@substrat-run/adapter-cloudflare 0.138.0 → 0.140.0

package/dist/sql.d.ts

@@ -1,4 +1,6 @@
 import { type RedactionSql, type ScopedSql } from '@substrat-run/kernel';
+/** Workerd's `_cf_*` tables back runtime-owned KV and alarms, not module data. */
+export declare function assertNoWorkerdStorage(sql: string): void;
 /**
  * Adapts a Durable Object's `SqlStorage` to the kernel's `ScopedSql` contract
  * (`query`/`exec`). DO SQL is synchronous — `exec` returns a cursor eagerly —
@@ -18,7 +20,11 @@ import { type RedactionSql, type ScopedSql } from '@substrat-run/kernel';
  * hosted push path. The DO's own spine writes go through `this.sql` directly and
  * never pass through here.
  */
-export declare function doScopedSql(sql: SqlStorage): ScopedSql;
+export declare function doScopedSql(sql: SqlStorage, 
+/** #119: the module tables carrying archive/trash columns — `guardSpine` refuses positional writes to them. */
+statefulTables?: ReadonlySet<string>, 
+/** #119: the kernel's integrity check, run after any runtime DDL — see `guardSpine`. */
+afterDdl?: () => void): ScopedSql;
 /**
  * The kernel's OWN spine access (#1672) — `doScopedSql` without `guardSpine`, because these
  * are the kernel's writes to `_substrat_capabilities`, which module code may never make.

package/dist/sql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,SAAS,EAAiB,MAAM,sBAAsB,CAAC;AAEpG;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAStD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CASrD;AAED,2GAA2G;AAC3G,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,YAAY,CAE5D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAWpF"}
+{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,SAAS,EAAiB,MAAM,sBAAsB,CAAC;AAGpG,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAaxD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,UAAU;AACf,+GAA+G;AAC/G,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC;AACpC,wFAAwF;AACxF,QAAQ,CAAC,EAAE,MAAM,IAAI,GACpB,SAAS,CAYX;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CASrD;AAED,2GAA2G;AAC3G,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,YAAY,CAE5D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAWpF"}

package/dist/sql.js

@@ -1,4 +1,22 @@
 import { guardSpine } from '@substrat-run/kernel';
+import { substratError, tokenizeSql } from '@substrat-run/contracts';
+/** Workerd's `_cf_*` tables back runtime-owned KV and alarms, not module data. */
+export function assertNoWorkerdStorage(sql) {
+    const tokens = tokenizeSql(sql);
+    if (tokens.some((token, index) => {
+        if (!token.text.split('.').some((part) => part.toLowerCase().startsWith('_cf_')))
+            return false;
+        // Quoted tokens can also be string literals in an expression. A table name
+        // there still follows a source/target keyword, including when quoted.
+        if (!token.quoted)
+            return true;
+        const before = tokens[index - 1];
+        return before && !before.quoted &&
+            ['FROM', 'JOIN', 'INTO', 'UPDATE', 'TABLE', 'REFERENCES', 'ON'].includes(before.text.toUpperCase());
+    })) {
+        throw substratError('forbidden', 'ctx.sql cannot read workerd internal storage');
+    }
+}
 /**
  * Adapts a Durable Object's `SqlStorage` to the kernel's `ScopedSql` contract
  * (`query`/`exec`). DO SQL is synchronous — `exec` returns a cursor eagerly —
@@ -18,14 +36,22 @@ import { guardSpine } from '@substrat-run/kernel';
  * hosted push path. The DO's own spine writes go through `this.sql` directly and
  * never pass through here.
  */
-export function doScopedSql(sql) {
+export function doScopedSql(sql, 
+/** #119: the module tables carrying archive/trash columns — `guardSpine` refuses positional writes to them. */
+statefulTables, 
+/** #119: the kernel's integrity check, run after any runtime DDL — see `guardSpine`. */
+afterDdl) {
     return guardSpine({
-        query: (q, params = []) => sql.exec(q, ...params).toArray(),
+        query: (q, params = []) => {
+            assertNoWorkerdStorage(q);
+            return sql.exec(q, ...params).toArray();
+        },
         exec: (q, params = []) => {
+            assertNoWorkerdStorage(q);
             const cursor = sql.exec(q, ...params);
             return { changes: cursor.rowsWritten };
         },
-    });
+    }, statefulTables, afterDdl);
 }
 /**
  * The kernel's OWN spine access (#1672) — `doScopedSql` without `guardSpine`, because these

package/dist/sql.js.map

@@ -1 +1 @@
-{"version":3,"file":"sql.js","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAoD,MAAM,sBAAsB,CAAC;AAEpG;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,WAAW,CAAC,GAAe;IACzC,OAAO,UAAU,CAAC;QAChB,KAAK,EAAE,CAA+B,CAAS,EAAE,MAAM,GAAwB,EAAE,EAAO,EAAE,CACxF,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,GAAI,MAAqB,CAAC,CAAC,OAAO,EAAS;QACzD,IAAI,EAAE,CAAC,CAAS,EAAE,MAAM,GAAwB,EAAE,EAAE,EAAE;YACpD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,GAAI,MAAqB,CAAC,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QACzC,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAe;IACxC,OAAO;QACL,KAAK,EAAE,CAA+B,CAAS,EAAE,MAAM,GAAwB,EAAE,EAAO,EAAE,CACxF,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,GAAI,MAAqB,CAAC,CAAC,OAAO,EAAS;QACzD,IAAI,EAAE,CAAC,CAAS,EAAE,MAAM,GAAwB,EAAE,EAAE,EAAE;YACpD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,GAAI,MAAqB,CAAC,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,cAAc,CAAC,GAAe;IAC5C,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,GAAI,MAAqB,CAAC,CAAC,OAAO,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAe,EAAE,IAAY;IAC5D,gGAAgG;IAChG,iGAAiG;IACjG,MAAM,KAAK,GAAG,GAAG;SACd,IAAI,CACH;iEAC2D,EAC3D,IAAI,CACL;SACA,OAAO,EAAE,CAAC;IACb,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,IAAI,WAAW,CAAC,CAAC,WAAW,CAAC;AAClG,CAAC"}
+{"version":3,"file":"sql.js","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAoD,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAErE,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC/B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/F,2EAA2E;QAC3E,sEAAsE;QACtE,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACjC,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM;YAC7B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACxG,CAAC,CAAC,EAAE,CAAC;QACH,MAAM,aAAa,CAAC,WAAW,EAAE,8CAA8C,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,WAAW,CACzB,GAAe;AACf,+GAA+G;AAC/G,cAAoC;AACpC,wFAAwF;AACxF,QAAqB;IAErB,OAAO,UAAU,CAAC;QAChB,KAAK,EAAE,CAA+B,CAAS,EAAE,MAAM,GAAwB,EAAE,EAAO,EAAE;YACxF,sBAAsB,CAAC,CAAC,CAAC,CAAC;YAC1B,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,GAAI,MAAqB,CAAC,CAAC,OAAO,EAAS,CAAC;QACjE,CAAC;QACD,IAAI,EAAE,CAAC,CAAS,EAAE,MAAM,GAAwB,EAAE,EAAE,EAAE;YACpD,sBAAsB,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,GAAI,MAAqB,CAAC,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QACzC,CAAC;KACF,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAe;IACxC,OAAO;QACL,KAAK,EAAE,CAA+B,CAAS,EAAE,MAAM,GAAwB,EAAE,EAAO,EAAE,CACxF,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,GAAI,MAAqB,CAAC,CAAC,OAAO,EAAS;QACzD,IAAI,EAAE,CAAC,CAAS,EAAE,MAAM,GAAwB,EAAE,EAAE,EAAE;YACpD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,GAAI,MAAqB,CAAC,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,cAAc,CAAC,GAAe;IAC5C,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,GAAI,MAAqB,CAAC,CAAC,OAAO,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAe,EAAE,IAAY;IAC5D,gGAAgG;IAChG,iGAAiG;IACjG,MAAM,KAAK,GAAG,GAAG;SACd,IAAI,CACH;iEAC2D,EAC3D,IAAI,CACL;SACA,OAAO,EAAE,CAAC;IACb,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,IAAI,WAAW,CAAC,CAAC,WAAW,CAAC;AAClG,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/adapter-cloudflare",
-  "version": "0.138.0",
+  "version": "0.140.0",
   "description": "Cloudflare Durable-Object scope host (D-14): DO-per-scope, real kernel semantics on Workers",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -26,8 +26,8 @@
     "dist"
   ],
   "dependencies": {
-    "@substrat-run/contracts": "^0.138.0",
-    "@substrat-run/kernel": "^0.138.0"
+    "@substrat-run/contracts": "^0.140.0",
+    "@substrat-run/kernel": "^0.140.0"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.12.21",
@@ -36,12 +36,12 @@
     "typescript": "^7.0.0",
     "vitest": "^3.2.7",
     "wrangler": "^4.146.0",
-    "@substrat-run/attachment-extractors": "^0.1.4",
-    "@substrat-run/contract-tests": "^0.138.0",
-    "@substrat-run/vertical-auth": "^0.19.1",
-    "@substrat-run/control-plane-api": "^0.138.0",
-    "@substrat-run/cli": "^0.40.2",
-    "@substrat-run/vertical-host": "^0.138.0"
+    "@substrat-run/attachment-extractors": "^0.2.1",
+    "@substrat-run/cli": "^0.41.0",
+    "@substrat-run/contract-tests": "^0.140.0",
+    "@substrat-run/control-plane-api": "^0.140.0",
+    "@substrat-run/vertical-auth": "^0.21.0",
+    "@substrat-run/vertical-host": "^0.140.0"
   },
   "publishConfig": {
     "access": "public"
@@ -49,6 +49,8 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
-    "test": "vitest run && vitest run -c vitest.supplied-sweeper.config.ts"
+    "test": "vitest run && vitest run -c vitest.supplied-sweeper.config.ts",
+    "test:contract": "vitest run test/contract.test.ts",
+    "test:rest": "vitest run --exclude test/contract.test.ts && vitest run -c vitest.supplied-sweeper.config.ts"
   }
 }