@steve31415/baselib 3.48.2 → 3.49.0

package/dist/db.js

@@ -2,6 +2,7 @@
 // (per-checkout instance — see TESTING.md). Cloud Run: the Cloud SQL Node
 // connector with IAM authentication (CLOUD_SQL_INSTANCE + DB_IAM_USER +
 // DB_NAME env vars) — no database passwords anywhere in the serving path.
+import { createHash } from 'node:crypto';
 import { readdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import pg from 'pg';
@@ -367,8 +368,10 @@ export async function endPool(pool) {
     await allClosed;
 }
 // Plain-SQL migrations: numbered files (001-*.sql, 002-*.sql, …) applied in
-// order, recorded in schema_migrations, each inside a transaction, guarded by
-// an advisory lock so concurrent boots can't race. Applied at service boot.
+// order, recorded in schema_migrations with their content's sha256, each
+// inside a transaction, guarded by an advisory lock so concurrent boots can't
+// race. Applied at service boot; an applied file whose content has since
+// changed fails the boot.
 // Lock loss (see logPoolErrors): all the work runs on the lock's own client,
 // so a dead connection fails the next statement and the boot aborts — no
 // window in which a migration runs unlocked.
@@ -380,18 +383,48 @@ export async function migrate(pool, migrationsDir, logger) {
         await client.query('select pg_advisory_lock(hashtext($1))', ['baselib_migrate']);
         await client.query(`create table if not exists schema_migrations (
          name text primary key,
-         applied_at timestamptz not null default now()
+         applied_at timestamptz not null default now(),
+         sha256 text
        )`);
-        const { rows } = await client.query('select name from schema_migrations');
-        const done = new Set(rows.map((r) => r.name));
+        await client.query('alter table schema_migrations add column if not exists sha256 text');
+        const { rows } = await client.query('select name, sha256 from schema_migrations');
+        const recorded = new Map(rows.map((r) => [r.name, r.sha256]));
+        const contents = new Map();
         for (const file of files) {
-            if (done.has(file))
-                continue;
             const sql = await readFile(join(migrationsDir, file), 'utf8');
+            contents.set(file, { sql, sha256: createHash('sha256').update(sql).digest('hex') });
+        }
+        // A shipped migration file is never edited (plasticine-way docs/DATABASE.md): the
+        // runner skips a recorded name, so an edit would never reach the database while the
+        // code relying on it ships. Refuse to boot instead, before applying anything, so the
+        // new revision fails its start and the old one keeps serving (people, 2026-11-02).
+        // Rows recorded before hashes were kept get the file's current hash, once.
+        const edited = [];
+        for (const file of files) {
+            if (!recorded.has(file))
+                continue;
+            const { sha256 } = contents.get(file);
+            const was = recorded.get(file);
+            if (was == null) {
+                await client.query('update schema_migrations set sha256 = $2 where name = $1', [file, sha256]);
+            }
+            else if (was !== sha256) {
+                edited.push(file);
+            }
+        }
+        if (edited.length > 0) {
+            throw new Error(`migration ${edited.join(', ')} was edited after it was applied; a shipped migration is never ` +
+                'edited: restore the file and put the change in a new migration (a local database holding an ' +
+                'unshipped draft: drop it and re-run)');
+        }
+        for (const file of files) {
+            if (recorded.has(file))
+                continue;
+            const { sql, sha256 } = contents.get(file);
             try {
                 await client.query('begin');
                 await client.query(sql);
-                await client.query('insert into schema_migrations (name) values ($1)', [file]);
+                await client.query('insert into schema_migrations (name, sha256) values ($1, $2)', [file, sha256]);
                 await client.query('commit');
             }
             catch (err) {

package/dist/extension-self-update.d.ts

@@ -46,13 +46,25 @@ export declare function codeIdOf(files: Record<string, string>): Promise<string>
  */
 export declare function diskCode(): Promise<string | null>;
 /**
- * Record the code Chrome just loaded. Call from runtime.onInstalled and
- * runtime.onStartup — the moments Chrome reads the extension from disk — and
- * nowhere else: a worker restarting after eviction runs the code loaded
- * earlier, whatever the disk holds now.
+ * Record the code Chrome just loaded. Call from runtime.onInstalled ONLY: that
+ * is when Chrome registers the worker script afresh from disk (install,
+ * chrome.runtime.reload(), a click on reload). Not from runtime.onStartup: a
+ * browser restart re-reads an unpacked extension's manifest and content
+ * scripts from disk but keeps running the worker script it registered
+ * earlier, even when the file on disk changed (measured 2026-11-02: Lurch's
+ * card said 2.6 after a restart while its worker still ran 2.5's code). And
+ * never on a worker restart after eviction, which also runs the registered
+ * script whatever the disk holds now.
  */
 export declare function recordLoadedCode(): Promise<string>;
-/** The code this extension runs: the record from its last load (re-taken when the record predates this manifest). */
+/**
+ * The code this extension runs: the record from its last load. 'unverified'
+ * when there is no record, or when the record predates the manifest Chrome now
+ * shows (a browser restart picked up a new manifest while the worker may still
+ * be the old script) — never re-read from disk, which would label an old
+ * worker as the new code. 'unverified' differs from every deployed id, so the
+ * extension reloads itself into the deployed code once it is on disk.
+ */
 export declare function loadedCode(): Promise<string>;
 /** Mark the extension busy for BUSY_LEASE_MS (an open overlay calls this through the worker every ~10 s). */
 export declare function extendBusyLease(now?: number): Promise<void>;

package/dist/extension-self-update.js

@@ -105,10 +105,15 @@ export async function diskCode() {
     return id;
 }
 /**
- * Record the code Chrome just loaded. Call from runtime.onInstalled and
- * runtime.onStartup — the moments Chrome reads the extension from disk — and
- * nowhere else: a worker restarting after eviction runs the code loaded
- * earlier, whatever the disk holds now.
+ * Record the code Chrome just loaded. Call from runtime.onInstalled ONLY: that
+ * is when Chrome registers the worker script afresh from disk (install,
+ * chrome.runtime.reload(), a click on reload). Not from runtime.onStartup: a
+ * browser restart re-reads an unpacked extension's manifest and content
+ * scripts from disk but keeps running the worker script it registered
+ * earlier, even when the file on disk changed (measured 2026-11-02: Lurch's
+ * card said 2.6 after a restart while its worker still ran 2.5's code). And
+ * never on a worker restart after eviction, which also runs the registered
+ * script whatever the disk holds now.
  */
 export async function recordLoadedCode() {
     const code = (await diskCode()) ?? 'unverified';
@@ -116,13 +121,20 @@ export async function recordLoadedCode() {
     await chrome.storage.local.set({ [LOADED_KEY]: record });
     return code;
 }
-/** The code this extension runs: the record from its last load (re-taken when the record predates this manifest). */
+/**
+ * The code this extension runs: the record from its last load. 'unverified'
+ * when there is no record, or when the record predates the manifest Chrome now
+ * shows (a browser restart picked up a new manifest while the worker may still
+ * be the old script) — never re-read from disk, which would label an old
+ * worker as the new code. 'unverified' differs from every deployed id, so the
+ * extension reloads itself into the deployed code once it is on disk.
+ */
 export async function loadedCode() {
     const { [LOADED_KEY]: stored } = await chrome.storage.local.get(LOADED_KEY);
     const record = stored;
     if (record && typeof record.code === 'string' && record.version === chrome.runtime.getManifest().version)
         return record.code;
-    return recordLoadedCode();
+    return 'unverified';
 }
 /** Mark the extension busy for BUSY_LEASE_MS (an open overlay calls this through the worker every ~10 s). */
 export async function extendBusyLease(now = Date.now()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steve31415/baselib",
-  "version": "3.48.2",
+  "version": "3.49.0",
   "description": "Plasticine new-world shared platform library: logging, auth, service-to-service auth, db, HTTP, sync, app updates",
   "type": "module",
   "license": "MIT",