.real.all(), (r) => ({
+			rows: r.results.length,
+			changes: r.meta.changes ?? 0
+		}));
+	}
+	first(colName) {
+		return this.ctx.hooks.effect(point(this.ctx, this.target, "first", {
+			...this.args(),
+			column: colName ?? null
+		}, READ), () => colName === void 0 ? this.real.first() : this.real.first(colName), (r) => ({ row: toJson(r) }));
+	}
+	raw(options) {
+		return this.ctx.hooks.effect(point(this.ctx, this.target, "raw", this.args(), READ), () => options ? this.real.raw(options) : this.real.raw(), (r) => ({ rows: r.length }));
+	}
+};
+/** Wrap a D1 binding. Methods not modelled fall through to the real binding and mark the run unsupported. */
+function proxyD1(real, binding, ctx) {
+	const target = `D1:${binding}`;
+	const modelled = {
+		prepare(sql) {
+			return new StatementProxy(real.prepare(sql), target, ctx, sql, []);
+		},
+		batch(statements) {
+			const unwrapped = statements.map((s) => s instanceof StatementProxy ? s.statement : s);
+			const args = { statements: statements.map((s) => s instanceof StatementProxy ? {
+				sql: s.sql,
+				params: toJson(s.params)
+			} : "<unproxied statement>") };
+			return ctx.hooks.effect(point(ctx, target, "batch", args, WRITE), () => real.batch(unwrapped), (rs) => ({
+				changes: rs.reduce((n, r) => n + (r.meta.changes ?? 0), 0),
+				statements: rs.length
+			}));
+		},
+		exec(sql) {
+			return ctx.hooks.effect(point(ctx, target, "exec", { sql }, WRITE), () => real.exec(sql), (r) => ({
+				count: r.count,
+				duration: 0
+			}));
+		}
+	};
+	return new Proxy(real, { get(obj, prop, receiver) {
+		if (prop in modelled) return modelled[prop];
+		const value = Reflect.get(obj, prop, receiver);
+		if (typeof value === "function") {
+			ctx.hooks.unsupported(`D1 ${binding}.${String(prop)} is not modelled`);
+			return value.bind(obj);
+		}
+		return value;
+	} });
+}
+/**
+* Statements in a schema file. Splits on semicolons outside string literals,
+* quoted identifiers and comments, and keeps CREATE TRIGGER bodies (and CASE
+* expressions) whole by tracking BEGIN/CASE ... END nesting.
+*/
+function splitSql(sql) {
+	const out = [];
+	let cur = "";
+	let depth = 0;
+	let i = 0;
+	const isWordChar = (c) => c !== void 0 && /[A-Za-z0-9_]/.test(c);
+	while (i < sql.length) {
+		const c = sql[i];
+		const next = sql[i + 1];
+		if (c === "-" && next === "-") {
+			while (i < sql.length && sql[i] !== "\n") i++;
+			continue;
+		}
+		if (c === "/" && next === "*") {
+			const end = sql.indexOf("*/", i + 2);
+			i = end === -1 ? sql.length : end + 2;
+			continue;
+		}
+		if (c === "'" || c === "\"" || c === "`" || c === "[") {
+			const close = c === "[" ? "]" : c;
+			let j = i + 1;
+			for (;;) {
+				const k = sql.indexOf(close, j);
+				if (k === -1) {
+					j = sql.length;
+					break;
+				}
+				if (close !== "]" && sql[k + 1] === close) {
+					j = k + 2;
+					continue;
+				}
+				j = k + 1;
+				break;
+			}
+			cur += sql.slice(i, j);
+			i = j;
+			continue;
+		}
+		if (isWordChar(c) && !isWordChar(sql[i - 1])) {
+			let j = i;
+			while (isWordChar(sql[j])) j++;
+			const word = sql.slice(i, j);
+			const upper = word.toUpperCase();
+			if (upper === "BEGIN" || upper === "CASE") depth++;
+			else if (upper === "END" && depth > 0) depth--;
+			cur += word;
+			i = j;
+			continue;
+		}
+		if (c === ";" && depth === 0) {
+			const statement = cur.trim();
+			if (statement.length > 0) out.push(statement);
+			cur = "";
+			i++;
+			continue;
+		}
+		cur += c;
+		i++;
+	}
+	const last = cur.trim();
+	if (last.length > 0) out.push(last);
+	return out;
+}
+/** Drop every user table and re-apply the schema, using the real binding (not an effect). */
+async function resetD1(real, schema) {
+	const tables = await real.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '\\_cf\\_%' ESCAPE '\\'").all();
+	for (const { name } of tables.results) await real.prepare(`DROP TABLE IF EXISTS "${name.replace(/"/g, "\"\"")}"`).run();
+	for (const statement of splitSql(schema)) await real.prepare(statement).run();
+}
+/** Every user table's rows, sorted canonically, read through the real binding (not an effect). */
+async function snapshotD1(real) {
+	const tables = await real.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '\\_cf\\_%' ESCAPE '\\' ORDER BY name").all();
+	const out = {};
+	for (const { name } of tables.results) out[name] = (await real.prepare(`SELECT * FROM "${name.replace(/"/g, "\"\"")}"`).all()).results.map((r) => toJson(r)).map((j) => [canonicalJson(j), j]).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0).map(([, j]) => j);
+	return out;
+}
+// packages/cloudflare/src/platform.ts
+const ACK = ["crash_before", "crash_after"];
+const CUT_OFF = ["cut_off"];
+function isD1$1(value) {
+	return typeof value === "object" && value !== null && typeof value.prepare === "function" && typeof value.batch === "function";
+}
+function isBindingLike(value) {
+	if (typeof value === "function") return true;
+	if (typeof value !== "object" || value === null) return false;
+	const proto = Object.getPrototypeOf(value);
+	return [...Object.getOwnPropertyNames(value), ...Object.getOwnPropertyNames(proto ?? {})].some((k) => k !== "constructor" && typeof value[k] === "function");
+}
+/** Deep-copy JSON data so a handler that mutates its message cannot leak into other runs. */
+function cloneJson(value) {
+	return JSON.parse(JSON.stringify(value));
+}
+const assumptions = [
+	"platform model: Cloudflare Queues at-least-once delivery; the first ack or retry decision per message wins; unacked messages are redelivered up to max_retries then dead-lettered",
+	"D1 statements run against Miniflare's SQLite; each run/first/all/raw/batch/exec is one effect",
+	"message.timestamp is the virtual clock's time at delivery",
+	"only D1 bindings are proxied; touching any other binding makes the run UNSUPPORTED",
+	"state invariants read a snapshot of every D1 binding named in setup, taken after the last event",
+	"work passed to ctx.waitUntil runs after the handler returns and never affects acknowledgement; a cut_off fault at that point loses work not yet started, and an effect in flight commits without its continuation"
+];
+function createCloudflarePlatform(options) {
+	const env = options.env;
+	const maxRetries = options.maxRetries ?? 3;
+	let currentInvocation = "";
+	let hooksRef = null;
+	const ctx = {
+		get hooks() {
+			if (!hooksRef) throw new Error("no run in progress");
+			return hooksRef;
+		},
+		currentInvocation: () => currentInvocation
+	};
+	const d1Proxies = /* @__PURE__ */ new Map();
+	const proxiedEnv = new Proxy(env, { get(target, prop, receiver) {
+		const value = Reflect.get(target, prop, receiver);
+		if (typeof prop !== "string") return value;
+		if (isD1$1(value)) {
+			let p = d1Proxies.get(prop);
+			if (!p) {
+				p = proxyD1(value, prop, ctx);
+				d1Proxies.set(prop, p);
+			}
+			return p;
+		}
+		if (isBindingLike(value)) ctx.hooks.unsupported(`binding ${prop} is not proxied`);
+		return value;
+	} });
+	/** Platform-level actions (dead-lettering) are recorded under an invocation no fault can crash. */
+	const platformInvocations = /* @__PURE__ */ new WeakMap();
+	function platformInvocation(hooks) {
+		let id = platformInvocations.get(hooks);
+		if (id === void 0) {
+			id = "platform";
+			hooks.startInvocation(id);
+			platformInvocations.set(hooks, id);
+		}
+		return id;
+	}
+	return {
+		name: "cloudflare",
+		assumptions,
+		async reset(spec) {
+			for (const step of spec.setup) {
+				if (step.kind !== "d1") continue;
+				const binding = String(step["binding"]);
+				const schema = options.schemas[binding];
+				if (schema === void 0) throw new Error(`no schema provided for D1 binding ${binding}`);
+				const real = env[binding];
+				if (!isD1$1(real)) throw new Error(`env.${binding} is not a D1 binding`);
+				await resetD1(real, schema);
+			}
+		},
+		restrictEvents(spec, keepIds) {
+			const drive = spec.drive;
+			return {
+				...spec,
+				drive: {
+					...drive,
+					messages: drive.messages.filter((m) => keepIds.includes(m.id))
+				}
+			};
+		},
+		async finish(spec, hooks) {
+			for (const step of spec.setup) {
+				if (step.kind !== "d1") continue;
+				const binding = String(step["binding"]);
+				const real = env[binding];
+				if (!isD1$1(real)) continue;
+				const tables = await snapshotD1(real);
+				hooks.snapshot(platformInvocation(hooks), `D1:${binding}`, { tables });
+			}
+		},
+		initialEvents(spec) {
+			const drive = spec.drive;
+			if (drive.kind !== "queue") throw new Error(`drive ${drive.kind} is not supported by the Cloudflare platform yet`);
+			return drive.messages.map((m) => ({
+				id: m.id,
+				attempt: 1,
+				data: m.body
+			}));
+		},
+		async deliver(event, hooks, spec) {
+			const drive = spec.drive;
+			const queueTarget = `Queue:${drive.queue}`;
+			const invocation = `${event.id}#${event.attempt}`;
+			hooksRef = hooks;
+			currentInvocation = invocation;
+			const inv = hooks.startInvocation(invocation);
+			/** Cloudflare honours the first ack or retry decision per message; later ones are ignored. */
+			const state = { decision: null };
+			const background = [];
+			/** Records the call; the result says whether it took effect (the first decision wins). */
+			const decide = (op, args) => {
+				hooks.effectSync({
+					invocation,
+					target: queueTarget,
+					op,
+					args,
+					allowed: ACK
+				}, () => {
+					if (state.decision !== null) return false;
+					state.decision = op;
+					return true;
+				}, (effective) => ({ effective }));
+			};
+			const message = {
+				id: event.id,
+				timestamp: /* @__PURE__ */ new Date(),
+				body: cloneJson(event.data),
+				attempts: event.attempt,
+				ack: () => decide("ack", {
+					messageId: event.id,
+					implicit: false,
+					body: event.data
+				}),
+				retry: () => decide("retry", {
+					messageId: event.id,
+					body: event.data
+				})
+			};
+			const batch = {
+				queue: drive.queue,
+				messages: [message],
+				metadata: { metrics: {
+					backlogCount: 0,
+					backlogBytes: 0
+				} },
+				ackAll: () => message.ack(),
+				retryAll: () => message.retry()
+			};
+			const execution = {
+				waitUntil: (promise) => {
+					background.push(promise.then(() => void 0, () => void 0));
+				},
+				passThroughOnException: () => {},
+				props: {}
+			};
+			const handler = options.handler.queue;
+			if (!handler) throw new Error("the Worker has no queue() handler");
+			const outcome = Promise.resolve().then(() => handler.call(options.handler, batch, proxiedEnv, execution)).then(() => "completed", (err) => err instanceof CrashSignal ? "crashed" : "errored");
+			let status = await Promise.race([hooks.settle(outcome, invocation), inv.crashed.then(() => "crashed")]);
+			if (status === "completed" && state.decision === null) try {
+				decide("ack", {
+					messageId: event.id,
+					implicit: true,
+					body: event.data
+				});
+			} catch (err) {
+				if (err instanceof CrashSignal) status = "crashed";
+				else throw err;
+			}
+			if (background.length > 0 && !inv.isCrashed()) try {
+				hooks.effectSync({
+					invocation,
+					target: queueTarget,
+					op: "background",
+					args: { pending: background.length },
+					allowed: CUT_OFF
+				}, () => null, () => null);
+				await Promise.race([hooks.settle(Promise.all(background), invocation), inv.crashed]);
+			} catch (err) {
+				if (!(err instanceof CrashSignal)) throw err;
+				status = "crashed";
+			}
+			const followUps = [];
+			if (state.decision !== "ack") {
+				const redeliveries = event.attempt - 1;
+				if (event.attempt <= maxRetries && redeliveries < spec.bounds.maxRedeliveries) followUps.push({
+					...event,
+					attempt: event.attempt + 1
+				});
+				else hooks.effectSync({
+					invocation: platformInvocation(hooks),
+					target: queueTarget,
+					op: "dead_letter",
+					args: {
+						messageId: event.id,
+						attempts: event.attempt
+					},
+					allowed: []
+				}, () => null, () => null);
+			}
+			currentInvocation = "";
+			return {
+				status,
+				followUps
+			};
+		}
+	};
+}
+// packages/cloudflare/src/differential.ts
+/**
+* Differential check: the same fault-free scenario run once through Eutaxy's
+* proxies and once against the raw bindings, with the queue model applied by
+* hand on the raw side. Any difference in the per-attempt decisions or in
+* the final D1 state is a bug in the proxies or the platform model, not in
+* the Worker. The raw side shares Eutaxy's *reading* of Cloudflare's queue
+* semantics; what it does not share is any proxy code.
+*/
+/** The raw side cannot abandon an invocation the way the engine does; a stuck handler ends the comparison. */
+var StuckError = class extends Error {
+	name = "StuckError";
+	constructor(message = "the handler is waiting on something outside the run (no timer due, no effect in flight)") {
+		super(message);
+	}
+};
+/**
+* The raw side's only wrapper: counts D1 calls in flight (so the settle loop
+* knows real I/O is pending) and advances the clock as the proxies do. It
+* records nothing and injects nothing.
+*/
+function countingD1(real, io, clock) {
+	const realOf = /* @__PURE__ */ new WeakMap();
+	const track = async (p) => {
+		io.n++;
+		try {
+			return await p;
+		} finally {
+			io.n--;
+			clock.advance(1);
+		}
+	};
+	const wrapStatement = (s) => {
+		const proxy = new Proxy(s, { get(t, prop, r) {
+			const v = Reflect.get(t, prop, r);
+			if (prop === "bind") return (...a) => wrapStatement(t.bind(...a));
+			if (prop === "run" || prop === "all" || prop === "first" || prop === "raw") return (...a) => track(v.apply(t, a));
+			return typeof v === "function" ? v.bind(t) : v;
+		} });
+		realOf.set(proxy, s);
+		return proxy;
+	};
+	return new Proxy(real, { get(t, prop, r) {
+		const v = Reflect.get(t, prop, r);
+		if (prop === "prepare") return (sql) => wrapStatement(t.prepare(sql));
+		if (prop === "batch") return (stmts) => track(t.batch(stmts.map((s) => realOf.get(s) ?? s)));
+		if (prop === "exec") return (sql) => track(t.exec(sql));
+		return typeof v === "function" ? v.bind(t) : v;
+	} });
+}
+function isD1(value) {
+	return typeof value === "object" && value !== null && typeof value.prepare === "function";
+}
+async function snapshotAll(spec, options) {
+	const env = options.env;
+	const out = {};
+	for (const step of spec.setup) {
+		if (step.kind !== "d1") continue;
+		const binding = String(step["binding"]);
+		const real = env[binding];
+		if (isD1(real)) out[binding] = await snapshotD1(real);
+	}
+	return out;
+}
+/** The Eutaxy side: one run with no faults, driven like `runOnce` but keeping each delivery's status. */
+async function eutaxySide(spec, options) {
+	const platform = createCloudflarePlatform(options);
+	const run = new Run({
+		mode: "replay",
+		schedule: {
+			seed: 0,
+			faults: []
+		},
+		bounds: spec.bounds,
+		faultProbability: 0
+	});
+	const attempts = [];
+	await platform.reset(spec);
+	run.install(spec.externals);
+	try {
+		const pending = [...platform.initialEvents(spec)];
+		while (pending.length > 0) {
+			const event = pending.shift();
+			const invocation = `${event.id}#${event.attempt}`;
+			const before = run.log.entries.length;
+			const result = await platform.deliver(event, run, spec);
+			const decision = run.log.entries.slice(before).find((e) => e.invocation === invocation && e.kind === "result" && (e.op === "ack" || e.op === "retry") && getPath(e.payload, "result.effective") === true)?.op;
+			attempts.push({
+				event: event.id,
+				attempt: event.attempt,
+				status: result.status === "completed" ? "completed" : "errored",
+				decision: decision ?? null
+			});
+			pending.push(...result.followUps);
+		}
+	} finally {
+		run.uninstall();
+	}
+	await platform.finish?.(spec, run);
+	return {
+		attempts,
+		state: await snapshotAll(spec, options),
+		unsupported: run.unsupportedReasons
+	};
+}
+/** The raw side: the handler called directly with the real bindings and plain message objects. */
+async function rawSide(spec, options) {
+	const env = options.env;
+	const drive = spec.drive;
+	const maxRetries = options.maxRetries ?? 3;
+	for (const step of spec.setup) {
+		if (step.kind !== "d1") continue;
+		const binding = String(step["binding"]);
+		const schema = options.schemas[binding];
+		const real = env[binding];
+		if (schema !== void 0 && isD1(real)) await resetD1(real, schema);
+	}
+	const handler = options.handler.queue;
+	if (!handler) throw new Error("the Worker has no queue() handler");
+	const attempts = [];
+	const pending = drive.messages.map((m) => ({
+		id: m.id,
+		attempt: 1,
+		data: m.body
+	}));
+	const patched = patchGlobals(0);
+	const unsupported = [];
+	const restoreFetch = installScriptedFetch(spec.externals, null, (r) => unsupported.push(r), () => patched.clock.advance(1));
+	const io = { n: 0 };
+	const counting = /* @__PURE__ */ new Map();
+	const countedEnv = new Proxy(env, { get(target, prop, receiver) {
+		const value = Reflect.get(target, prop, receiver);
+		if (typeof prop !== "string" || !isD1(value)) return value;
+		let c = counting.get(prop);
+		if (!c) {
+			c = countingD1(value, io, patched.clock);
+			counting.set(prop, c);
+		}
+		return c;
+	} });
+	const settle = (p) => settleOn(p, {
+		clock: patched.clock,
+		inFlight: () => io.n,
+		crashed: () => false,
+		stuck: () => {
+			throw new StuckError();
+		}
+	});
+	try {
+		while (pending.length > 0) {
+			const event = pending.shift();
+			let decision = null;
+			const background = [];
+			const message = {
+				id: event.id,
+				timestamp: /* @__PURE__ */ new Date(),
+				body: JSON.parse(JSON.stringify(event.data)),
+				attempts: event.attempt,
+				ack: () => {
+					decision ??= "ack";
+				},
+				retry: () => {
+					decision ??= "retry";
+				}
+			};
+			const batch = {
+				queue: drive.queue,
+				messages: [message],
+				metadata: { metrics: {
+					backlogCount: 0,
+					backlogBytes: 0
+				} },
+				ackAll: () => message.ack(),
+				retryAll: () => message.retry()
+			};
+			const ctx = {
+				waitUntil: (p) => {
+					background.push(p.then(() => void 0, () => void 0));
+				},
+				passThroughOnException: () => {},
+				props: {}
+			};
+			let status;
+			try {
+				await settle(Promise.resolve().then(() => handler.call(options.handler, batch, countedEnv, ctx)));
+				status = "completed";
+			} catch (err) {
+				if (err instanceof CrashSignal || err instanceof StuckError) throw err;
+				status = "errored";
+			}
+			if (status === "completed") decision ??= "ack";
+			await settle(Promise.all(background));
+			attempts.push({
+				event: event.id,
+				attempt: event.attempt,
+				status,
+				decision
+			});
+			if (decision !== "ack" && event.attempt <= maxRetries && event.attempt - 1 < spec.bounds.maxRedeliveries) pending.push({
+				...event,
+				attempt: event.attempt + 1
+			});
+		}
+	} finally {
+		restoreFetch();
+		patched.restore();
+	}
+	if (unsupported.length > 0) throw new StuckError(`raw side: ${unsupported.join("; ")}`);
+	return {
+		attempts,
+		state: await snapshotAll(spec, options)
+	};
+}
+/** Run both sides and compare. The Eutaxy side runs first; both start from the schema. */
+async function runDifferential(spec, options) {
+	const { unsupported, ...eutaxy } = await eutaxySide(spec, options);
+	const raw = await rawSide(spec, options);
+	const differences = [];
+	if (unsupported.length > 0) differences.push(`the proxied run touched unsupported APIs: ${unsupported.join("; ")}`);
+	const a = canonicalJson(eutaxy.attempts);
+	const b = canonicalJson(raw.attempts);
+	if (a !== b) differences.push(`attempts differ:\n  eutaxy ${a}\n  raw    ${b}`);
+	const bindings = /* @__PURE__ */ new Set([...Object.keys(eutaxy.state), ...Object.keys(raw.state)]);
+	for (const binding of [...bindings].sort()) {
+		const tables = /* @__PURE__ */ new Set([...Object.keys(eutaxy.state[binding] ?? {}), ...Object.keys(raw.state[binding] ?? {})]);
+		for (const table of [...tables].sort()) {
+			const x = canonicalJson(eutaxy.state[binding]?.[table] ?? []);
+			const y = canonicalJson(raw.state[binding]?.[table] ?? []);
+			if (x !== y) differences.push(`${binding}.${table} differs:\n  eutaxy ${x}\n  raw    ${y}`);
+		}
+	}
+	return {
+		equal: differences.length === 0,
+		eutaxy,
+		raw,
+		differences,
+		unsupported
+	};
+}
+// packages/cloudflare/src/scenario.ts
+/**
+* Typed construction of scenario specs for Cloudflare Workers. Everything here
+* produces the plain-data `ScenarioSpec` from core; this module only knows the
+* Cloudflare shapes (queues, D1 bindings) and the effect conventions the
+* proxies follow.
+*/
+function queue(name, messages) {
+	return {
+		kind: "queue",
+		queue: name,
+		messages: messages.map((m, i) => ({
+			id: m.id ?? `msg-${i + 1}`,
+			body: m.body
+		}))
+	};
+}
+function d1Schema(binding, schemaFile) {
+	return {
+		kind: "d1",
+		binding,
+		schemaFile
+	};
+}
+/**
+* Effect conventions for D1 (what the proxies record):
+*   call   payload { args: { sql, params } }
+*   result payload { args: { sql, params }, result: { changes, lastRowId } }
+* A committed write is a `result` whose `result.changes` is at least 1.
+*/
+function d1Write(binding, op = "run") {
+	return {
+		target: `D1:${binding}`,
+		op,
+		kind: "result",
+		atLeast: { "result.changes": 1 }
+	};
+}
+/** Dot path to the Nth bound parameter of a D1 statement, in an effect payload. */
+function d1Param(index) {
+	return `args.params.${index}`;
+}
+function atMostOncePerKey(name, effect, key) {
+	return {
+		kind: "atMostOncePerKey",
+		name,
+		effect,
+		key
+	};
+}
+function atLeastOnce(name, effect, key, expected) {
+	return {
+		kind: "atLeastOnce",
+		name,
+		effect,
+		key,
+		expected
+	};
+}
+/**
+* Every message's `bodyKey` value must appear at least once as `key` in a
+* selected effect: nothing the queue delivered may be lost.
+*/
+function atLeastOncePerMessage(name, drive, effect, key, bodyKey) {
+	const expected = [];
+	for (const m of drive.messages) {
+		const v = getPath(m.body, bodyKey);
+		if (v === void 0) throw new Error(`message ${m.id} has no ${JSON.stringify(bodyKey)} in its body`);
+		expected.push(v);
+	}
+	return {
+		...atLeastOnce(name, effect, key, expected),
+		perMessage: { bodyKey }
+	};
+}
+/** Rows of a D1 table in the end-of-run snapshot, optionally filtered. */
+function d1Rows(binding, table, where) {
+	return where ? {
+		target: `D1:${binding}`,
+		table,
+		where
+	} : {
+		target: `D1:${binding}`,
+		table
+	};
+}
+/** Every row the query selects satisfies all conditions. */
+function everyRow(name, query, holds) {
+	return {
+		kind: "everyRow",
+		name,
+		query,
+		holds
+	};
+}
+/** Every selected effect has a row whose column equals the effect's key. */
+function implies(name, when, key, state, column) {
+	return {
+		kind: "implies",
+		name,
+		when,
+		key,
+		state,
+		column
+	};
+}
+/** Selects the acknowledgement that took effect for each message (explicit or implicit; not one ignored after a retry). */
+function queueAck(queueName) {
+	return {
+		target: `Queue:${queueName}`,
+		op: "ack",
+		kind: "result",
+		where: { "result.effective": true }
+	};
+}
+/**
+* Declare an external service: requests to `host` are answered from
+* `responses` (every request gets 200 and an empty body when omitted), and
+* `dedupeBy` names the header whose value makes repeated requests
+* idempotent at that service.
+*/
+function external(name, host, options = {}) {
+	return {
+		name,
+		host,
+		guarantees: options.dedupeBy ? { dedupeBy: options.dedupeBy } : {},
+		...options.responses ? { responses: options.responses } : {}
+	};
+}
+/**
+* Selects the requests to an external that took effect: a request replayed
+* under a dedupe key the external had already seen is not counted.
+*/
+function fetchCall(externalName, method) {
+	return {
+		target: `Fetch:${externalName}`,
+		...method ? { op: method.toUpperCase() } : {},
+		kind: "result",
+		where: { "result.effective": true }
+	};
+}
+/** Build and validate a scenario spec; throws with every problem listed. */
+function defineScenario(input) {
+	const drive = "messages" in input.drive && input.drive.messages.every((m) => "id" in m && typeof m.id === "string") ? input.drive : queue(input.drive.queue, input.drive.messages);
+	const spec = {
+		version: 1,
+		name: input.name,
+		platform: "cloudflare",
+		worker: input.worker,
+		drive,
+		setup: input.setup ?? [],
+		externals: input.externals ?? [],
+		invariants: input.invariants,
+		bounds: {
+			...defaultBounds,
+			...input.bounds
+		}
+	};
+	const errors = validateScenario(spec);
+	if (errors.length > 0) throw new Error(`invalid scenario ${JSON.stringify(input.name)}:\n- ${errors.join("\n- ")}`);
+	return spec;
+}
+export { atLeastOnce, atLeastOncePerMessage, atMostOncePerKey, check, cloudflareRegressionTest, createCloudflarePlatform, d1Param, d1Rows, d1Schema, d1Write, defineScenario, everyRow, expectHolds, external, fetchCall, implies, queue, queueAck, runDifferential, snapshotD1 };
+
+//# sourceMappingURL=cloudflare.mjs.map