@pramen/server 0.0.3 → 0.0.5

package/src/durable-object.ts

@@ -24,6 +24,8 @@ import { compileAcl, type AclContext, type CompiledAcl } from "./runtime/acl";
 import { DoSqliteDriver, type Driver } from "./runtime/driver";
 import { BadRequest, toResponse, toWsError } from "./runtime/errors";
 import { Kv } from "./runtime/kv";
+import { registryKey } from "./runtime/registry";
+import { DEFAULT_PARTITION } from "./sdk/schema";
 import { createFiles, R2Adapter, type Files } from "./runtime/storage";
 import type { Identity } from "./sdk/acl";
 import type { PramenApp } from "./pramen";
@@ -33,6 +35,9 @@ interface SocketState {
   identity: Identity | null;
   /** Tenant fixed at connect time (survives hibernation via the attachment). */
   tenant: string;
+  /** Partition fixed at connect time (read from x-pramen-partition at upgrade);
+   * survives hibernation via the attachment, like `tenant`. */
+  partition: string;
   subs: Subscription[];
 }
 
@@ -62,6 +67,13 @@ export class PramenDOBase extends DurableObject<DoEnv> {
   /** Tenant this DO serves (one per idFromName). Learned from the Worker-forwarded
    * x-pramen-tenant header; defaults to "main". */
   private tenant = "main";
+  /** Partition this DO serves (one per idFromName(partitionDoName)). Learned from the
+   * Worker-forwarded x-pramen-partition header on the first fetch; defaults to the
+   * default partition (a single-partition app, or a stray request with no header). */
+  private partition = DEFAULT_PARTITION;
+  /** Boot migration runs on the FIRST fetch (once the partition is known), not in the
+   * constructor — see `ensureMigrated`. Guards against re-running. */
+  private migrated = false;
   private files?: Files;
 
   constructor(ctx: DurableObjectState, env: DoEnv, app: PramenApp) {
@@ -74,19 +86,46 @@ export class PramenDOBase extends DurableObject<DoEnv> {
     // the D1 substrate (D1Driver) lives in the Worker (the "Worker + D1, no DO" path).
     this.driver = new DoSqliteDriver(ctx.storage);
 
-    // Reconcile the store with the schema before any request is served (create/alter
-    // tables; destructive changes rebuild the table). Wrapped in a transaction so a
-    // partial migration can't leave a half-rebuilt table.
-    const allowDestructive = env.PRAMEN_ALLOW_DESTRUCTIVE === "true";
-    ctx.blockConcurrencyWhile(() =>
-      this.driver.transaction(() => migrate(this.driver, this.app.schema, { allowDestructive }).then(() => {})),
-    );
+    // NOTE: the boot migration is NOT run here. The constructor cannot know which
+    // partition this DO serves — that arrives in the x-pramen-partition header on the
+    // first request, after construction. Migrating the full schema here would create
+    // OTHER partitions' tables in this DO (defeating partition isolation), so we defer
+    // the partition-scoped migrate() to the first fetch (`ensureMigrated`), guarded by
+    // ctx.blockConcurrencyWhile so concurrent first requests can't double-migrate.
+  }
+
+  // Reconcile this partition's tables with the schema before the first request is
+  // served. Runs once per DO lifetime: the `migrated` flag + blockConcurrencyWhile
+  // serialize concurrent first fetches (the platform queues other requests while the
+  // block runs), so two in-flight first requests can't both migrate. Scoped to
+  // this.partition — only this partition's tables are created/altered (migrate()
+  // never touches other partitions' tables). Wrapped in a transaction so a partial
+  // migration can't leave a half-rebuilt table. This preserves the single-partition
+  // (default) behavior exactly: a default DO migrates its full default-partition
+  // schema, just lazily on first touch instead of in the constructor.
+  private async ensureMigrated(): Promise<void> {
+    if (this.migrated) return;
+    const allowDestructive = this.env.PRAMEN_ALLOW_DESTRUCTIVE === "true";
+    const partition = this.partition;
+    await this.ctx.blockConcurrencyWhile(async () => {
+      if (this.migrated) return; // a concurrent first request already migrated
+      await this.driver.transaction(() =>
+        migrate(this.driver, this.app.schema, { allowDestructive, partition }).then(() => {}),
+      );
+      this.migrated = true;
+    });
   }
 
   override async fetch(request: Request): Promise<Response> {
-    await this.ensureRegistered(request);
     const tenantHeader = request.headers.get("x-pramen-tenant");
     if (tenantHeader) this.tenant = tenantHeader;
+    // Learn the partition before the boot migration so it migrates the right subset.
+    // Absent header (shouldn't happen post-routing) -> default partition.
+    const partitionHeader = request.headers.get("x-pramen-partition");
+    if (partitionHeader) this.partition = partitionHeader;
+
+    await this.ensureMigrated();
+    await this.ensureRegistered(request);
 
     const path = new URL(request.url).pathname;
     if (path === "/__recover") return this.handleRecover(request);
@@ -98,7 +137,7 @@ export class PramenDOBase extends DurableObject<DoEnv> {
     if (request.headers.get("Upgrade") === "websocket") {
       const { 0: client, 1: server } = new WebSocketPair();
       this.ctx.acceptWebSocket(server); // hibernatable
-      this.setState(server, { identity, tenant: this.tenant, subs: [] });
+      this.setState(server, { identity, tenant: this.tenant, partition: this.partition, subs: [] });
       return new Response(null, { status: 101, webSocket: client });
     }
 
@@ -138,6 +177,16 @@ export class PramenDOBase extends DurableObject<DoEnv> {
       return this.send(ws, { type: "error", id: "", error: "invalid JSON" });
     }
 
+    // A hibernated DO can be reconstructed and routed here WITHOUT fetch() running
+    // again, so the boot migration may not have run on this fresh instance. Adopt this
+    // socket's (tenant, partition) — fixed at connect time, survives via the attachment
+    // — and ensure the schema is migrated before any handler/ctx.db work. Idempotent
+    // (the `migrated` flag), so a no-op after the first call.
+    const { tenant, partition } = this.getState(ws);
+    this.tenant = tenant;
+    this.partition = partition;
+    await this.ensureMigrated();
+
     switch (msg.type) {
       case "subscribe":
         return this.onSubscribe(ws, msg.id, msg.name, msg.input);
@@ -175,7 +224,7 @@ export class PramenDOBase extends DurableObject<DoEnv> {
       if (!replacing && state.subs.length >= MAX_SUBSCRIPTIONS) {
         return this.send(ws, toWsError(id, new BadRequest("subscription limit reached")));
       }
-      const { result, kind, touched } = await dispatch(this.app.handlers, this.app.schema, this.driver, this.kv, this.filesFor(state.tenant), this.envBag, this.ctxFor(state.identity), name, input);
+      const { result, kind, touched } = await dispatch(this.app.handlers, this.app.schema, this.driver, this.kv, this.filesFor(state.tenant), this.envBag, this.ctxFor(state.identity, state.partition), name, input);
       if (kind !== "query") {
         return this.send(ws, toWsError(id, new BadRequest(`${name} is not a query`)));
       }
@@ -191,7 +240,7 @@ export class PramenDOBase extends DurableObject<DoEnv> {
   private async onCall(ws: WebSocket, id: string, name: string, input: unknown): Promise<void> {
     const state = this.getState(ws);
     try {
-      const { result, kind, touched } = await dispatch(this.app.handlers, this.app.schema, this.driver, this.kv, this.filesFor(state.tenant), this.envBag, this.ctxFor(state.identity), name, input);
+      const { result, kind, touched } = await dispatch(this.app.handlers, this.app.schema, this.driver, this.kv, this.filesFor(state.tenant), this.envBag, this.ctxFor(state.identity, state.partition), name, input);
       this.send(ws, { type: "result", id, result });
       if (kind === "mutation" && touched.length > 0) await this.broadcast(touched);
     } catch (err) {
@@ -209,7 +258,7 @@ export class PramenDOBase extends DurableObject<DoEnv> {
       for (const sub of state.subs) {
         if (!sub.tables.some((t) => written.has(t))) continue;
         try {
-          const { result } = await dispatch(this.app.handlers, this.app.schema, this.driver, this.kv, this.filesFor(state.tenant), this.envBag, this.ctxFor(state.identity), sub.name, sub.input);
+          const { result } = await dispatch(this.app.handlers, this.app.schema, this.driver, this.kv, this.filesFor(state.tenant), this.envBag, this.ctxFor(state.identity, state.partition), sub.name, sub.input);
           const next = digest(result);
           if (next === sub.digest) continue; // result unchanged for this subscription
           sub.digest = next;
@@ -239,7 +288,9 @@ export class PramenDOBase extends DurableObject<DoEnv> {
       this.registered = true;
       return;
     }
-    await this.env.KV.put(`tenant:${name}`, JSON.stringify({ firstSeen: Date.now() }));
+    // Record under this DO's real (tenant, partition): the default partition keeps the
+    // bare `tenant:<name>` key (backward-compat), a non-default one is `tenant:<name>:<p>`.
+    await this.env.KV.put(registryKey(name, this.partition), JSON.stringify({ firstSeen: Date.now() }));
     await this.driver.exec(`INSERT OR REPLACE INTO _pramen_meta (key, value) VALUES ('registered', ?)`, [name]);
     this.registered = true;
   }
@@ -279,7 +330,11 @@ export class PramenDOBase extends DurableObject<DoEnv> {
   // Introspection: this tenant's applied schema hash + live table/column shape
   // (admin-gated at the Worker). Powers the CLI's `schema status`.
   private async handleSchema(): Promise<Response> {
-    const hashRow = (await this.driver.exec(`SELECT value FROM _pramen_meta WHERE key = 'schema_hash'`, [])) as {
+    // The applied-schema hash is stored per-partition (migrate keys it
+    // `schema_hash:<partition>` whenever a partition is scoped, which the DO always
+    // does). Read this DO's partition's key.
+    const hashKey = `schema_hash:${this.partition}`;
+    const hashRow = (await this.driver.exec(`SELECT value FROM _pramen_meta WHERE key = ?`, [hashKey])) as {
       value: string;
     }[];
     const tableRows = (await this.driver.exec(
@@ -304,7 +359,7 @@ export class PramenDOBase extends DurableObject<DoEnv> {
       return Response.json({ ok: false, error: "unknown table", code: "bad_request" }, { status: 400 });
     }
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const db = new Db(this.driver, { acl: this.acl, identity: null, system: true }, this.app.schema) as any;
+    const db = new Db(this.driver, { acl: this.acl, identity: null, system: true, partition: this.partition }, this.app.schema) as any;
     try {
       let result: unknown;
       let mutated = false;
@@ -341,10 +396,11 @@ export class PramenDOBase extends DurableObject<DoEnv> {
     }
   }
 
-  private ctxFor(identity: Identity | null): AclContext {
+  private ctxFor(identity: Identity | null, partition: string = this.partition): AclContext {
     // Carry the schema so any consumer of this context (not just Db) can compile
-    // relation-aware `where` rules into subqueries.
-    return { acl: this.acl, identity, schema: this.app.schema };
+    // relation-aware `where` rules into subqueries, and the active partition so Db's
+    // table-access guard rejects any table outside this DO's partition.
+    return { acl: this.acl, identity, schema: this.app.schema, partition };
   }
 
   // The DO env (bindings + vars + secrets) handed to handlers as ctx.env. Loosely
@@ -374,7 +430,14 @@ export class PramenDOBase extends DurableObject<DoEnv> {
   }
 
   private getState(ws: WebSocket): SocketState {
-    return (ws.deserializeAttachment() as SocketState | null) ?? { identity: null, tenant: this.tenant, subs: [] };
+    return (
+      (ws.deserializeAttachment() as SocketState | null) ?? {
+        identity: null,
+        tenant: this.tenant,
+        partition: this.partition,
+        subs: [],
+      }
+    );
   }
 
   private setState(ws: WebSocket, state: SocketState): void {

package/src/index.ts

@@ -8,7 +8,8 @@
 // and codegen load an app.ts for its schema without dragging in the DO runtime.
 
 // --- schema authoring ---
-export { Entity, defineSchema, renamedFrom, notNull, unique, indexed, defaultTo } from "./sdk/schema";
+export { Entity, defineSchema, renamedFrom, notNull, unique, indexed, defaultTo, primaryKey, generated, expr, ExprDefault } from "./sdk/schema";
+export { isValidUuid } from "./sdk/uuid";
 export type {
   DefaultValue,
   FieldType,

package/src/runtime/acl.ts

@@ -60,6 +60,10 @@ export interface AclContext {
   /** The app schema — lets `where` rules traverse relations (`{ rel: { col } }`),
    * compiled to a subquery with the related entity's read scope AND-merged in. */
   readonly schema?: SchemaDef;
+  /** The partition this DO serves. When set, Db rejects any access to a table that
+   * lives in a different partition (a partition-DO only owns its own tables). Unset
+   * (e.g. the D1/Worker shared-store path) disables the guard — a no-op. */
+  readonly partition?: string;
 }
 
 /** Evaluate every resolver reachable by the identity's roles, once per request.

package/src/runtime/db.ts

@@ -41,7 +41,8 @@ import {
 } from "./read-engine";
 import { BadRequest } from "./errors";
 import type { Dialect, Driver } from "./driver";
-import type { EntityFields, FieldDef, RelationDef, SchemaDef } from "../sdk/schema";
+import { partitionOf, type EntityFields, type FieldDef, type RelationDef, type SchemaDef } from "../sdk/schema";
+import { isValidUuid } from "../sdk/uuid";
 import type { Cell, FieldsOf, InferInsert, InferRow, InferUpdate, RelationsOf, RelationsResult, WhereClause } from "../sdk/infer";
 
 type Row = Record<string, unknown>;
@@ -168,6 +169,21 @@ export class Db<S extends SchemaDef = SchemaDef> {
     this.dialect = driver.dialect;
   }
 
+  /** Partition guard. When this Db's context carries an active partition (a
+   * partition-DO knows which partition it serves), reject any access to a table
+   * that lives in a different partition — a partition-DO only owns its own tables,
+   * so touching another partition's table is a routing bug, not an empty result.
+   * Unset partition (the D1/Worker shared-store path, or a single-partition app on
+   * the default DO with no header) makes this a no-op. */
+  private assertInPartition(table: string): void {
+    const self = this.acl.partition;
+    if (self === undefined) return;
+    const tablePartition = partitionOf(this.schema, table);
+    if (tablePartition !== self) {
+      throw new BadRequest(`table '${table}' is in partition '${tablePartition}', not this partition '${self}'`);
+    }
+  }
+
   /** Resolve the ACL scope for an operation, or grant everything in SYSTEM mode. */
   private scopeFor(entity: string, action: Action): Scope {
     if (this.acl.system) return ALLOW_ALL;
@@ -226,6 +242,7 @@ export class Db<S extends SchemaDef = SchemaDef> {
   ): Promise<(InferRow<FieldsOf<S[T]>> & RelationsResult<S, T>)[]> {
     const from = spec.from as string;
     this.touched.add(from);
+    this.assertInPartition(from);
     const scope = this.scopeFor(from, "read");
     if (!scope.allowed) throw new AclDenied(from, "read");
 
@@ -245,6 +262,7 @@ export class Db<S extends SchemaDef = SchemaDef> {
   ): Promise<Page<InferRow<FieldsOf<S[T]>> & RelationsResult<S, T>>> {
     const from = spec.from as string;
     this.touched.add(from);
+    this.assertInPartition(from);
     const scope = this.scopeFor(from, "read");
     if (!scope.allowed) throw new AclDenied(from, "read");
 
@@ -269,6 +287,7 @@ export class Db<S extends SchemaDef = SchemaDef> {
   async count<T extends keyof S & string>(spec: { from: T; where?: WhereClause<S, T> }): Promise<number> {
     const from = spec.from as string;
     this.touched.add(from);
+    this.assertInPartition(from);
     const scope = this.scopeFor(from, "read");
     if (!scope.allowed) throw new AclDenied(from, "read");
     const where = this.readWhere(from, spec.where, scope);
@@ -293,6 +312,7 @@ export class Db<S extends SchemaDef = SchemaDef> {
   }): Promise<AggregateResult<FieldsOf<S[T]>, G, A>[]> {
     const from = spec.from as string;
     this.touched.add(from);
+    this.assertInPartition(from);
     const scope = this.scopeFor(from, "read");
     if (!scope.allowed) throw new AclDenied(from, "read");
 
@@ -365,6 +385,35 @@ export class Db<S extends SchemaDef = SchemaDef> {
       .map(([n]) => n);
   }
 
+  /** Mint a UUID for every `generated()` uuid column the caller omitted, mutating
+   * `vals`. Returns the columns it filled — server-minted, so the insert path treats
+   * them like forced `set` values (bypassing the writable-field ACL check). */
+  private fillGeneratedUuids(table: string, vals: Row): string[] {
+    const fields = this.schema[table]?.fields;
+    if (!fields) return [];
+    const minted: string[] = [];
+    for (const [name, f] of Object.entries(fields)) {
+      const fd = f as FieldDef;
+      if (fd.type === "uuid" && fd.generated && vals[name] == null) {
+        vals[name] = crypto.randomUUID();
+        minted.push(name);
+      }
+    }
+    return minted;
+  }
+
+  /** Reject a malformed value on any uuid column present in `row` (mirrors kvalt's
+   * write-time isValidUuid). Absent columns are not checked. */
+  private assertValidUuids(table: string, row: Row): void {
+    const fields = this.schema[table]?.fields;
+    if (!fields) return;
+    for (const [name, f] of Object.entries(fields)) {
+      if ((f as FieldDef).type !== "uuid") continue;
+      const v = row[name];
+      if (v != null && !isValidUuid(v)) throw new BadRequest(`invalid UUID for '${name}'`);
+    }
+  }
+
   private decodeRows(table: string, rows: Row[]): Row[] {
     const cols = this.jsonColsOf(table);
     if (cols.length === 0) return rows;
@@ -469,13 +518,18 @@ export class Db<S extends SchemaDef = SchemaDef> {
     values: InferInsert<FieldsOf<S[T]>>,
   ): Promise<InferRow<FieldsOf<S[T]>>> {
     this.touched.add(table);
+    this.assertInPartition(table);
     const scope = this.scopeFor(table, "create");
     if (!scope.allowed) throw new AclDenied(table, "create");
     const vals = { ...(values as Row) };
     const { set, validators } = this.writeRules(table, "create");
     Object.assign(vals, set); // forced server values first, so a conditional `when` can see them
-    this.checkWriteFields(table, "create", scope, Object.keys(vals), vals, new Set(Object.keys(set)));
+    // Auto-mint generated() uuid columns the caller omitted; server-minted, so they
+    // join `set` in the bypass-list for the writable-field check.
+    const generatedCols = this.fillGeneratedUuids(table, vals);
+    this.checkWriteFields(table, "create", scope, Object.keys(vals), vals, new Set([...Object.keys(set), ...generatedCols]));
     this.runValidators(validators, vals);
+    this.assertValidUuids(table, vals);
 
     const cols = Object.keys(vals);
     const jsonCols = new Set(this.jsonColsOf(table));
@@ -512,6 +566,7 @@ export class Db<S extends SchemaDef = SchemaDef> {
     patch: InferUpdate<FieldsOf<S[T]>>,
   ): Promise<InferRow<FieldsOf<S[T]>> | undefined> {
     this.touched.add(table);
+    this.assertInPartition(table);
     const scope = this.scopeFor(table, "update");
     if (!scope.allowed) throw new AclDenied(table, "update");
     const p = { ...(patch as Row) };
@@ -530,6 +585,7 @@ export class Db<S extends SchemaDef = SchemaDef> {
     }
     this.checkWriteFields(table, "update", scope, cols, evalRow, new Set(Object.keys(set)));
     this.runValidators(validators, p);
+    this.assertValidUuids(table, p);
 
     const params: unknown[] = [];
     const jsonCols = new Set(this.jsonColsOf(table));
@@ -550,6 +606,7 @@ export class Db<S extends SchemaDef = SchemaDef> {
   /** Delete a row by id within scope. Returns whether a row was deleted. */
   async delete<T extends keyof S & string>(table: T, id: Id): Promise<boolean> {
     this.touched.add(table);
+    this.assertInPartition(table);
     const scope = this.scopeFor(table, "delete");
     if (!scope.allowed) throw new AclDenied(table, "delete");
     const params: unknown[] = [this.dialect.encode(id)];

package/src/runtime/ddl.ts

@@ -4,11 +4,15 @@
 
 import type { DefaultValue, EntityFields, FieldDef } from "../sdk/schema";
 
-// SQLite has no boolean type; store as INTEGER 0/1. json + fileRef are stored as
-// TEXT (JSON). Exported for the migrator, which compares declared column types
+// SQLite has no boolean type; store as INTEGER 0/1. json + fileRef + uuid are
+// stored as TEXT. Exported for the migrator, which compares declared column types
 // (and CASTs on a type change).
 export const sqlType = (f: FieldDef): string =>
-  f.type === "boolean" ? "INTEGER" : f.type === "json" || f.type === "fileRef" ? "TEXT" : f.type.toUpperCase();
+  f.type === "boolean"
+    ? "INTEGER"
+    : f.type === "json" || f.type === "fileRef" || f.type === "uuid"
+      ? "TEXT"
+      : f.type.toUpperCase();
 
 /** Render a DEFAULT literal. Strings are single-quote-escaped; booleans → 0/1. */
 function defaultLiteral(v: DefaultValue): string {
@@ -18,10 +22,15 @@ function defaultLiteral(v: DefaultValue): string {
   return `'${v.replace(/'/g, "''")}'`;
 }
 
-/** The ` DEFAULT x` fragment for a column, or "" when it has no default. UNIQUE/
- * index are NOT inline — they're emitted as separate index statements so the same
- * code path serves both CREATE TABLE and ALTER TABLE ADD COLUMN. */
+/** The ` DEFAULT x` fragment for a column, or "" when it has no default. A raw-SQL
+ * `defaultExpr` (e.g. `datetime('now')`) is emitted UNQUOTED; a literal `default` is
+ * quote-escaped. UNIQUE/index are NOT inline — they're emitted as separate index
+ * statements so the same code path serves both CREATE TABLE and ALTER TABLE ADD COLUMN. */
 function defaultSql(f: FieldDef): string {
+  // A raw-SQL default is parenthesized: SQLite's column-DEFAULT grammar only takes a
+  // bare literal/keyword, so a function call (e.g. datetime('now')) must be wrapped —
+  // `DEFAULT (datetime('now'))`. Parens are harmless around a keyword too.
+  if (f.defaultExpr !== undefined) return ` DEFAULT (${f.defaultExpr})`;
   return f.default !== undefined ? ` DEFAULT ${defaultLiteral(f.default)}` : "";
 }
 

package/src/runtime/dispatch.ts

@@ -50,10 +50,10 @@ export async function dispatch(
 
   // Warmup: evaluate dynamic resolvers once, reading through a SYSTEM-mode db
   // (separate from the handler's db, so its reads don't pollute `touched`).
-  const systemDb = new Db(driver, { acl: acl.acl, identity: acl.identity, system: true, schema }, schema);
+  const systemDb = new Db(driver, { acl: acl.acl, identity: acl.identity, system: true, schema, partition: acl.partition }, schema);
   const resolved = await warmup(acl.acl, acl.identity, systemDb as unknown as ResolverDb);
 
-  const db = new Db(driver, { acl: acl.acl, identity: acl.identity, input: parsed, resolved, schema }, schema);
+  const db = new Db(driver, { acl: acl.acl, identity: acl.identity, input: parsed, resolved, schema, partition: acl.partition }, schema);
   const ctx: HandlerContext = { db, kv, files, env, identity: acl.identity };
 
   const result =

package/src/runtime/migrate.ts

@@ -21,6 +21,7 @@
 import { addColumnSql, createTableSql, indexStatements, sqlType } from "./ddl";
 import { digest } from "./digest";
 import type { Driver } from "./driver";
+import { entitiesInPartition, validateSchema } from "../sdk/schema";
 import type { EntityFields, FieldDef, SchemaDef } from "../sdk/schema";
 
 export interface MigrationReport {
@@ -41,6 +42,14 @@ export interface MigrateOptions {
    * — data-loss is gated behind an explicit opt-in (env `PRAMEN_ALLOW_DESTRUCTIVE`).
    * Additive changes (create table, add column, add index) always apply. */
   allowDestructive?: boolean;
+  /** Scope the migration to a single partition (Durable Object class). When set,
+   * migrate operates ONLY on entities whose `partition` matches — it creates/alters
+   * just that partition's tables and never drops other partitions' tables (a
+   * partition-DO never sees them). The schema hash is stored under a per-partition
+   * key so partitions don't thrash each other's drift detection. When unset, all
+   * entities are migrated and the legacy single-hash key is used (unchanged — the
+   * D1 path and existing callers). */
+  partition?: string;
 }
 
 /** Internal bookkeeping tables the migrator must never touch — pramen's own, SQLite's,
@@ -110,11 +119,28 @@ async function rebuildTable(driver: Driver, table: string, def: { fields: Entity
 }
 
 export async function migrate(driver: Driver, schema: SchemaDef, opts: MigrateOptions = {}): Promise<MigrationReport> {
+  // Static schema invariants (relation targets exist, no cross-partition relations) —
+  // checked before any DDL so a bad schema fails fast on boot / the D1 path, not mid-migration.
+  validateSchema(schema);
   await driver.exec(`CREATE TABLE IF NOT EXISTS _pramen_meta (key TEXT PRIMARY KEY, value TEXT)`, []);
   const allowDestructive = opts.allowDestructive ?? false;
 
-  const current = schemaHash(schema);
-  if ((await readMeta(driver, "schema_hash")) === current)
+  // When a partition is named, narrow the schema to just that partition's entities —
+  // every later pass (create/alter/rebuild/drop/index/hash) iterates this subset, so
+  // a partition-DO only ever touches its own tables. Unset ⇒ the whole schema, the
+  // legacy (default) behavior.
+  const tables = opts.partition === undefined ? Object.keys(schema) : entitiesInPartition(schema, opts.partition);
+  const entries = tables.map((table) => [table, schema[table]!] as const);
+  const inScope = new Set(tables);
+
+  // The schema hash is computed over the in-scope subset only, and stored under a
+  // per-partition meta key, so two partitions of the same app each detect just their
+  // own drift and never invalidate the other. The unscoped path keeps the original
+  // `schema_hash` key for backward compatibility (existing stores + the D1 path).
+  const subset: SchemaDef = Object.fromEntries(entries);
+  const hashKey = opts.partition === undefined ? "schema_hash" : `schema_hash:${opts.partition}`;
+  const current = schemaHash(subset);
+  if ((await readMeta(driver, hashKey)) === current)
     return { changed: false, created: [], added: [], rebuilt: [], droppedTables: [], skipped: [] };
 
   const created: string[] = [];
@@ -123,7 +149,7 @@ export async function migrate(driver: Driver, schema: SchemaDef, opts: MigrateOp
   const droppedTables: string[] = [];
   const skipped: string[] = [];
 
-  for (const [table, def] of Object.entries(schema)) {
+  for (const [table, def] of entries) {
     const existing = await tableColumns(driver, table);
     if (existing.size === 0) {
       await driver.exec(createTableSql(table, def), []);
@@ -131,8 +157,17 @@ export async function migrate(driver: Driver, schema: SchemaDef, opts: MigrateOp
       continue;
     }
     // Pass 1 — additive: add any column the schema declares but the table lacks.
+    // SQLite forbids ALTER ADD COLUMN with a non-constant DEFAULT (e.g. expr.now()),
+    // so such a column is added via a table rebuild instead — which is still additive
+    // (no data loss): the rebuild's INSERT omits the new column, so SQLite applies its
+    // CREATE TABLE default, backfilling existing rows. Flagged here, done in Pass 2.
+    let needsAdditiveRebuild = false;
     for (const [name, field] of Object.entries(def.fields)) {
       if (existing.has(name)) continue;
+      if ((field as FieldDef).defaultExpr !== undefined) {
+        needsAdditiveRebuild = true;
+        continue;
+      }
       await driver.exec(`ALTER TABLE ${ident(table)} ADD COLUMN ${addColumnSql(name, field as FieldDef)}`, []);
       added.push(`${table}.${name}`);
     }
@@ -150,27 +185,38 @@ export async function migrate(driver: Driver, schema: SchemaDef, opts: MigrateOp
     const needsTypeChange = Object.entries(def.fields).some(
       ([n, f]) => live.has(n) && live.get(n) !== sqlType(f as FieldDef),
     );
-    if (needsDrop || needsTypeChange || renamedSources.size > 0) {
-      if (allowDestructive) {
-        await rebuildTable(driver, table, def, live);
-        rebuilt.push(table);
-      } else {
-        skipped.push(`rebuild ${table} (drop/type-change/rename)`);
-      }
+    const destructive = needsDrop || needsTypeChange || renamedSources.size > 0;
+    if (destructive && !allowDestructive) {
+      // The destructive part is gated off — skip the whole rebuild (any pending
+      // expr-default column waits until destructive migrations are allowed).
+      skipped.push(`rebuild ${table} (drop/type-change/rename)`);
+    } else if (destructive || needsAdditiveRebuild) {
+      // An additive-only rebuild (just an expr-default column) needs no permission —
+      // it loses no data.
+      await rebuildTable(driver, table, def, live);
+      rebuilt.push(table);
     }
   }
 
   // Ensure unique/index declarations (idempotent, via IF NOT EXISTS). Indexes can be
   // added to an existing table without a rebuild; a stale index from a removed
   // declaration is left in place (cleanup is future work).
-  for (const [table, def] of Object.entries(schema)) {
+  for (const [table, def] of entries) {
     for (const stmt of indexStatements(table, def)) await driver.exec(stmt, []);
   }
 
   // Drop tables the schema no longer declares (internal bookkeeping tables skipped).
+  // When scoped to a partition, a live table that belongs to ANOTHER partition's
+  // entity must NOT be dropped — a partition-DO never owns it, and even when several
+  // partitions share a store the other partition's reconciler owns that table. So the
+  // drop candidate set is: live tables that are neither in this scope's declared
+  // entities nor declared by any other partition. (Unscoped: `otherPartitionTables`
+  // is empty and `inScope` is every entity, so this is the original behavior.)
+  const otherPartitionTables =
+    opts.partition === undefined ? new Set<string>() : new Set(Object.keys(schema).filter((t) => !inScope.has(t)));
   const liveTables = (await driver.exec(`SELECT name FROM sqlite_master WHERE type = 'table'`, [])) as { name: string }[];
   for (const { name } of liveTables) {
-    if (isInternalTable(name) || name in schema) continue;
+    if (isInternalTable(name) || inScope.has(name) || otherPartitionTables.has(name)) continue;
     if (allowDestructive) {
       await driver.exec(`DROP TABLE ${ident(name)}`, []);
       droppedTables.push(name);
@@ -183,7 +229,7 @@ export async function migrate(driver: Driver, schema: SchemaDef, opts: MigrateOp
   // were skipped, leave the hash so a later deploy (with allowDestructive) retries —
   // additive work is idempotent, so re-running is safe.
   if (skipped.length === 0) {
-    await writeMeta(driver, "schema_hash", current);
+    await writeMeta(driver, hashKey, current);
   } else {
     console.warn(
       `pramen: ${skipped.length} destructive migration(s) skipped (set PRAMEN_ALLOW_DESTRUCTIVE=true to apply): ${skipped.join("; ")}`,

package/src/runtime/registry.ts

@@ -0,0 +1,96 @@
+// DO registry — the source of truth for which `(tenant, partition)` Durable Objects
+// exist. A `DurableObjectNamespace` has NO list/enumerate API (only idFromName /
+// idFromString / newUniqueId / get), so the platform cannot tell us which DOs were
+// ever instantiated. The only way to "work with all DOs" (migrate, recover, browse)
+// is this registry we maintain ourselves: each DO self-registers once (durable-object.ts
+// `ensureRegistered`), and admin ops enumerate via `listDOs`.
+//
+// This file owns the KV key scheme so the Worker and the DO agree on the format. It
+// is deliberately free of `cloudflare:workers` imports — it takes a `KVNamespace`
+// param, mirroring runtime/kv.ts.
+//
+// KEY SCHEME (hard backward-compat requirement):
+//   - default partition  → BARE  `tenant:<t>`        (NO `:default` suffix)
+//   - non-default        →       `tenant:<t>:<p>`
+// The bare-key-for-default rule keeps existing registry entries and DO routing keys
+// unchanged for single-partition apps. Adding a `:default` suffix would orphan all
+// existing data, so it must never appear in a key.
+//
+// NAME RULE: tenant and partition names MUST NOT contain `:`. The key format is
+// `tenant:<t>` / `tenant:<t>:<p>`, so a `:` in a name would make parsing ambiguous
+// (we couldn't tell where the tenant ends and the partition begins). Names are
+// validated at the boundary (here, when building a key) and rejected otherwise.
+
+import { DEFAULT_PARTITION } from "../sdk/schema";
+
+const KEY_PREFIX = "tenant:";
+
+/** A registered Durable Object identity: a (tenant, partition) pair. */
+export interface DoRef {
+  readonly tenant: string;
+  readonly partition: string;
+}
+
+/** Reject a tenant/partition name that would make a registry key ambiguous. A name
+ * may not be empty and may not contain `:` (the key separator). Throws on violation. */
+export function assertValidName(kind: "tenant" | "partition", name: string): void {
+  if (name.length === 0) {
+    throw new Error(`pramen: ${kind} name must not be empty`);
+  }
+  if (name.includes(":")) {
+    throw new Error(`pramen: ${kind} name "${name}" must not contain ':' (it is the registry key separator)`);
+  }
+}
+
+/** Build the registry KV key for a `(tenant, partition)`. The default partition keeps
+ * the bare `tenant:<t>` key (backward-compat); any other partition is `tenant:<t>:<p>`.
+ * Rejects names containing `:` so the key parses unambiguously. */
+export function registryKey(tenant: string, partition: string = DEFAULT_PARTITION): string {
+  assertValidName("tenant", tenant);
+  assertValidName("partition", partition);
+  return partition === DEFAULT_PARTITION ? `${KEY_PREFIX}${tenant}` : `${KEY_PREFIX}${tenant}:${partition}`;
+}
+
+/** Build the Durable Object NAME for a `(tenant, partition)` — the string passed to
+ * `idFromName`. This is the same default/non-default rule as `registryKey` but WITHOUT
+ * the KV `tenant:` prefix: the DO namespace and the KV registry are distinct keyspaces.
+ * Default partition keeps the BARE `tenant` name (byte-for-byte the pre-partition DO
+ * name — a hard backward-compat requirement: changing it would orphan existing DOs);
+ * any other partition is `${tenant}:${partition}`. Keeping it next to `registryKey`
+ * keeps routing and the registry derived from one place. */
+export function partitionDoName(tenant: string, partition: string = DEFAULT_PARTITION): string {
+  assertValidName("tenant", tenant);
+  assertValidName("partition", partition);
+  return partition === DEFAULT_PARTITION ? tenant : `${tenant}:${partition}`;
+}
+
+/** Parse a registry KV key back into a `(tenant, partition)`. A bare `tenant:<t>`
+ * key yields partition `"default"`; `tenant:<t>:<p>` yields `<p>`. Returns null if
+ * the key is not a registry key (missing the `tenant:` prefix). */
+export function parseRegistryKey(key: string): DoRef | null {
+  if (!key.startsWith(KEY_PREFIX)) return null;
+  const rest = key.slice(KEY_PREFIX.length);
+  // At most one `:` remains (names exclude `:`), separating tenant from partition.
+  const sep = rest.indexOf(":");
+  if (sep === -1) return { tenant: rest, partition: DEFAULT_PARTITION };
+  return { tenant: rest.slice(0, sep), partition: rest.slice(sep + 1) };
+}
+
+/** Enumerate every registered `(tenant, partition)` pair from the registry KV.
+ * Paginates over the full listing (cursor / list_complete) — never truncates at the
+ * 1000-key page limit. */
+export async function listDOs(kv: KVNamespace): Promise<DoRef[]> {
+  const out: DoRef[] = [];
+  let cursor: string | undefined;
+  for (;;) {
+    const res = await kv.list({ prefix: KEY_PREFIX, cursor });
+    for (const k of res.keys) {
+      const ref = parseRegistryKey(k.name);
+      if (ref) out.push(ref);
+    }
+    if (res.list_complete) break;
+    cursor = (res as { cursor?: string }).cursor;
+    if (!cursor) break;
+  }
+  return out;
+}