@substrat-run/adapter-cloudflare 0.124.0 → 0.126.0

package/dist/live-reads.d.ts

@@ -39,8 +39,12 @@ export declare const LIVE_SCOPE_HEADER = "x-substrat-live-scope";
  * is how somebody reports "live updates are broken" two months later and nobody can
  * establish whether they ever worked on that hostname. One header makes the fallback a
  * fact the client can log, display, and report.
+ *
+ * Defined in the kernel (#1859), because the pure host's `501` names it too and a
+ * vertical's dev server should not import this adapter to spell it. Re-exported here so
+ * `host.ts` and `scope-do.ts` keep reading every wire name from this one file.
  */
-export declare const LIVE_MODE_HEADER = "x-substrat-live";
+export { LIVE_MODE_HEADER, type LiveRefusal } from '@substrat-run/kernel';
 /**
  * Cloudflare's own per-request marker for orange-to-orange routing.
  *
@@ -58,12 +62,6 @@ export declare const LIVE_MODE_HEADER = "x-substrat-live";
  * cheaper than a matrix and correct on the request after the tenant changes their DNS.
  */
 export declare const O2O_HEADER = "cf-connecting-o2o";
-/** Why a subscription was refused — the value of `LIVE_MODE_HEADER` on a refusal. */
-export type LiveRefusal = 
-/** This connection cannot carry a WebSocket; the client should keep polling. */
-'poll'
-/** The request was not an upgrade at all — a programming error at the caller. */
- | 'not-an-upgrade';
 /**
  * What a subscribed socket remembers about itself across a hibernation.
  *
@@ -103,8 +101,8 @@ export declare function readSubscription(attachment: unknown): LiveSubscription
  * reaching it means something unusual happened rather than something normal being cut off.
  */
 export declare const LIVE_FANOUT_LIMIT = 200;
-/** Is this request asking to be upgraded to a WebSocket? */
-export declare function isUpgradeRequest(request: Request): boolean;
+/** Is this request asking to be upgraded to a WebSocket? Defined in the kernel (#1859). */
+export { isUpgradeRequest } from '@substrat-run/kernel';
 /**
  * Is this request arriving over an orange-to-orange hop?
  *

package/dist/live-reads.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-reads.d.ts","sourceRoot":"","sources":["../src/live-reads.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAE9E;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AACjE,eAAO,MAAM,kBAAkB,2BAA2B,CAAC;AAC3D,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,UAAU,sBAAsB,CAAC;AAE9C,qFAAqF;AACrF,MAAM,MAAM,WAAW;AACrB,gFAAgF;AAC9E,MAAM;AACR,iFAAiF;GAC/E,gBAAgB,CAAC;AAErB;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAa7E;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAI1D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE1D"}
+{"version":3,"file":"live-reads.d.ts","sourceRoot":"","sources":["../src/live-reads.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAE9E;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AACjE,eAAO,MAAM,kBAAkB,2BAA2B,CAAC;AAC3D,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAE1E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,UAAU,sBAAsB,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAa7E;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC,2FAA2F;AAC3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE1D"}

package/dist/live-reads.js

@@ -27,8 +27,12 @@ export const LIVE_SCOPE_HEADER = 'x-substrat-live-scope';
  * is how somebody reports "live updates are broken" two months later and nobody can
  * establish whether they ever worked on that hostname. One header makes the fallback a
  * fact the client can log, display, and report.
+ *
+ * Defined in the kernel (#1859), because the pure host's `501` names it too and a
+ * vertical's dev server should not import this adapter to spell it. Re-exported here so
+ * `host.ts` and `scope-do.ts` keep reading every wire name from this one file.
  */
-export const LIVE_MODE_HEADER = 'x-substrat-live';
+export { LIVE_MODE_HEADER } from '@substrat-run/kernel';
 /**
  * Cloudflare's own per-request marker for orange-to-orange routing.
  *
@@ -87,12 +91,8 @@ export function readSubscription(attachment) {
  * reaching it means something unusual happened rather than something normal being cut off.
  */
 export const LIVE_FANOUT_LIMIT = 200;
-/** Is this request asking to be upgraded to a WebSocket? */
-export function isUpgradeRequest(request) {
-    // Case-insensitive: the header is `Upgrade: websocket` by the RFC, but the token is
-    // compared case-insensitively there too, and browsers are not the only clients.
-    return (request.headers.get('Upgrade') ?? '').toLowerCase() === 'websocket';
-}
+/** Is this request asking to be upgraded to a WebSocket? Defined in the kernel (#1859). */
+export { isUpgradeRequest } from '@substrat-run/kernel';
 /**
  * Is this request arriving over an orange-to-orange hop?
  *

package/dist/live-reads.js.map

@@ -1 +1 @@
-{"version":3,"file":"live-reads.js","sourceRoot":"","sources":["../src/live-reads.ts"],"names":[],"mappings":"AAaA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAC;AA0B9C;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmB;IAClD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,CAAC,GAAG,UAA8D,CAAC;IACzE,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO;QACL,SAAS,EAAE,CAAC,CAAC,SAAwB;QACrC,QAAQ,EAAE,CAAC,CAAC,QAAoB;QAChC,OAAO,EAAE,CAAC,CAAC,OAAkB;QAC7B,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,oFAAoF;IACpF,gFAAgF;IAChF,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC;AACjD,CAAC"}
+{"version":3,"file":"live-reads.js","sourceRoot":"","sources":["../src/live-reads.ts"],"names":[],"mappings":"AAaA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,gBAAgB,EAAoB,MAAM,sBAAsB,CAAC;AAE1E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAC;AAmB9C;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmB;IAClD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,CAAC,GAAG,UAA8D,CAAC;IACzE,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO;QACL,SAAS,EAAE,CAAC,CAAC,SAAwB;QACrC,QAAQ,EAAE,CAAC,CAAC,QAAoB;QAChC,OAAO,EAAE,CAAC,CAAC,OAAkB;QAC7B,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC,2FAA2F;AAC3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC;AACjD,CAAC"}

package/dist/scope-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAWL,KAAK,WAAW,EAqCjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAmCL,KAAK,SAAS,EAmBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAoEtB,MAAM,sBAAsB,CAAC;AAiF9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAwaD;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAgDxG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwDxD;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAo5JjE"}
+{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAcL,KAAK,WAAW,EAqCjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAmCL,KAAK,SAAS,EAmBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAoEtB,MAAM,sBAAsB,CAAC;AAmF9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAsbD;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAgDxG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwDxD;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAs7JjE"}

package/dist/scope-do.js

@@ -1,12 +1,13 @@
 import { REWIND_REFUSED } from './rewind-refusal.js';
 import { DurableObject } from 'cloudflare:workers';
-import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, requestFingerprint, substratError, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
 import { ulid, DO_SQL_LIMITS, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, IDEMPOTENCY_DDL, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
 import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { OperationQueue } from './serialization.js';
 import { doScopedSql, doSpineSql } from './sql.js';
-import { actorOf, admitPeer, collectPeers, switchPeer, assertNoSecret, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, resolveCapabilitySession, revokeCapabilityAsPlatform, domainEventOf, facetEvents, readDeadLetters, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
+import { actorOf, admitPeer, collectPeers, switchPeer, assertNoSecret, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, resolveCapabilitySession, revokeCapabilityAsPlatform, domainEventOf, facetEvents, readDeadLetters, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
 import { createDoTupleChecker, createLocalControlPlaneReader } from './checker.js';
+import { repointScopeGrants } from '@substrat-run/kernel';
 /**
  * The key marking a scope DO whose storage was destroyed (`destroyStorage`).
  * Written after `deleteAll()` so it survives the wipe, and never cleared: `reaped`
@@ -341,6 +342,19 @@ const KERNEL_DDL = `
  * In-process — the SQLite adapter, a handler in the same isolate — the real class
  * arrives and `errorCodeOf` reads it directly.
  */
+/**
+ * #1864: the kernel's own events (attachments, capability exchanges) written through the
+ * context an operation runs in, WITHOUT `ctx.emit`'s refusal of kernel-authored types. Keyed
+ * by the context object and never exported, so module code — which can reach `ctx` but not
+ * this map — cannot write one. Registered as each context is built.
+ */
+const kernelEmitters = new WeakMap();
+function kernelEmit(ctx, event) {
+    const write = kernelEmitters.get(ctx);
+    if (!write)
+        throw new Error('kernelEmit: not an operation context this host built');
+    write(event);
+}
 function toRpcError(err) {
     if (err instanceof Error) {
         return err.constructor === Error ? err : new Error(err.message);
@@ -556,8 +570,20 @@ export function defineScopeDO(modules, bareOps) {
         lastFailure = null;
         /** Passes of `applyPendingMigrations` that had work to do — see `migrationAttemptsOnInstance`. */
         migrationRuns = 0;
+        /**
+         * TEST-ONLY (#1860): no production code reads this. An exact `'ping'` is answered
+         * by `setWebSocketAutoResponse` without reaching `webSocketMessage` at all, and
+         * this count is how a test proves that from outside the object — read through
+         * `runInDurableObject` — rather than assuming the runtime's documented behaviour.
+         */
+        webSocketMessagesHandled = 0;
         constructor(ctx, env) {
             super(ctx, env);
+            // #1860: the client's 45s keep-alive (demos/ticket0/app/src/feed.ts) answered at
+            // the runtime level, before this object wakes for it. Without this, every idle
+            // subscriber's ping still reaches `webSocketMessage` and pins the DO in memory —
+            // exactly the hibernation cost `acceptWebSocket` (below) exists to avoid.
+            ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair('ping', 'pong'));
             this.sql = ctx.storage.sql;
             for (const stmt of splitSqlStatements(KERNEL_DDL)) {
                 this.sql.exec(stmt);
@@ -1233,16 +1259,17 @@ export function defineScopeDO(modules, bareOps) {
                 // BOTH stores, because a scope check consults both: rule 2 inheritance makes a
                 // tenant-level grant enforceable here exactly as a scope-level one is, and the
                 // projected `_substrat_tenant_tuples` is where this DO holds them. A read-back
-                // that disagreed with enforcement would be worse than none.
+                // that disagreed with enforcement would be worse than none. GLOB, not LIKE (#1869):
+                // case-sensitive, as the checker's match is.
                 const rows = [
                     ...this.sql
                         .exec(`SELECT subject, relation, expires_at FROM _substrat_tuples
-               WHERE subject LIKE 'connection:%' AND relation LIKE 'granted:%'
+               WHERE subject GLOB 'connection:*' AND relation GLOB 'granted:*'
                  AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)`, now)
                         .toArray(),
                     ...this.sql
                         .exec(`SELECT subject, relation, expires_at FROM _substrat_tenant_tuples
-               WHERE subject LIKE 'connection:%' AND relation LIKE 'granted:%'
+               WHERE subject GLOB 'connection:*' AND relation GLOB 'granted:*'
                  AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?)`, now)
                         .toArray(),
                 ];
@@ -1827,8 +1854,14 @@ export function defineScopeDO(modules, bareOps) {
          * Deliberately NOT a place to let a client narrow or widen what it receives: a
          * filter the client chooses is a filter the client can choose wrongly, and the
          * only filter that matters here is the one it does not control.
+         *
+         * #1860: an exact `'ping'` is now answered by `setWebSocketAutoResponse` in the
+         * constructor, at the runtime level, without waking this object — so this branch no
+         * longer runs for it. Kept as the documented fallback for a client on an older
+         * build, or a hop where the runtime's auto-response is unavailable.
          */
         webSocketMessage(ws, message) {
+            this.webSocketMessagesHandled++;
             if (message === 'ping')
                 ws.send('pong');
         }
@@ -2071,7 +2104,7 @@ export function defineScopeDO(modules, bareOps) {
                  (id, entity_type, entity_id, filename, content_type, size, sha256,
                   visibility, created_by, created_at)
                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, parsed.id, parsed.entity.entityType, parsed.entity.entityId, parsed.filename, parsed.contentType, parsed.size, parsed.sha256, parsed.visibility, parsed.createdBy, parsed.createdAt);
-                        ctx.emit({
+                        kernelEmit(ctx, {
                             type: ATTACHMENT_ADDED,
                             schemaVersion: 1,
                             entity: parsed.entity,
@@ -2167,7 +2200,7 @@ export function defineScopeDO(modules, bareOps) {
                         const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, undefined, undefined, undefined, 'attachments.remove');
                         assertAllowed(await ctx.check(gate.write, record.entity));
                         this.sql.exec('DELETE FROM _substrat_attachments WHERE id = ?', attachmentId);
-                        ctx.emit({
+                        kernelEmit(ctx, {
                             type: ATTACHMENT_REMOVED,
                             schemaVersion: 1,
                             entity: record.entity,
@@ -2574,7 +2607,7 @@ export function defineScopeDO(modules, bareOps) {
                         // Stamped `{ capability }` by the ordinary emit path, under the exchange's own
                         // pseudo-operation name — the actor is the capability, as on every event it
                         // goes on to cause.
-                        emit: (capability, event) => this.operationContext(principalId.parse(ulid()), tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, CAPABILITY_EXCHANGE_OPERATION, capability, [], now).emit(event),
+                        emit: (capability, event) => kernelEmit(this.operationContext(principalId.parse(ulid()), tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, CAPABILITY_EXCHANGE_OPERATION, capability, [], now), event),
                     }, secret, mode);
                 });
                 if (outcome)
@@ -3386,11 +3419,7 @@ export function defineScopeDO(modules, bareOps) {
                     this.sql.exec(stmt);
             });
         }
-        async importDump(tables, destScopeId, 
-        /** The directory's recorded-off modules (#1742), switched off on `destScopeId` right after
-         *  the replay re-points the grants, in the same event: a dump from before the switch was
-         *  pulled carries the grants live and no marker. Needs `destScopeId`, the scope restored. */
-        switchOff) {
+        async importDump(tables, destScopeId, { switchOff, sourceScopeId, exact, } = {}) {
             // The WHOLE drop-then-replay runs under deferred foreign keys, in one transaction.
             //
             // Two distinct FK hazards, and both need the deferral — the second is why it cannot
@@ -3419,6 +3448,10 @@ export function defineScopeDO(modules, bareOps) {
             // only the first statement, so the text itself has to be the one statement.
             // Pure input validation, so it runs before the first DROP: a refused dump touches nothing.
             assertReplayableDump(replayable, { maxColumns: DO_SQL_LIMITS.columns });
+            // #1869: `exact` vouches for a named source; without one it would silently fall back.
+            if (exact && !sourceScopeId) {
+                throw substratError('validation_failed', 'restore refused: `exact` needs the scope the dump came from');
+            }
             const switched = await this.ctx.storage.transaction(async () => {
                 this.sql.exec('PRAGMA defer_foreign_keys = ON');
                 // Real tables only; `sqlite_*` internals are auto-managed and un-droppable.
@@ -3469,7 +3502,7 @@ export function defineScopeDO(modules, bareOps) {
                 // Re-point the restored grants at THIS scope (after the spine exists, so a dump
                 // that carried no tuples table still finds one here).
                 if (destScopeId)
-                    this.rewriteScopeTuples(destScopeId);
+                    this.rewriteScopeTuples(destScopeId, sourceScopeId && { scopeId: sourceScopeId, exact });
                 // #1742: the recorded-off modules go back off INSIDE the replay's transaction, with
                 // the spine and the re-point. A switch that throws rolls the whole restore back, so
                 // the dump's grants never commit live without the switch that should cover them.
@@ -3539,14 +3572,14 @@ export function defineScopeDO(modules, bareOps) {
          * `_substrat_tenant_tuples`, which this does not attempt — a cross-tenant restore is a
          * governed copy, not a repair.
          *
+         * Which rows move is `repointScopeGrants`'s (#1869): the dump's source scope, exactly.
+         *
          * `UPDATE OR REPLACE` because (subject, relation, object) is the primary key: if the
          * dump already held a tuple for the destination scope, the rewritten row collapses
          * onto it instead of failing the whole restore.
          */
-        rewriteScopeTuples(destScopeId) {
-            this.sql.exec(`UPDATE OR REPLACE _substrat_tuples
-            SET object = ?
-          WHERE object LIKE 'scope:%' AND object <> ?`, `scope:${destScopeId}`, `scope:${destScopeId}`);
+        rewriteScopeTuples(destScopeId, source) {
+            repointScopeGrants(this.switchSql(), destScopeId, source);
         }
         /**
          * Wipe this scope's storage — the reap half of deleteSnapshot (preview-and-
@@ -3918,6 +3951,51 @@ export function defineScopeDO(modules, bareOps) {
                 }
                 return checker.covers(subject, role.permissions, { tenantId, scopeId });
             };
+            // ctx.emit's writer, and the kernel's own events' (#1864): one path to the outbox, with the
+            // reserved-type refusal applied to module code only. Never handed to module code as-is.
+            const writeEvent = (event, author) => {
+                assertImpersonationWrites(impersonation, 'ctx.emit');
+                const parsed = domainEventInput.parse(event);
+                // #1864: a kernel-authored type is the kernel's to write — module code cannot forge one.
+                if (author === 'module')
+                    assertModuleEmittableType(parsed.type);
+                else
+                    assertKernelAuthoredType(parsed.type); // a new kernel event must join the reserved set
+                // #1672: the COMPLETE parsed event — entity id, type and subject as well as payload.
+                assertNoSecret('ctx.emit', parsed, minted);
+                const full = domainEvent.parse({
+                    ...parsed,
+                    // #956: from the operation's instant, not a second reading of the clock.
+                    // `ORDER BY id` is how the outbox and every timeline page, so an id whose
+                    // timestamp disagreed with its own `occurredAt` sorted the log by a clock
+                    // nothing else in the operation used.
+                    id: eventId.parse(mintEventId(Date.parse(at))),
+                    occurredAt: at,
+                    tenantId,
+                    scopeId,
+                    actor: systemActor ?? derivedActor,
+                    ...(passed.length ? { authorization: passed.map((p) => ({ ...p })) } : {}),
+                    ...(stamp ? { impersonation: stamp } : {}),
+                    // #1231: kernel-stamped like the two above — `domainEventInput.parse`
+                    // already stripped anything module code tried to smuggle under this key.
+                    ...(operation ? { operation } : {}),
+                });
+                sql.exec(`INSERT INTO _substrat_outbox
+             (id, type, schema_version, occurred_at, tenant_id, scope_id, actor,
+              entity_type, entity_id, pii_class, subject_id, authorization,
+              impersonation, operation, version, caused_by, invocation_id, payload)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, full.id, full.type, full.schemaVersion, full.occurredAt, full.tenantId, full.scopeId, JSON.stringify(full.actor), full.entity.entityType, full.entity.entityId, full.piiClass, full.subjectId ?? null, full.authorization ? JSON.stringify(full.authorization) : null, full.impersonation ? JSON.stringify(full.impersonation) : null, full.operation ?? null, 
+                // #1242: script configuration, not envelope data — the version is a fact
+                // about the deploy, so it never rides `DomainEvent` for module code to
+                // branch on; it exists for the observability joins the column serves.
+                this.env.SUBSTRAT_VERSION_ID ?? null, 
+                // #1237: whatever delivery is in flight, if any — read off the DO the same
+                // way the version is read off its env. A fact about the surrounding
+                // dispatch, never envelope data module code could set or branch on.
+                this.causedBy, 
+                // #1237: a fact about the surrounding CALL, like the version above.
+                this.invocationId, full.payload === undefined ? null : JSON.stringify(full.payload));
+            };
             const ctxRef = {
                 tenantId,
                 scopeId,
@@ -3939,44 +4017,7 @@ export function defineScopeDO(modules, bareOps) {
                     // log's text is not JSON.
                     redact: (text) => redactSecretText(text, minted),
                 }),
-                emit: (event) => {
-                    assertImpersonationWrites(impersonation, 'ctx.emit');
-                    const parsed = domainEventInput.parse(event);
-                    // #1672: the COMPLETE parsed event — entity id, type and subject as well as payload.
-                    assertNoSecret('ctx.emit', parsed, minted);
-                    const full = domainEvent.parse({
-                        ...parsed,
-                        // #956: from the operation's instant, not a second reading of the clock.
-                        // `ORDER BY id` is how the outbox and every timeline page, so an id whose
-                        // timestamp disagreed with its own `occurredAt` sorted the log by a clock
-                        // nothing else in the operation used.
-                        id: eventId.parse(mintEventId(Date.parse(at))),
-                        occurredAt: at,
-                        tenantId,
-                        scopeId,
-                        actor: systemActor ?? derivedActor,
-                        ...(passed.length ? { authorization: passed.map((p) => ({ ...p })) } : {}),
-                        ...(stamp ? { impersonation: stamp } : {}),
-                        // #1231: kernel-stamped like the two above — `domainEventInput.parse`
-                        // already stripped anything module code tried to smuggle under this key.
-                        ...(operation ? { operation } : {}),
-                    });
-                    sql.exec(`INSERT INTO _substrat_outbox
-               (id, type, schema_version, occurred_at, tenant_id, scope_id, actor,
-                entity_type, entity_id, pii_class, subject_id, authorization,
-                impersonation, operation, version, caused_by, invocation_id, payload)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, full.id, full.type, full.schemaVersion, full.occurredAt, full.tenantId, full.scopeId, JSON.stringify(full.actor), full.entity.entityType, full.entity.entityId, full.piiClass, full.subjectId ?? null, full.authorization ? JSON.stringify(full.authorization) : null, full.impersonation ? JSON.stringify(full.impersonation) : null, full.operation ?? null, 
-                    // #1242: script configuration, not envelope data — the version is a fact
-                    // about the deploy, so it never rides `DomainEvent` for module code to
-                    // branch on; it exists for the observability joins the column serves.
-                    this.env.SUBSTRAT_VERSION_ID ?? null, 
-                    // #1237: whatever delivery is in flight, if any — read off the DO the same
-                    // way the version is read off its env. A fact about the surrounding
-                    // dispatch, never envelope data module code could set or branch on.
-                    this.causedBy, 
-                    // #1237: a fact about the surrounding CALL, like the version above.
-                    this.invocationId, full.payload === undefined ? null : JSON.stringify(full.payload));
-                },
+                emit: (event) => writeEvent(event, 'module'),
                 requestPlatform: (request) => {
                     assertImpersonationWrites(impersonation, 'ctx.requestPlatform');
                     const input = platformRequestInput.parse(request);
@@ -4070,6 +4111,7 @@ export function defineScopeDO(modules, bareOps) {
                  */
                 grant: async (principal, permission, entity) => {
                     assertImpersonationWrites(impersonation, 'ctx.grant');
+                    entityObjectRef(entity, 'ctx.grant'); // #1856: a tuple the walk can read back
                     const held = await runCheck(permission, entity);
                     if (!held.allowed) {
                         throw new PermissionDenied(`cannot grant '${permission}' on ${entity.entityType}:${entity.entityId} — ` +
@@ -4077,6 +4119,11 @@ export function defineScopeDO(modules, bareOps) {
                     }
                     sql.exec(`INSERT OR IGNORE INTO _substrat_tuples (subject, relation, object) VALUES (?, ?, ?)`, `principal:${principal}`, `granted:${permission}`, `${entity.entityType}:${entity.entityId}`);
                 },
+                /**
+                 * Deliberately NOT the #1856 grammar check `grant` and `link` make: a revoke writes
+                 * nothing the walk must read back, and a grant stored before that check existed must
+                 * stay removable.
+                 */
                 revoke: async (principal, permission, entity) => {
                     assertImpersonationWrites(impersonation, 'ctx.revoke');
                     const held = await runCheck(permission, entity);
@@ -4098,21 +4145,19 @@ export function defineScopeDO(modules, bareOps) {
                     subject: systemActor ? { kind: 'system', id: systemActor.system } : subject,
                     now: at,
                     check: runCheck,
-                    emit: (event) => ctxRef.emit(event),
+                    emit: (event) => writeEvent(event, 'kernel'),
                     isOperation: (name) => this.operations.has(name),
                     assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
                     minted,
                 }),
-                link: (child, parent) => {
-                    assertImpersonationWrites(impersonation, 'ctx.link');
-                    const allowed = relations.get(child.entityType);
-                    if (!allowed?.has(parent.entityType)) {
-                        throw new Error(`undeclared entity relation: ${child.entityType} → ${parent.entityType} ` +
-                            `(declare it in a module manifest's entityRelations)`);
-                    }
-                    sql.exec(`INSERT OR IGNORE INTO _substrat_tuples (subject, relation, object)
-             VALUES (?, 'parent', ?)`, `${child.entityType}:${child.entityId}`, `${parent.entityType}:${parent.entityId}`);
-                },
+                // K-16 / #1864: link and relink, written once in the kernel over the raw spine seam.
+                ...createEntityEdgeVerbs({
+                    sql: doSpineSql(sql),
+                    relations,
+                    now: at,
+                    emit: (event) => writeEvent(event, 'kernel'),
+                    assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
+                }),
                 entitlement: async (key) => {
                     const held = await entitlementReader().listEntitlements(tenantId);
                     return held.find((e) => e.key === key) ?? null;
@@ -4136,6 +4181,7 @@ export function defineScopeDO(modules, bareOps) {
                     return sealTo({ keyId: row.key_id, publicKey: row.public_key }, plaintext);
                 },
             };
+            kernelEmitters.set(ctxRef, (event) => writeEvent(event, 'kernel'));
             return ctxRef;
         }
         /** True once this scope has had entitlements projected at least once (#304) — the switch