@substrat-run/adapter-cloudflare 0.143.0 → 0.144.0

package/dist/scope-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA4DnD,OAAO,EA2DL,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAqGtB,MAAM,sBAAsB,CAAC;AAmD9B,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAkBL,kBAAkB,EAsEnB,MAAM,sBAAsB,CAAC;AA0B9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAoFD,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAsjB5E;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAmBtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,gHAAgH;AAChH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA2B9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAAC,UAAU,CAAC,CA46N7E"}
+{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA4DnD,OAAO,EA2DL,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAqGtB,MAAM,sBAAsB,CAAC;AAoD9B,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAkBL,kBAAkB,EAyEnB,MAAM,sBAAsB,CAAC;AA0B9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAoFD,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AA+jB5E;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAmBtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,gHAAgH;AAChH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA2B9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAAC,UAAU,CAAC,CA0gO7E"}

package/dist/scope-do.js

@@ -7,7 +7,7 @@ import { isUpgradeRequest, readSubscription, LIVE_DECIDE_ATTEMPTS, LIVE_FANOUT_L
 import { replyOf } from './do-reply.js';
 import { OperationQueue } from './serialization.js';
 import { assertNoWorkerdStorage, doScopedSql, doBuiltColumnsOf, doRedactionSql, doSpineSql } from './sql.js';
-import { actorOf, admitPeer, collectPeers, switchPeer, peerSubjectRef, subjectGrantState, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, splitSqlStatements, executableSqlStatements, blankSqlComments, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, assertNoCallerPurge, isUnreachableParent, PURGE_BATCH, heldPurgePass, lifecycleRefusal, purgeHeldBy, purgeDueOf, purgeOnlyKeysOf, runPurgePass, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readOperationSeries, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
+import { actorOf, admitPeer, collectPeers, switchPeer, peerSubjectRef, subjectGrantState, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, splitSqlStatements, executableSqlStatements, blankSqlComments, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, assertNoCallerPurge, isUnreachableParent, PURGE_BATCH, heldPurgePass, lifecycleRefusal, purgeHeldBy, purgeDueOf, purgeOnlyKeysOf, runPurgePass, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readOperationSeries, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
 import { COPY_RESTORE_FENCE_LAPSED, copyRestoreFenceLapsed } from '@substrat-run/kernel';
 import { createDoTupleChecker, createLocalControlPlaneReader, scopeTupleReader } from './checker.js';
 import { settlePlatformRequestIn } from '@substrat-run/kernel';
@@ -561,6 +561,15 @@ function toRpcError(err) {
     }
     return new Error(String(err));
 }
+/** A throwing RPC kept for a coordinator from before #113: `fn`'s refusal, as `toRpcError` rebuilds it. */
+async function thrownForRpc(fn) {
+    try {
+        return await fn();
+    }
+    catch (err) {
+        throw toRpcError(err);
+    }
+}
 /** The check subject for an attachment gate (#476): the connection when the connector door
  *  set one, else the principal — mirrors the invoke path's subject selection. */
 /**
@@ -2758,8 +2767,42 @@ export function defineScopeDO(modules, bareOps) {
                 .toArray()[0];
             return row ? attachmentRecordOfRow(row) : null;
         }
+        // The attachment verbs (#473) each have two doors onto one private body. The `…Reply`
+        // door answers a refusal as DATA, so its code and extensions survive the hop (#113); the
+        // plain one throws it as the bare `Error` `toRpcError` rebuilds, and is kept for a
+        // coordinator from before #113.
+        attachmentAdd(...args) {
+            return thrownForRpc(() => this.addAttachment(...args));
+        }
+        attachmentAddReply(...args) {
+            return replyOf(() => this.addAttachment(...args));
+        }
+        attachmentList(...args) {
+            return thrownForRpc(() => this.listAttachments(...args));
+        }
+        attachmentListReply(...args) {
+            return replyOf(() => this.listAttachments(...args));
+        }
+        attachmentAuthorize(...args) {
+            return thrownForRpc(() => this.authorizeAttachment(...args));
+        }
+        attachmentAuthorizeReply(...args) {
+            return replyOf(() => this.authorizeAttachment(...args));
+        }
+        systemAttachmentAuthorize(...args) {
+            return thrownForRpc(() => this.authorizeSystemAttachment(...args));
+        }
+        systemAttachmentAuthorizeReply(...args) {
+            return replyOf(() => this.authorizeSystemAttachment(...args));
+        }
+        attachmentRemove(...args) {
+            return thrownForRpc(() => this.removeAttachment(...args));
+        }
+        attachmentRemoveReply(...args) {
+            return replyOf(() => this.removeAttachment(...args));
+        }
         /** Record an uploaded attachment: write gate + row + `attachment.added`, one txn. */
-        async attachmentAdd(record, principal, tenantId, scopeId, 
+        async addAttachment(record, principal, tenantId, scopeId, 
         // #476: when set, the gate is checked as this CONNECTION (not `principal`, which is
         // then only the ctx.principal placeholder the connector door passes).
         connectionId) {
@@ -2795,7 +2838,7 @@ export function defineScopeDO(modules, bareOps) {
                     if (err instanceof PermissionDenied) {
                         this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.upload', err, null);
                     }
-                    throw toRpcError(err);
+                    throw err;
                 }
                 // #1525: null. An attachment RPC carries no invocation, exactly as its denial
                 // records none — so the deliveries it drains name no call rather than a wrong one.
@@ -2804,7 +2847,7 @@ export function defineScopeDO(modules, bareOps) {
             });
         }
         /** Records for one entity, newest first — read gate first. */
-        async attachmentList(entity, principal, tenantId, scopeId, connectionId) {
+        async listAttachments(entity, principal, tenantId, scopeId, connectionId) {
             await this.ensureMigrations();
             const gate = this.attachmentGate(entity.entityType);
             try {
@@ -2815,7 +2858,7 @@ export function defineScopeDO(modules, bareOps) {
                 if (err instanceof PermissionDenied) {
                     this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.list', err, null);
                 }
-                throw toRpcError(err);
+                throw err;
             }
             const rows = this.sql
                 .exec(`SELECT id FROM _substrat_attachments WHERE entity_type = ? AND entity_id = ?
@@ -2827,7 +2870,7 @@ export function defineScopeDO(modules, bareOps) {
          * Authorize one attachment (`read` before bytes are served, `write` before a remove is
          * attempted elsewhere) and return its record — null for an id this scope does not know.
          */
-        async attachmentAuthorize(attachmentId, mode, principal, tenantId, scopeId, connectionId, forEventId) {
+        async authorizeAttachment(attachmentId, mode, principal, tenantId, scopeId, connectionId, forEventId) {
             await this.ensureMigrations();
             const record = this.attachmentRow(attachmentId);
             if (!record)
@@ -2846,7 +2889,7 @@ export function defineScopeDO(modules, bareOps) {
                     if (err instanceof PermissionDenied) {
                         this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.open', err, null);
                     }
-                    throw toRpcError(err);
+                    throw err;
                 }
                 return record;
             }
@@ -2859,12 +2902,12 @@ export function defineScopeDO(modules, bareOps) {
                 if (err instanceof PermissionDenied) {
                     this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.open', err, null);
                 }
-                throw toRpcError(err);
+                throw err;
             }
             return record;
         }
         /** Authorize a job's read as its registered module, never as a person. */
-        async systemAttachmentAuthorize(attachmentId, moduleId, tenantId, scopeId, 
+        async authorizeSystemAttachment(attachmentId, moduleId, tenantId, scopeId, 
         /** #1834: the instance the system door's gate read; see `invoke`. */
         systemDoorInstance) {
             await this.ensureMigrations();
@@ -2875,10 +2918,10 @@ export function defineScopeDO(modules, bareOps) {
             catch (err) {
                 if (err instanceof SystemDoorMovedError)
                     return SYSTEM_DOOR_MOVED;
-                throw toRpcError(err);
+                throw err;
             }
             if (!this.modules.has(moduleId)) {
-                throw toRpcError(substratError('not_found', `module not registered in this scope: ${moduleId}`));
+                throw substratError('not_found', `module not registered in this scope: ${moduleId}`);
             }
             const record = this.attachmentRow(attachmentId);
             if (!record)
@@ -2892,12 +2935,12 @@ export function defineScopeDO(modules, bareOps) {
                 if (err instanceof PermissionDenied) {
                     this.recordDenial({ kind: 'system', id: moduleId }, tenantId, 'attachments.open', err, null);
                 }
-                throw toRpcError(err);
+                throw err;
             }
             return record;
         }
         /** Remove an attachment's metadata fact: write gate + delete + `attachment.removed`. */
-        async attachmentRemove(attachmentId, principal, tenantId, scopeId, connectionId) {
+        async removeAttachment(attachmentId, principal, tenantId, scopeId, connectionId) {
             await this.ensureMigrations();
             return this.queue.enqueue(async () => {
                 const record = this.attachmentRow(attachmentId);
@@ -2924,7 +2967,7 @@ export function defineScopeDO(modules, bareOps) {
                     if (err instanceof PermissionDenied) {
                         this.recordDenial(attachSubject(principal, connectionId), tenantId, 'attachments.remove', err, null);
                     }
-                    throw toRpcError(err);
+                    throw err;
                 }
                 // #1525: null. An attachment RPC carries no invocation, exactly as its denial
                 // records none — so the deliveries it drains name no call rather than a wrong one.
@@ -3530,6 +3573,7 @@ export function defineScopeDO(modules, bareOps) {
                         holdings: this.checker.holdings
                             ? (principal) => this.checker.holdings({ kind: 'principal', id: principal }, { tenantId, scopeId })
                             : undefined,
+                        allowed: (principal, permission, entity) => allowedFor(this.checker, principal, { tenantId, scopeId })(permission, entity),
                     }, secret, mode);
                 });
                 if (outcome)
@@ -3548,7 +3592,7 @@ export function defineScopeDO(modules, bareOps) {
             const minter = principalId.parse(caller);
             const parsed = principalBecomeCapabilityInput.parse(input);
             return await this.queue.enqueue(async () => {
-                const checked = await becomeMintCheck({ sql: doSpineSql(this.sql), checker: this.checker }, minter, parsed.principal, { tenantId, scopeId });
+                const checked = await becomeMintCheck({ sql: doSpineSql(this.sql), checker: this.checker }, minter, parsed.principal, { tenantId, scopeId }, parsed.bind);
                 if (!checked.ok)
                     return checked;
                 const liveSince = this.liveHighWaterMark();
@@ -3565,6 +3609,32 @@ export function defineScopeDO(modules, bareOps) {
                 return { ok: true, minted: minted };
             });
         }
+        /**
+         * Unbind a binding shape's record (#1686) — its column cleared and the shape its person held
+         * there through it taken back — as `caller`, who must hold the binding's key on the record. The
+         * kernel's bound and the write in ONE queued body and one storage transaction; a refusal writes
+         * nothing. On the spine as `entity.holder-unbound`, the caller its actor.
+         */
+        async unbindEntityHolderBoundedFor(tenantId, scopeId, caller, entity) {
+            await this.ensureMigrations();
+            const by = principalId.parse(caller);
+            return await this.queue.enqueue(async () => {
+                const liveSince = this.liveHighWaterMark();
+                const now = instant.parse(new Date().toISOString());
+                let answer = { ok: true, unbound: [] };
+                await this.revision.transaction(async () => {
+                    answer = await unbindEntityHolderBounded({
+                        sql: doSpineSql(this.sql),
+                        now,
+                        allowed: allowedFor(this.checker, by, { tenantId, scopeId }),
+                        emit: (event) => kernelEmit(this.operationContext(by, tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, ENTITY_UNBIND_OPERATION, undefined, [], now), event),
+                    }, entity);
+                });
+                if (answer.ok && answer.unbound.length > 0)
+                    await this.settleCommitted(tenantId, scopeId, liveSince, null);
+                return answer;
+            });
+        }
         /** Where each named `become` link stands (#1686) — a pending-invite list's read. */
         async becomeLinkStatesFor(tenantId, scopeId, ids) {
             await this.ensureMigrations();
@@ -4510,12 +4580,7 @@ export function defineScopeDO(modules, bareOps) {
         /** A bounded page of one table. Unknown table names throw — never queried blind. Kept for a
          *  coordinator from before #113; the current one calls `introspectTableReply`. */
         introspectTable(table, limit, offset) {
-            try {
-                return this.tablePage(table, limit, offset);
-            }
-            catch (e) {
-                throw toRpcError(e);
-            }
+            return thrownForRpc(async () => this.tablePage(table, limit, offset));
         }
         /** `introspectTable`, its refusal answered as DATA so its code survives the hop (#113). */
         introspectTableReply(table, limit, offset) {
@@ -4547,13 +4612,8 @@ export function defineScopeDO(modules, bareOps) {
          * at SCOPE_QUERY_ROW_MAX with `truncated` set, never an error.
          * Kept for a coordinator from before #113; the current one calls `introspectQueryReply`.
          */
-        async introspectQuery(sql) {
-            try {
-                return await this.readOnlyQuery(sql);
-            }
-            catch (e) {
-                throw toRpcError(e);
-            }
+        introspectQuery(sql) {
+            return thrownForRpc(() => this.readOnlyQuery(sql));
         }
         /** `introspectQuery`, its refusal answered as DATA so its code survives the hop (#113). */
         introspectQueryReply(sql) {
@@ -4711,6 +4771,8 @@ export function defineScopeDO(modules, bareOps) {
                 'ALTER TABLE _substrat_capabilities ADD COLUMN target_digest TEXT',
                 // #1686: why the kernel revoked a link itself; NULL for every revoke already there.
                 'ALTER TABLE _substrat_capabilities ADD COLUMN revoked_reason TEXT',
+                // #1686: the action a become carries; NULL on every row already there — none carries one.
+                'ALTER TABLE _substrat_capabilities ADD COLUMN action TEXT',
                 // #1632: legacy runs retain an unknown subject; no content-based backfill.
                 'ALTER TABLE _substrat_job_runs ADD COLUMN subject_id TEXT',
                 // #2034: the lease. NULL = nobody holds the run, which is right for every row already there.