@substrat-run/adapter-cloudflare 0.127.0 → 0.129.0

package/dist/scope-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAcL,KAAK,WAAW,EAqCjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAmCL,KAAK,SAAS,EAmBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAoEtB,MAAM,sBAAsB,CAAC;AAmF9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAsbD;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAgDxG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwDxD;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAs7JjE"}
+{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAcL,KAAK,WAAW,EAqCjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAmCL,KAAK,SAAS,EAmBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAoEtB,MAAM,sBAAsB,CAAC;AAsF9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAsbD;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAgDxG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAwDxD;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAq9JjE"}

package/dist/scope-do.js

@@ -4,10 +4,10 @@ import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, do
 import { ulid, DO_SQL_LIMITS, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, JOB_RUN_PATCH_SQL, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexDdl, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, IDEMPOTENCY_DDL, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, jobRunListLimit, } from '@substrat-run/kernel';
 import { isUpgradeRequest, readSubscription, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, } from './live-reads.js';
 import { OperationQueue } from './serialization.js';
-import { doScopedSql, doSpineSql } from './sql.js';
-import { actorOf, admitPeer, collectPeers, switchPeer, assertNoSecret, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, resolveCapabilitySession, revokeCapabilityAsPlatform, domainEventOf, facetEvents, readDeadLetters, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
+import { doScopedSql, doSpineColumnsOf, doSpineSql } from './sql.js';
+import { actorOf, admitPeer, collectPeers, switchPeer, assertNoSecret, CAPABILITY_DDL, CAPABILITY_EXCHANGE_OPERATION, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, resolveCapabilitySession, revokeCapabilityAsPlatform, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
 import { createDoTupleChecker, createLocalControlPlaneReader } from './checker.js';
-import { repointScopeGrants } from '@substrat-run/kernel';
+import { assertNoSpineReference, assertSpineTablesBuilt, dumpRowsInsert, isSpineTable, repointScopeGrants, spineColumnAdditions } from '@substrat-run/kernel';
 /**
  * The key marking a scope DO whose storage was destroyed (`destroyStorage`).
  * Written after `deleteAll()` so it survives the wipe, and never cleared: `reaped`
@@ -1190,6 +1190,10 @@ export function defineScopeDO(modules, bareOps) {
         deadLetters(input) {
             return readDeadLetters({ sql: doScopedSql(this.sql) }, { limit: input.limit, cursor: input.cursor });
         }
+        /** #1744: one entity's lifecycle replayed over this scope's outbox, where it lives. */
+        lifecycleFlow(input) {
+            return readLifecycleFlow({ sql: doScopedSql(this.sql) }, input);
+        }
         migrationBookmarks(limit = 20) {
             return this.sql
                 .exec(`SELECT bookmark, taken_at, pending FROM _substrat_migration_bookmarks
@@ -1337,6 +1341,13 @@ export function defineScopeDO(modules, bareOps) {
                     `the attachments of the entity its event names, and no others`);
             }
         }
+        /** Does `subject` hold a role this scope can expand (#1665)? The #1659 lockout predicate
+         *  narrowed to one holder: a live role tuple, scope or tenant level, for a current role. */
+        async hasEffectiveRoleGrantFor(tenantId, subject) {
+            const q = effectiveRoleGrantQuery(tenantId, new Date().toISOString(), subject);
+            const row = this.sql.exec(q.sql, ...q.params).toArray()[0];
+            return row?.effective === 1;
+        }
         /** Tombstone a scope tuple (K-21) — the row stays, the walk skips it. Returns
          *  whether anything changed so a repeat revoke is a silent no-op. */
         async revokeTuple(subject, relation, object, at) {
@@ -2917,6 +2928,9 @@ export function defineScopeDO(modules, bareOps) {
                                 .exec('SELECT 1 FROM _substrat_migrations WHERE module_id = ? AND version = ?', moduleId, migration.version)
                                 .toArray()[0];
                             if (!already) {
+                                // #1898: a migration runs on this DO's own handle, not `ctx.sql`, so the
+                                // spine guard's REFERENCES rule is applied here.
+                                assertNoSpineReference(migration.sql, `migration ${key}`);
                                 for (const stmt of splitSqlStatements(migration.sql)) {
                                     this.sql.exec(stmt);
                                 }
@@ -2929,6 +2943,10 @@ export function defineScopeDO(modules, bareOps) {
                         // re-parsing the thrown message. The throw stays: `invoke` awaits
                         // `ensureMigrations` on every operation and relies on the rejection to
                         // fail closed, so resolving here would serve a half-migrated schema.
+                        // workerd logs this throw as `Uncaught (in promise)` when it leaves an RPC method,
+                        // as it does every exception an RPC call returns (a dump refusal, a denied check).
+                        // It is not an unhandled rejection: every caller awaits the memoised promise, and
+                        // the coordinator records the failure it receives (#1898 review).
                         this.lastFailure = { version: key, error: err.message };
                         throw new Error(`migration failed for ${key} — scope fails closed: ${err.message}`);
                     }
@@ -3286,7 +3304,7 @@ export function defineScopeDO(modules, bareOps) {
             // carries the rows, never the index over them.
             const defs = this.sql
                 .exec(`SELECT name, sql FROM sqlite_master
-              WHERE type = 'table' AND name NOT LIKE 'sqlite_%' AND sql IS NOT NULL
+              WHERE type = 'table' AND name NOT GLOB 'sqlite_*' AND sql IS NOT NULL
               ORDER BY name`)
                 .toArray().filter(({ name }) => !isSearchIndexTable(name));
             return defs.map(({ name, sql }) => {
@@ -3300,8 +3318,9 @@ export function defineScopeDO(modules, bareOps) {
         }
         /**
          * Load a dump into this (freshly-provisioned) scope — the write half of the fork
-         * (host.ts importScope). Drop-then-replay: the dump's schema is authoritative, so
-         * the provisioning schema is wiped and rebuilt from the dump verbatim.
+         * (host.ts importScope). Drop-then-replay: the provisioning schema is wiped and rebuilt,
+         * a vertical's tables from the dump's DDL and the `_substrat_*` spine from KERNEL_DDL
+         * (#1883), then the dump's rows go back in.
          *
          * `destScopeId` is the scope being written INTO. A dump carries scope-level tuples
          * naming the scope it was captured from, so restoring one anywhere else needs them
@@ -3312,14 +3331,18 @@ export function defineScopeDO(modules, bareOps) {
          */
         /**
          * The additive spine-column migrations. KERNEL_DDL is all IF NOT EXISTS, so a
-         * scope DO created before a column keeps the old shape — and so does a table a
-         * DUMP replay just recreated from legacy DDL, which is why `importDump` re-runs
-         * this after the replay: without it, the next INSERT naming the column fails in
-         * this very instance. Attempt-and-tolerate: DO SQLite restricts PRAGMA, so there
+         * scope DO created before a column keeps the old shape until this runs on its next
+         * wake. `importDump` runs it too, after rebuilding the spine from KERNEL_DDL: there every
+         * ALTER is a duplicate, since a restore never brings a legacy spine table (#1883), but the
+         * pass also creates `_substrat_outbox_invocation`, which KERNEL_DDL deliberately does not
+         * and the restore's DROP of the outbox took with it. Attempt-and-tolerate: DO SQLite restricts PRAGMA, so there
          * is no column probe, and a duplicate is the steady state after the first cold
          * start (same argument as ControlPlaneDO.addColumn).
          */
         applySpineColumnAdditions() {
+            // Every column here is nullable with no DEFAULT (`attempts` is grandfathered): a restore may
+            // have added it bare already, and then this ALTER is skipped as a duplicate (#1883).
+            // `lint:spine-ddl` refuses one that is not.
             for (const alter of [
                 'ALTER TABLE _substrat_tuples ADD COLUMN revoked_at TEXT',
                 // Executor retry state (#100). The defaults read as "terminal", which is
@@ -3440,7 +3463,8 @@ export function defineScopeDO(modules, bareOps) {
             // cycles, and self-referencing rows within a single table.
             // A dump written before indexes were excluded may still carry them; skipped
             // rather than failing a restore over data about to be recomputed.
-            const replayable = tables.filter((t) => !isSearchIndexTable(t.name));
+            // Matched without case, as SQLite resolves a table name (#1883 review).
+            const replayable = tables.filter((t) => !isSearchIndexTable(t.name.toLowerCase()));
             // The dump is untrusted input (#1143). `SqlStorage.exec` runs every statement
             // in the string it is given, so a `ddl` with anything appended to its CREATE
             // TABLE executed that too — with entirely plain identifiers, which is why no
@@ -3456,53 +3480,59 @@ export function defineScopeDO(modules, bareOps) {
                 this.sql.exec('PRAGMA defer_foreign_keys = ON');
                 // Real tables only; `sqlite_*` internals are auto-managed and un-droppable.
                 const existing = this.sql
-                    .exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'`)
+                    .exec(`SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT GLOB 'sqlite_*'`)
                     .toArray();
                 // Search index tables are left alone here and rebuilt below (#827): dropping a
                 // shadow table directly is an error, and `sqlite_master` order would reach one
                 // before its virtual table.
                 for (const { name } of existing) {
-                    if (isSearchIndexTable(name))
+                    if (isSearchIndexTable(name.toLowerCase()))
                         continue;
                     this.sql.exec(`DROP TABLE IF EXISTS "${name}"`);
                 }
+                // A vertical's tables take the dump's own DDL. The spine never does (#1883): a dump
+                // that declared a column the checker compares on as COLLATE NOCASE would otherwise
+                // decide how this DO's permission checks match. Every `_substrat_*` table is built
+                // from KERNEL_DDL instead, and the dump contributes only rows, by column name
+                // (`spineRowsInsert`), a missing column taking the kernel's default.
                 for (const t of replayable)
-                    this.sql.exec(t.ddl);
+                    if (!isSpineTable(t.name))
+                        this.sql.exec(t.ddl);
+                // KERNEL_DDL also builds what the dump did not carry (#321). A dump captured from a
+                // WORLD that stores some `_substrat_*` tables ELSEWHERE carries only a subset — an
+                // `@substrat-run/adapter-sqlite` scope file keeps `_substrat_roles` /
+                // `_substrat_tenant_tuples` in its DIRECTORY database, so its per-scope dump omits
+                // them, and without them the very next permission check would raise a bare `no such
+                // table: _substrat_roles`. Roles land empty here and are re-projected by the
+                // restore's repair leg (host.projectRolesLocal) — the spine's job is only to exist so
+                // the checker can read it. The column pass follows, for the one outbox index KERNEL_DDL
+                // leaves to it.
+                for (const stmt of splitSqlStatements(KERNEL_DDL))
+                    this.sql.exec(stmt);
+                this.applySpineColumnAdditions();
+                const columnsOf = (name) => doSpineColumnsOf(this.sql, name);
+                assertSpineTablesBuilt(replayable.map((t) => t.name), columnsOf);
+                // A spine column this kernel does not know (a dump from a newer one) is kept, as a plain
+                // untyped column the checker never reads.
                 for (const t of replayable) {
-                    if (t.rows.length === 0)
-                        continue;
-                    const cols = t.columns.map((c) => `"${c}"`).join(', ');
-                    const placeholders = t.columns.map(() => '?').join(', ');
-                    const insert = `INSERT INTO "${t.name}" (${cols}) VALUES (${placeholders})`;
+                    if (isSpineTable(t.name))
+                        for (const alter of spineColumnAdditions(t, columnsOf(t.name)))
+                            this.sql.exec(alter);
+                }
+                for (const t of replayable) {
+                    const insert = dumpRowsInsert(t, columnsOf);
                     for (const row of t.rows)
                         this.sql.exec(insert, ...row);
                 }
-                // Re-assert the kernel spine (#321). A dump captured from a WORLD that stores some
-                // `_substrat_*` tables ELSEWHERE carries only a subset — an `@substrat-run/adapter-
-                // sqlite` scope file, for instance, keeps `_substrat_roles`/`_substrat_tenant_tuples`
-                // in its DIRECTORY database, so its per-scope dump omits them. Replaying such a dump
-                // verbatim would leave this DO missing those spine tables, and the very next
-                // permission check would raise a bare `no such table: _substrat_roles`. KERNEL_DDL is
-                // all IF NOT EXISTS, so this recreates only what the dump did not carry (empty), and
-                // never disturbs a table the dump DID bring. Roles land empty here and are re-projected
-                // by the restore's repair leg (host.projectRolesLocal) — the spine's job is only to
-                // exist so the checker can read it.
-                for (const stmt of splitSqlStatements(KERNEL_DDL))
-                    this.sql.exec(stmt);
-                // …and the additive columns, for the same reason KERNEL_DDL is re-asserted: a
-                // dump captured before a column existed replays DDL WITHOUT it, and IF NOT
-                // EXISTS cannot widen a table the dump did bring. Without this, the next emit
-                // in this instance fails with `no such column` until a cold start re-runs the
-                // constructor's pass.
-                this.applySpineColumnAdditions();
                 // #1738: a dump's `provisioned_for` names the scope (and tenant) it was captured from,
                 // not this one. Dropped, so a restore never carries a receipt over; the repair
                 // projection that follows writes this scope's own.
                 this.sql.exec(`DELETE FROM _substrat_meta WHERE key = 'provisioned_for'`);
                 // Re-point the restored grants at THIS scope (after the spine exists, so a dump
                 // that carried no tuples table still finds one here).
-                if (destScopeId)
-                    this.rewriteScopeTuples(destScopeId, sourceScopeId && { scopeId: sourceScopeId, exact });
+                if (destScopeId) {
+                    this.rewriteScopeTuples(destScopeId, sourceScopeId && { scopeId: sourceScopeId, exact }, new Date().toISOString());
+                }
                 // #1742: the recorded-off modules go back off INSIDE the replay's transaction, with
                 // the spine and the re-point. A switch that throws rolls the whole restore back, so
                 // the dump's grants never commit live without the switch that should cover them.
@@ -3574,12 +3604,12 @@ export function defineScopeDO(modules, bareOps) {
          *
          * Which rows move is `repointScopeGrants`'s (#1869): the dump's source scope, exactly.
          *
-         * `UPDATE OR REPLACE` because (subject, relation, object) is the primary key: if the
-         * dump already held a tuple for the destination scope, the rewritten row collapses
-         * onto it instead of failing the whole restore.
+         * (subject, relation, object) is the primary key, so a moved row can meet one the dump
+         * already holds for the destination scope. Which survives is that function's rule too
+         * (#1882), with expiry judged at `now`, as this DO's checker judges it.
          */
-        rewriteScopeTuples(destScopeId, source) {
-            repointScopeGrants(this.switchSql(), destScopeId, source);
+        rewriteScopeTuples(destScopeId, source, now) {
+            repointScopeGrants(this.switchSql(), destScopeId, source, now);
         }
         /**
          * Wipe this scope's storage — the reap half of deleteSnapshot (preview-and-