@nanobpm/urban 0.80.0 → 0.82.0

package/src/runtime/core/modules/open-user-tasks-store.test.ts

@@ -154,3 +154,14 @@ test("syncInstance is atomic — it composes inside an existing transaction and
 test("the DSL projection name is stable and unprefixed (usable in `exists(...)`)", () => {
   assert.equal(OPEN_USER_TASKS_PROJECTION, "urban_open_user_tasks");
 });
+
+test("instanceKeys returns each distinct instance with ≥1 open task (and drops one when cleared)", async () => {
+  await withStore((store) => {
+    assert.deepEqual(store.instanceKeys(), []); // empty projection
+    store.syncInstance("pi-1", [task("ut-1"), task("ut-2")]); // two tasks, one instance
+    store.syncInstance("pi-2", [task("ut-3")]);
+    assert.deepEqual(store.instanceKeys().sort(), ["pi-1", "pi-2"]); // distinct, not per-task
+    store.clearInstance("pi-1"); // answered/terminated
+    assert.deepEqual(store.instanceKeys(), ["pi-2"]); // retired key no longer listed
+  });
+});

package/src/runtime/core/modules/open-user-tasks-store.ts

@@ -144,6 +144,17 @@ export class OpenUserTasksStore {
     this.#db.run(`DELETE FROM ${OPEN_USER_TASKS_TABLE} WHERE process_instance_key = ?`, [processInstanceKey]);
   }
 
+  /** Every distinct instance key currently projected as having ≥1 open user task. Used by the
+   *  reconciler to re-probe (and, when answered, RETIRE) keys that have dropped out of a binding's
+   *  `activeStatuses` allow-list — a projected row must be retired independently of the base-row
+   *  selector, or an answered escalation's row would linger and the derived edge tear (ADR 0065). */
+  instanceKeys(): string[] {
+    const rows = this.#db.all<{ process_instance_key: string }>(
+      `SELECT DISTINCT process_instance_key FROM ${OPEN_USER_TASKS_TABLE}`,
+    );
+    return rows.map((r) => r.process_instance_key);
+  }
+
   /** True iff the instance currently has any open user task — the "parked on a human" predicate. */
   hasOpenTask(processInstanceKey: string): boolean {
     if (!processInstanceKey) return false;

package/src/runtime/core/modules/pages.ts

@@ -35,6 +35,7 @@ import { FORMJS_JS } from "./formjs.gen.ts";
 import { completeUserTaskResponse, resolveFormResponse } from "./forms.ts";
 import { quoteIdent } from "./gateway.ts";
 import { RENDERER_JS } from "./runtime.gen.ts";
+import { isSqlIdentifier } from "../read-model.ts";
 
 /** The subset of the datasource gateway the page runtime needs. */
 export interface PagesDataSource {
@@ -183,10 +184,10 @@ async function serveAsset(
   }
 }
 
-/** A SQL identifier guard — a table name must be a bare identifier *and* a known table
- * (checked against `schema()`), so `/app/data/:table` can never inject SQL. */
-const IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/;
-
+/** A table name must be a bare SQL identifier ({@link isSqlIdentifier}, the runtime-wide single source
+ * of truth) *and* a known table (checked against `schema()`), so `/app/data/:table` can never inject
+ * SQL. Reusing the shared guard (rather than a private regex) keeps this surface from drifting from
+ * manifest / read-model / data-source identifier validation. */
 // A query flag (e.g. ?count=1) is "on" when present and not one of the falsy
 // spellings. A bare `?count` (empty string) still counts as on, so a caller can
 // opt in without inventing a value.
@@ -369,7 +370,7 @@ export function createPagesRoutes(opts: PagesOptions, deps: PagesDeps): Route[]
       // v1 exposes only the injected default datasource; a request naming any other
       // source is rejected rather than silently served off the default.
       if (source !== sourceName) return json({ error: `unknown datasource "${source}"` }, 404);
-      if (!IDENT.test(table)) return json({ error: "invalid table name" }, 400);
+      if (!isSqlIdentifier(table)) return json({ error: "invalid table name" }, 400);
       let tables: Set<string>;
       try {
         tables = await knownTables();

package/src/runtime/core/modules/workers.ts

@@ -11,7 +11,7 @@ import { runInJobContext } from "../execContext.ts";
 import type { JobExecContext } from "../execContext.ts";
 import { readLineage } from "../lineage.ts";
 import { LineageStore } from "./lineage-store.ts";
-import { readModelRegistry } from "../read-model.ts";
+import { readModelRegistry, rollupRegistry } from "../read-model.ts";
 import { registerCanonicalProjections } from "./canonical-projections.ts";
 import { InstanceStateStore } from "./instance-state-store.ts";
 import { OpenUserTasksStore } from "./open-user-tasks-store.ts";
@@ -139,6 +139,25 @@ function tryLineageStore(app: AppApi, log: RuntimeContext["host"]["log"]): Linea
   }
 }
 
+/**
+ * Apply every managed rollup VIEW registered in the process-wide `rollupRegistry` (ADR 0065, #468) to
+ * the app's DEFAULT data source, in dependency order (a composed rollup after the rollup it reads).
+ * Mirrors {@link tryProvisionReadModelViews}: empty until a sibling task registers a rollup, and
+ * absent-/error-safe so a missing datasource or a VIEW-provisioning failure never breaks a worker mount.
+ */
+function tryProvisionRollupViews(app: AppApi, log: RuntimeContext["host"]["log"]): void {
+  if (rollupRegistry.all().length === 0) return;
+  if (!app.data.hasDefaultSource()) {
+    log("debug", "rollups: no default data source; managed VIEW provisioning skipped");
+    return;
+  }
+  try {
+    rollupRegistry.ensureViews(app.data.source().db);
+  } catch (err) {
+    log("warn", "rollups: failed to provision managed VIEWs", { error: String(err) });
+  }
+}
+
 /**
  * Apply every managed read-model VIEW registered in the process-wide `readModelRegistry` to the app's
  * DEFAULT data source (ADR 0065, surface #3). A `defineReadModel(...)` declaration compiles to a
@@ -251,6 +270,10 @@ export async function mountWorkers(
   // provision the projection tables per source (absent-safe), and finally the read-model VIEWs.
   registerCanonicalProjections();
   tryProvisionCanonicalProjections(app, ctx.host.log);
+  // Rollup VIEWs (ADR 0065, #468) BEFORE the read-model VIEWs: a read model's key-correlated rollup
+  // lookup `LEFT JOIN`s a rollup's `*_counts` VIEW, and a composed rollup reads another rollup's VIEW,
+  // so every rollup VIEW (in dependency order) must exist before any dependent VIEW compiles.
+  tryProvisionRollupViews(app, ctx.host.log);
   tryProvisionReadModelViews(app, ctx.host.log);
 
   // Cache module loads so a multi-type handler module is imported once.

package/src/runtime/core/read-model.test.ts

@@ -24,7 +24,10 @@ import {
   pcol,
   ProjectionRegistry,
   projectionRegistry,
+  rcol,
   ReadModelRegistry,
+  isReservedObjectName,
+  RESERVED_OBJECT_PREFIXES,
   when,
 } from "./read-model.ts";
 import type { ReadModel } from "./read-model.ts";
@@ -82,6 +85,19 @@ const EXPECTED: Record<string, { display_status: string; is_high_priority: numbe
   t3: { display_status: "active", is_high_priority: 1 },
 };
 
+test("isReservedObjectName flags every reserved prefix, case-insensitively, and clears domain names", () => {
+  // Single source of truth for the prefixes the datasource surface hides (gateway.schema()) and the
+  // provenance recorder skips (datasource.ts). SQLite folds ASCII object names, so a cased reserved
+  // name must not slip through.
+  assert.deepEqual([...RESERVED_OBJECT_PREFIXES], ["_urban_", "_nano_", "sqlite_"]);
+  for (const name of ["_urban_x", "_URBAN_x", "_nano_y", "sqlite_master", "SQLITE_stat1"]) {
+    assert.ok(isReservedObjectName(name), `expected "${name}" reserved`);
+  }
+  for (const name of ["orders", "plans__tracking", "urban_things", "nano", "sqlitely"]) {
+    assert.ok(!isReservedObjectName(name), `expected "${name}" NOT reserved`);
+  }
+});
+
 test("(i) the read model with CASE + EXISTS compiles to a SQLite VIEW returning the expected values", async () => {
   await withDb((db) => {
     seedFixtures(db);
@@ -219,6 +235,84 @@ test("both backends agree on NULL inputs: SQL NULL propagation is COALESCE'd to
   });
 });
 
+test("compileToFn resolves col/pcol identifiers case-insensitively (SQLite identifier folding)", () => {
+  // SQLite folds identifier case even for quoted identifiers, so `col("Status")` in the VIEW binds to a
+  // column DECLARED `status`. The TS backend must fold too — a case-sensitive `row["Status"]` returns
+  // null and silently diverges from the VIEW on the no-edge fallback and on keyField correlation.
+  assert.equal(compileToFn(col("Status"))({ status: "abandoned" }), "abandoned"); // folds to declared column
+  assert.equal(compileToFn(col("status"))({ status: "abandoned" }), "abandoned"); // exact match still works
+  assert.equal(compileToFn(col("Missing"))({ status: "x" }), null); // a truly-absent column → null (not a fold)
+  // pcol inside EXISTS folds too, so keyField correlation matches the VIEW's join.
+  const corr = compileToFn(exists("p", eq(pcol("Process_Instance_Key"), col("Key"))));
+  assert.equal(corr({ key: "pi-1" }, { p: [{ process_instance_key: "pi-1" }] }), true);
+  assert.equal(corr({ key: "pi-1" }, { p: [{ process_instance_key: "pi-2" }] }), false);
+});
+
+test("compileToFn / rcol reads the resolved lookup row by OWN property (a `__proto__` alias can't resolve Object.prototype)", () => {
+  // Lookup aliases are only identifier-validated, so `__proto__` is a legal alias. A bare `fnFor` caller
+  // supplies a plain `{}` for `lookups`; a raw `lookups["__proto__"]` resolves the inherited
+  // `Object.prototype` (truthy), bypassing the "missing lookup row → throw" guard and reading NULLs off the
+  // prototype chain. Reading by OWN property keeps the guard fail-loud on the bare-caller path.
+  const fn = compileToFn(rcol("__proto__", "amount"));
+  assert.throws(() => fn({}), /without a resolved lookup row/);
+  // A genuinely-supplied own `__proto__` row still resolves (null-prototype dict, an own property).
+  const lookups: Record<string, Record<string, unknown>> = Object.create(null);
+  lookups.__proto__ = { amount: 7 };
+  assert.equal(fn({}, {}, lookups), 7);
+});
+
+test("compileToFn / exists reads projections by OWN property (a `__proto__` projection can't resolve Object.prototype)", () => {
+  // Projection names are user-controlled, so `__proto__` is legal. A bare `fnFor` caller passes a plain
+  // `{}` for projections; a raw `projections["__proto__"]` resolves the inherited `Object.prototype`
+  // (truthy, non-array), so `.some(...)` throws a TypeError. Reading by OWN property yields an empty EXISTS.
+  const fn = compileToFn(exists("__proto__", eq(col("k"), lit(1))));
+  assert.equal(fn({ k: 1 }), false); // no such projection → empty EXISTS, not a prototype read
+  // A genuinely-supplied own `__proto__` projection still matches.
+  const projections: Record<string, ReadonlyArray<Record<string, unknown>>> = Object.create(null);
+  projections.__proto__ = [{ k: 1 }];
+  assert.equal(fn({ k: 1 }, projections), true);
+});
+
+test("mixed-case col/pcol identifiers: the VIEW and TS backends agree (VIEW/TS parity on the no-edge fallback)", async () => {  // End-to-end guard for the case-fold fix: author a model with mixed-case identifiers over lowercase
+  // columns and confirm the SQLite VIEW and the TS backend derive the SAME value — including the
+  // parity-critical no-edge fallback that passes the stored status through.
+  const mixed: ReadModel = defineReadModel({
+    name: "mixed_case_display",
+    baseTable: "widgets",
+    derive: {
+      effective: caseWhen(
+        [
+          when(
+            exists("urban_open_user_tasks", eq(pcol("Process_Instance_Key"), col("Process_Key"))),
+            lit("awaiting_operator"),
+          ),
+        ],
+        col("Status"), // no-edge fallback → the stored status, read via a mixed-case identifier
+      ),
+    },
+  });
+  await withDb((db) => {
+    db.exec(`CREATE TABLE widgets (id TEXT, process_key TEXT, status TEXT);`);
+    db.exec(`CREATE TABLE urban_open_user_tasks (process_instance_key TEXT);`);
+    db.exec(mixed.viewDdl());
+    db.run(`INSERT INTO widgets VALUES (?, ?, ?)`, ["w1", "pi-1", "dispatched"]); // no open task → fallback
+    db.run(`INSERT INTO widgets VALUES (?, ?, ?)`, ["w2", "pi-2", "dispatched"]);
+    db.run(`INSERT INTO urban_open_user_tasks VALUES (?)`, ["pi-2"]); // w2 waiting on a human
+    // SQL backend: the VIEW resolves the mixed-case identifiers against the lowercase columns.
+    const sqlRows = db
+      .all<{ id: string; effective: string }>(`SELECT id, effective FROM mixed_case_display ORDER BY id`)
+      .map((r) => ({ ...r }));
+    assert.deepEqual(sqlRows, [
+      { id: "w1", effective: "dispatched" }, // no-edge fallback → stored status (the parity-critical path)
+      { id: "w2", effective: "awaiting_operator" },
+    ]);
+    // TS backend: base/projection rows arrive keyed as SQLite stored them (lowercase).
+    const projections = { urban_open_user_tasks: [{ process_instance_key: "pi-2" }] };
+    assert.equal(mixed.evaluate({ id: "w1", process_key: "pi-1", status: "dispatched" }, projections).effective, "dispatched");
+    assert.equal(mixed.evaluate({ id: "w2", process_key: "pi-2", status: "dispatched" }, projections).effective, "awaiting_operator");
+  });
+});
+
 test("EXISTS references a projection by name; the projection registry resolves the physical table", () => {
   const reg = new ProjectionRegistry();
   reg.register({ name: "urban_instance_state", sqlTable: "_urban_instance_state" });