@substrat-run/adapter-cloudflare 0.120.0 → 0.121.0

package/dist/index.d.ts

@@ -14,13 +14,14 @@
  *                               driving `drainDue`/`runDueSchedules` per scope (#461)
  */
 export { CloudflareScopeHost } from './host.js';
-export type { CloudflareScopeHostOptions, ConnectorDelegation, EventDrainDelegation, PeerSwitchDelegation, SystemSwitchDelegation, } from './host.js';
+export type { CloudflareScopeHostOptions, ConnectorDelegation, EventDrainDelegation, PeerSwitchDelegation, ImportCursorDelegation, SystemSwitchDelegation, } from './host.js';
 export { defineScopeDO } from './scope-do.js';
 export { ControlPlaneDO } from './control-plane-do.js';
 export { OperationQueue } from './serialization.js';
 export { doScopedSql } from './sql.js';
 export { createDoTupleChecker } from './checker.js';
 export { definePlatformSweeperDO, PLATFORM_SWEEPER_NAME } from './platform-sweeper-do.js';
+export { defineKickCoalescerDO, kickCoalescerName, CROSS_VERTICAL_KICK_WINDOW_MS, type KickCoalescerConfig, type KickCoalescerDo, type KickOutcome, type KickProducer, } from './kick-coalescer-do.js';
 export type { PlatformSweeperDoConfig, PlatformSweepOutcome } from './platform-sweeper-do.js';
 export { defineScopeSweeperDO, SCOPE_SWEEPER_NAME } from './scope-sweeper-do.js';
 export type { ScopeSweeperDo, ScopeSweeperDoConfig, ScopeSweepHost, ScopeSweepOutcome, ScopeSweepReport, } from './scope-sweeper-do.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,YAAY,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAC1F,YAAY,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,YAAY,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE1F,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -20,6 +20,8 @@ export { OperationQueue } from './serialization.js';
 export { doScopedSql } from './sql.js';
 export { createDoTupleChecker } from './checker.js';
 export { definePlatformSweeperDO, PLATFORM_SWEEPER_NAME } from './platform-sweeper-do.js';
+// #1705 PR 2: the global bound on the router's cross-vertical kick, one object per producer.
+export { defineKickCoalescerDO, kickCoalescerName, CROSS_VERTICAL_KICK_WINDOW_MS, } from './kick-coalescer-do.js';
 export { defineScopeSweeperDO, SCOPE_SWEEPER_NAME } from './scope-sweeper-do.js';
 export { createD1TenantStores, d1TenantRelationalStore, tenantStoreDatabaseName, } from './d1.js';
 export { blobStoreBucketName, createR2BlobStores, r2TenantBlobStore, } from './r2.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAQhD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE1F,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAQjF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG1D,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAShD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAC1F,6FAA6F;AAC7F,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,GAK9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAQjF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG1D,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/kick-coalescer-do.d.ts

@@ -0,0 +1,57 @@
+import { DurableObject } from 'cloudflare:workers';
+import type { ScopeId, TenantId } from '@substrat-run/contracts';
+/**
+ * How long one producer's cross-vertical kicks coalesce (#1705 PR 2): after a pass STARTS, the
+ * next may start no sooner than this. A burst inside the window costs the pass that started it
+ * plus one trailing pass at the window's end, fleet-wide. It is not per isolate, because one
+ * Durable Object per producer holds the bit.
+ */
+export declare const CROSS_VERTICAL_KICK_WINDOW_MS = 5000;
+/** What one kick did: started a pass, joined the one running, or left it for the window's end. */
+export type KickOutcome = 'ran' | 'coalesced' | 'deferred';
+/** The producer a kick names: the scope the router resolved, and its tenant. Nothing else. */
+export interface KickProducer {
+    tenantId: TenantId;
+    scopeId: ScopeId;
+}
+/** The RPC surface a `defineKickCoalescerDO` class exposes over its stub. */
+export interface KickCoalescerDo {
+    kick(tenantId: TenantId, scopeId: ScopeId): Promise<KickOutcome>;
+}
+export interface KickCoalescerConfig<Env> {
+    /** Default {@link CROSS_VERTICAL_KICK_WINDOW_MS}. */
+    windowMs?: number;
+    /**
+     * One pass for this producer. CODE-TIME, closed over like `definePlatformSweeperDO`'s
+     * `sweep`, since a Durable Object cannot receive a closure over RPC. It is where the
+     * authority lives: the deployment runs `runCrossVerticalFrom` here with the same reach and
+     * gates as its sweep, so this object decides only WHEN, never what or for whom.
+     */
+    run(env: Env, producer: KickProducer): Promise<void>;
+    /** A pass that threw. Never rethrown: a lost kick costs latency, and the sweep is the backstop. */
+    onError?(err: unknown, env: Env): void;
+}
+/** The one instance per producer: `ns.get(ns.idFromName(kickCoalescerName(tenantId, scopeId)))`. */
+export declare function kickCoalescerName(tenantId: TenantId, scopeId: ScopeId): string;
+/**
+ * `defineKickCoalescerDO` — the global bound on the router kick (#1705 PR 2).
+ *
+ * The kick is raised by a response header that tenant code sets, so a vertical can raise it on
+ * every response it serves. Each one is a producer-scoped cross-vertical pass: a directory read,
+ * registry reads, and up to `maxConsumers × (1 + 2 × sources)` `/internal` calls. The phase caps
+ * one pass, not passes per unit of time. This object is that second cap, and it holds nothing
+ * else: no authority and no data, only a start time and a dirty bit.
+ *
+ * - A kick with no pass running and none started within the window starts one, and waits for it.
+ * - A kick while a pass runs marks the producer dirty and returns at once. When the pass ends,
+ *   a dirty producer gets one trailing pass at the window's end, by alarm.
+ * - A kick inside the window marks it dirty and returns at once. The same alarm runs the
+ *   trailing pass.
+ *
+ * So passes for one producer start at least `windowMs` apart. A burst of N kicks costs one pass
+ * plus one trailing pass, and nothing a tenant sends can raise that. The trailing pass is what
+ * keeps coalescing lossless: an event committed after the first pass read its outbox is still
+ * moved within one window, not left for the next sweep.
+ */
+export declare function defineKickCoalescerDO<Env>(config: KickCoalescerConfig<Env>): new (ctx: DurableObjectState, env: Env) => DurableObject<Env> & KickCoalescerDo;
+//# sourceMappingURL=kick-coalescer-do.d.ts.map

package/dist/kick-coalescer-do.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kick-coalescer-do.d.ts","sourceRoot":"","sources":["../src/kick-coalescer-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,OAAQ,CAAC;AAEnD,kGAAkG;AAClG,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,WAAW,GAAG,UAAU,CAAC;AAE3D,8FAA8F;AAC9F,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,mBAAmB,CAAC,GAAG;IACtC,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,mGAAmG;IACnG,OAAO,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC;CACxC;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAE9E;AAUD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EACvC,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,GAC/B,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,GAAG,KAAK,aAAa,CAAC,GAAG,CAAC,GAAG,eAAe,CAwEjF"}

package/dist/kick-coalescer-do.js

@@ -0,0 +1,106 @@
+import { DurableObject } from 'cloudflare:workers';
+/**
+ * How long one producer's cross-vertical kicks coalesce (#1705 PR 2): after a pass STARTS, the
+ * next may start no sooner than this. A burst inside the window costs the pass that started it
+ * plus one trailing pass at the window's end, fleet-wide. It is not per isolate, because one
+ * Durable Object per producer holds the bit.
+ */
+export const CROSS_VERTICAL_KICK_WINDOW_MS = 5_000;
+/** The one instance per producer: `ns.get(ns.idFromName(kickCoalescerName(tenantId, scopeId)))`. */
+export function kickCoalescerName(tenantId, scopeId) {
+    return `${tenantId}:${scopeId}`;
+}
+/**
+ * `defineKickCoalescerDO` — the global bound on the router kick (#1705 PR 2).
+ *
+ * The kick is raised by a response header that tenant code sets, so a vertical can raise it on
+ * every response it serves. Each one is a producer-scoped cross-vertical pass: a directory read,
+ * registry reads, and up to `maxConsumers × (1 + 2 × sources)` `/internal` calls. The phase caps
+ * one pass, not passes per unit of time. This object is that second cap, and it holds nothing
+ * else: no authority and no data, only a start time and a dirty bit.
+ *
+ * - A kick with no pass running and none started within the window starts one, and waits for it.
+ * - A kick while a pass runs marks the producer dirty and returns at once. When the pass ends,
+ *   a dirty producer gets one trailing pass at the window's end, by alarm.
+ * - A kick inside the window marks it dirty and returns at once. The same alarm runs the
+ *   trailing pass.
+ *
+ * So passes for one producer start at least `windowMs` apart. A burst of N kicks costs one pass
+ * plus one trailing pass, and nothing a tenant sends can raise that. The trailing pass is what
+ * keeps coalescing lossless: an event committed after the first pass read its outbox is still
+ * moved within one window, not left for the next sweep.
+ */
+export function defineKickCoalescerDO(config) {
+    const windowMs = config.windowMs ?? CROSS_VERTICAL_KICK_WINDOW_MS;
+    return class KickCoalescerDO extends DurableObject {
+        /** The in-flight pass, when one is running. */
+        #running = null;
+        async kick(tenantId, scopeId) {
+            const prior = await this.ctx.storage.get('state');
+            const state = prior ?? { producer: { tenantId, scopeId }, lastStartedAt: 0, dirty: false };
+            if (this.#running) {
+                await this.ctx.storage.put('state', { ...state, dirty: true });
+                return 'coalesced';
+            }
+            const now = Date.now();
+            if (now - state.lastStartedAt < windowMs) {
+                await this.ctx.storage.put('state', { ...state, dirty: true });
+                await this.#armFor(state.lastStartedAt);
+                return 'deferred';
+            }
+            await this.#pass(state);
+            return 'ran';
+        }
+        /**
+         * The window's end: the trailing pass if a kick arrived that no pass has covered, and
+         * otherwise the end of this object. Its storage is deleted, so a producer that kicked once
+         * leaves nothing behind. That waits for the window's end, so a kick after the delete may run
+         * at once without breaking the bound.
+         */
+        async alarm() {
+            const state = await this.ctx.storage.get('state');
+            if (!state || this.#running)
+                return;
+            // The window holds even against an early alarm: re-arm for its end rather than act.
+            if (Date.now() - state.lastStartedAt < windowMs) {
+                await this.#armFor(state.lastStartedAt);
+                return;
+            }
+            if (state.dirty) {
+                await this.#pass(state);
+                return;
+            }
+            await this.ctx.storage.deleteAlarm();
+            await this.ctx.storage.deleteAll();
+        }
+        async #pass(state) {
+            const startedAt = Date.now();
+            await this.ctx.storage.put('state', { ...state, lastStartedAt: startedAt, dirty: false });
+            this.#running = (async () => {
+                try {
+                    await config.run(this.env, state.producer);
+                }
+                catch (err) {
+                    config.onError?.(err, this.env);
+                }
+            })();
+            try {
+                await this.#running;
+            }
+            finally {
+                this.#running = null;
+                // Always, at this window's end: the alarm runs the trailing pass if a kick arrived since
+                // this one started, and clears this object's storage if none did.
+                await this.#armFor(startedAt);
+            }
+        }
+        /** Arm the trailing pass for the end of the window that started at `startedAt`. */
+        async #armFor(startedAt) {
+            const at = startedAt + windowMs;
+            const existing = await this.ctx.storage.getAlarm();
+            if (existing === null || existing > at)
+                await this.ctx.storage.setAlarm(at);
+        }
+    };
+}
+//# sourceMappingURL=kick-coalescer-do.js.map

package/dist/kick-coalescer-do.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kick-coalescer-do.js","sourceRoot":"","sources":["../src/kick-coalescer-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,CAAC;AA8BnD,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAAC,QAAkB,EAAE,OAAgB;IACpE,OAAO,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAC;AAClC,CAAC;AAUD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAgC;IAEhC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,6BAA6B,CAAC;IAClE,OAAO,MAAM,eAAgB,SAAQ,aAAkB;QACrD,+CAA+C;QAC/C,QAAQ,GAAyB,IAAI,CAAC;QAEtC,KAAK,CAAC,IAAI,CAAC,QAAkB,EAAE,OAAgB;YAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAY,OAAO,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAc,KAAK,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YACtG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/D,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,KAAK,CAAC,aAAa,GAAG,QAAQ,EAAE,CAAC;gBACzC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/D,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBACxC,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,KAAK;YACT,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAY,OAAO,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO;YACpC,oFAAoF;YACpF,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,aAAa,GAAG,QAAQ,EAAE,CAAC;gBAChD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,KAAgB;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC1B,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;YACL,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,CAAC;YACtB,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrB,yFAAyF;gBACzF,kEAAkE;gBAClE,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,mFAAmF;QACnF,KAAK,CAAC,OAAO,CAAC,SAAiB;YAC7B,MAAM,EAAE,GAAG,SAAS,GAAG,QAAQ,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,GAAG,EAAE;gBAAE,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/scope-do.d.ts

@@ -1,6 +1,6 @@
 import { DurableObject } from 'cloudflare:workers';
 import { type WireFailure } from '@substrat-run/contracts';
-import { type ModuleRegistration, type OperationHandler } from '@substrat-run/kernel';
+import { type SwitchSql, type ModuleRegistration, type OperationHandler } from '@substrat-run/kernel';
 /**
  * `defineScopeDO` — one Durable Object per scope, the CF analogue of a single
  * `SqliteScopeHost` scope runtime (D-14). It closes over a CODE-TIME module set
@@ -42,6 +42,12 @@ export type CapabilityAttachmentReply<T> = {
 } | {
     failure: WireFailure;
 };
+/**
+ * The kernel's two-method SQL handle (`SwitchSql`) over a Durable Object's storage — what the
+ * shared switch rules (#1666) and the directory's switch record (#1674) run through. One
+ * wrapper for both DOs, as the pure adapter has one `switchSqlOf`.
+ */
+export declare function switchSqlOver(sql: SqlStorage): SwitchSql;
 export declare function splitSqlStatements(sql: string): string[];
 export declare function defineScopeDO(modules: ModuleRegistration[], bareOps: Record<string, OperationHandler<never, unknown>>): new (ctx: DurableObjectState, env: ScopeDoEnv) => DurableObject;
 //# sourceMappingURL=scope-do.d.ts.map

package/dist/scope-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAWL,KAAK,WAAW,EAqCjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAmDL,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EA8DtB,MAAM,sBAAsB,CAAC;AA6E9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAwaD;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAgDxG,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwDxD;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CA48IjE"}
+{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAWL,KAAK,WAAW,EAqCjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAiCL,KAAK,SAAS,EAkBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAgEtB,MAAM,sBAAsB,CAAC;AA+E9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAwaD;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAgDxG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwDxD;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAkgJjE"}

package/dist/scope-do.js

@@ -1,6 +1,6 @@
 import { DurableObject } from 'cloudflare:workers';
 import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexMigrations, searchIndexPlans, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, IDEMPOTENCY_DDL, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
+import { ulid, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, IDEMPOTENCY_DDL, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
 import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { OperationQueue } from './serialization.js';
 import { doScopedSql, doSpineSql } from './sql.js';
@@ -414,6 +414,19 @@ function cellToJson(v) {
  */
 const IS_CREATE_TRIGGER = /^\s*CREATE\s+(TEMP\s+|TEMPORARY\s+)?TRIGGER\b/i;
 const ENDS_WITH_END = /\bEND\s*$/i;
+/**
+ * The kernel's two-method SQL handle (`SwitchSql`) over a Durable Object's storage — what the
+ * shared switch rules (#1666) and the directory's switch record (#1674) run through. One
+ * wrapper for both DOs, as the pure adapter has one `switchSqlOf`.
+ */
+export function switchSqlOver(sql) {
+    return {
+        all: (q, ...params) => sql.exec(q, ...params).toArray(),
+        run: (q, ...params) => {
+            sql.exec(q, ...params);
+        },
+    };
+}
 export function splitSqlStatements(sql) {
     const out = [];
     let cur = '';
@@ -601,11 +614,8 @@ export function defineScopeDO(modules, bareOps) {
             this.crossVertical.register(manifest, registration.imports);
             this.modules.set(manifest.id, {
                 id: manifest.id,
-                migrations: [
-                    ...(registration.migrations ?? []),
-                    ...searchIndexMigrations(manifest.id, manifest.searchables),
-                    ...listIndexMigrations(manifest.id, manifest.lists),
-                ],
+                // The order the kernel writes once (#1677): authored, then search, then list indexes.
+                migrations: moduleMigrations(registration),
                 consumers: Object.entries(registration.consumers ?? {}).map(([eventType, handler]) => ({
                     eventType,
                     handler,
@@ -889,6 +899,35 @@ export function defineScopeDO(modules, bareOps) {
             }));
             return { consumes, cursors };
         }
+        /**
+         * #1705 PR 2: does this DO hold a scope PROVISIONED here for `tenantId`?
+         *
+         * A CP-less deployment has no directory to ask whether it serves a scope. What it does
+         * have is what provisioning wrote: `provisionScopeLocal` projects the vertical's role
+         * definitions under the tenant (`_substrat_roles`), and a restore re-projects them. A scope
+         * this deployment never provisioned has none of that. Its DO is empty, and a cross-vertical
+         * verb answering from it is a wrong answer rather than a failure: a watermark of "never
+         * read", or a delivery journaled into a scope that is not the install. A scope provisioned
+         * for ANOTHER tenant has roles under that tenant's id only, so the same read is K-3's pair
+         * check too.
+         *
+         * Read without migrating, so asking about a foreign scope leaves its DO as empty as it found it.
+         */
+        async servesTenant(tenantId) {
+            const hasRoles = this.sql.exec(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '_substrat_roles'`).toArray().length > 0;
+            if (!hasRoles)
+                return false;
+            return this.sql.exec('SELECT 1 FROM _substrat_roles WHERE tenant_id = ? LIMIT 1', tenantId).toArray().length > 0;
+        }
+        /** #1705 PR 2: the outbox's insertion mark (`OUTBOX_MARK_SQL`). */
+        outboxMark() {
+            return Number(this.sql.exec(OUTBOX_MARK_SQL).toArray()[0]?.mark ?? 0);
+        }
+        /** #1705 PR 2: exported-type rows added above `mark`. */
+        exportedSince(types, mark) {
+            const q = exportedSinceQuery(types, mark);
+            return Number(this.sql.exec(q.sql, ...q.params).toArray()[0]?.n ?? 0);
+        }
         /**
          * #1705: apply a batch another vertical exported. The pure adapter's `deliverToPeer`
          * body, on this scope's queue: the compare-and-set on the watermark, a dead letter per
@@ -1459,6 +1498,11 @@ export function defineScopeDO(modules, bareOps) {
                      * which is the floor this whole surface sits on.
                      */
                     const liveSince = this.liveHighWaterMark();
+                    // #1705 PR 2: the outbox's insertion mark, so the envelope can say whether this
+                    // invoke (or a consumer in its tail) committed an exported type. Only in a deployment
+                    // that exports something, and never for a read-only session, which commits nothing.
+                    const exportTypes = impersonation?.mode === 'read-only' ? [] : this.crossVertical.exportTypes();
+                    const exportMark = exportTypes.length > 0 ? this.outboxMark() : null;
                     let result;
                     let committedVersion = null;
                     // #116: set when this invocation was answered from a recording rather
@@ -1594,9 +1638,14 @@ export function defineScopeDO(modules, bareOps) {
                     // call's own work — the same tail its consumers' emits are stamped in.
                     if (!replayed)
                         await this.settleCommitted(tenantId, scopeId, liveSince, this.invocationId);
+                    // After the tail, so an exported type a consumer emitted in it counts too.
+                    const exported = exportMark !== null && !replayed ? this.exportedSince(exportTypes, exportMark) : 0;
                     return {
                         result,
                         platformRequests: signals.platformRequests,
+                        // #1705 PR 2: the coordinator fires `onExportedEvents` from this. Omitted at 0, so
+                        // the envelope of a deployment that exports nothing is byte-for-byte what it was.
+                        ...(exported > 0 ? { exported } : {}),
                         ...(impersonation ? { impersonation: { honoured: true } } : {}),
                         // #1672: the acknowledgement the coordinator's skew check reads — see `invoke`.
                         ...(capabilitySession !== undefined ? { capability: { honoured: true } } : {}),
@@ -2166,12 +2215,7 @@ export function defineScopeDO(modules, bareOps) {
         }
         /** The kernel's schedule-switch SQL (#1666), over this DO's storage. */
         switchSql() {
-            return {
-                all: (sql, ...params) => this.sql.exec(sql, ...params).toArray(),
-                run: (sql, ...params) => {
-                    this.sql.exec(sql, ...params);
-                },
-            };
+            return switchSqlOver(this.sql);
         }
         /**
          * Where a module's schedules stand on this scope (#383, #1666) — the kernel's
@@ -2215,6 +2259,19 @@ export function defineScopeDO(modules, bareOps) {
         async switchSystemSchedules(moduleId, scopeId, to, at) {
             return this.queue.enqueue(() => this.ctx.storage.transactionSync(() => switchSystemSchedules(this.switchSql(), { moduleId, scopeId, to, at })));
         }
+        /**
+         * The replay lever on this scope (#1705 PR 3): the kernel's `moveImportCursor`, queued with
+         * every `importApply` on this scope and run as one `transactionSync`. A delivery on the same
+         * edge is therefore wholly before the move, or refused by its compare-and-set after it.
+         * Migrated first: the rows a replay moves aside go to `_substrat_import_replays`.
+         */
+        async importCursorMove(input) {
+            await this.ensureMigrations();
+            // The consumer's own running imports decide whether the edge exists: read here, in the
+            // deployment whose handlers would run, never from the platform's request.
+            const imports = this.crossVertical.consumes();
+            return this.queue.enqueue(() => this.ctx.storage.transactionSync(() => moveImportCursor(this.switchSql(), { ...input, imports })));
+        }
         /**
          * Move one PEER's kill switch on this scope (#1706) — the kernel's `switchPeer`, which is
          * the schedule switch's statement with a `vertical:` subject. Queued, one transaction.