@substrat-run/adapter-cloudflare 0.144.0 → 0.145.0

package/dist/scope-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA4DnD,OAAO,EA2DL,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAqGtB,MAAM,sBAAsB,CAAC;AAoD9B,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAkBL,kBAAkB,EAyEnB,MAAM,sBAAsB,CAAC;AA0B9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAoFD,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AA+jB5E;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAmBtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,gHAAgH;AAChH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA2B9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAAC,UAAU,CAAC,CA0gO7E"}
+{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA4DnD,OAAO,EA2DL,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAqGtB,MAAM,sBAAsB,CAAC;AAoD9B,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAkBL,kBAAkB,EA4EnB,MAAM,sBAAsB,CAAC;AA0B9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAoFD,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AA+jB5E;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAmBtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,gHAAgH;AAChH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA2B9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAAC,UAAU,CAAC,CA2jO7E"}

package/dist/scope-do.js

@@ -7,7 +7,7 @@ import { isUpgradeRequest, readSubscription, LIVE_DECIDE_ATTEMPTS, LIVE_FANOUT_L
 import { replyOf } from './do-reply.js';
 import { OperationQueue } from './serialization.js';
 import { assertNoWorkerdStorage, doScopedSql, doBuiltColumnsOf, doRedactionSql, doSpineSql } from './sql.js';
-import { actorOf, admitPeer, collectPeers, switchPeer, peerSubjectRef, subjectGrantState, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, splitSqlStatements, executableSqlStatements, blankSqlComments, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, assertNoCallerPurge, isUnreachableParent, PURGE_BATCH, heldPurgePass, lifecycleRefusal, purgeHeldBy, purgeDueOf, purgeOnlyKeysOf, runPurgePass, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readOperationSeries, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
+import { actorOf, admitPeer, collectPeers, switchPeer, peerSubjectRef, subjectGrantState, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, splitSqlStatements, executableSqlStatements, blankSqlComments, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, assertNoCallerPurge, isUnreachableParent, PURGE_BATCH, heldPurgePass, lifecycleRefusal, purgeHeldBy, purgeDueOf, purgeOnlyKeysOf, runPurgePass, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readOperationSeries, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
 import { COPY_RESTORE_FENCE_LAPSED, copyRestoreFenceLapsed } from '@substrat-run/kernel';
 import { createDoTupleChecker, createLocalControlPlaneReader, scopeTupleReader } from './checker.js';
 import { settlePlatformRequestIn } from '@substrat-run/kernel';
@@ -352,9 +352,9 @@ const KERNEL_DDL = `
   -- #1575: attachment text and its FTS5 index, shared from @substrat-run/kernel. After
   -- _substrat_attachments, whose delete trigger it adds.
   ${ATTACHMENT_TEXT_DDL}
-  -- #901: an entity's version is the ULID of the last event about it, so
-  -- MAX(id) per (entity_type, entity_id) is the read. The id column sits last so
-  -- SQLite walks to the end of the matched range instead of aggregating over it.
+  -- #901: an entity's version is the ULID of the last event about it (a state move
+  -- excepted, #2191), so the newest id per (entity_type, entity_id) is the read. The id
+  -- column sits last so SQLite walks the matched range backwards instead of aggregating.
   ${OUTBOX_ENTITY_INDEX}
   -- #116: the request-dedupe table, kernel-owned so no vertical migrates for it.
   ${IDEMPOTENCY_DDL}
@@ -746,6 +746,8 @@ export function defineScopeDO(modules, bareOps) {
         listPlans = new Map();
         /** #119: entity type → its archive/trash plan, from every registered module. */
         statePlans = new Map();
+        /** #2166: entity type → the updated stamps the host holds, from every registered module. */
+        updatedStampPlans = new Map();
         /** #2068: each registered module's erasure, in registration order — what `redactSubject` runs. */
         erasurePlans = [];
         /** entityType → the declared attachment gate (#473): read key + write key (default: read). */
@@ -869,6 +871,7 @@ export function defineScopeDO(modules, bareOps) {
             }
             // #119: the archive/trash plans, refusing a second owner of one entity type.
             addStatePlans(this.statePlans, manifest.id, manifest.entityStates, manifest.permissions);
+            addUpdatedStampPlans(this.updatedStampPlans, manifest.id, manifest.updatedStamps);
             // #811: the list indexes `lists` declares, same placement and same reason.
             for (const plan of listIndexPlans(manifest.id, manifest.lists, manifest.entityStates)) {
                 const existing = this.listPlans.get(plan.entityType);
@@ -1367,7 +1370,10 @@ export function defineScopeDO(modules, bareOps) {
                                 // As the producer's principal: real checks against the grants this vertical's
                                 // `peers` gave it; its emits carry `{ vertical, scope }` and what they passed.
                                 // What it emits was emitted BECAUSE of the producer's event (#1237).
-                                await imp.handler(this.importContext(tenantId, scopeId, peerSubject, { causedBy: e.id, invocationId: unit.invocationId }), event);
+                                const ctx = this.importContext(tenantId, scopeId, peerSubject, { causedBy: e.id, invocationId: unit.invocationId });
+                                const stamps = watchUpdatedStamps(doSpineSql(this.sql), this.updatedStampPlans);
+                                await imp.handler(ctx, event);
+                                stamps?.assertHeld(ctx, `${imp.moduleId} consuming ${e.type}`);
                                 this.sql.exec(`INSERT INTO _substrat_deliveries (event_id, consumer_module, delivered_at, invocation_id)
                    VALUES (?, ?, ?, NULL)`, e.id, imp.moduleId, new Date().toISOString());
                             });
@@ -1684,14 +1690,16 @@ export function defineScopeDO(modules, bareOps) {
                 return { ...one, done: one.next === null };
             }
             let [toppedUp, retired, retirementsLeftOpen, from] = [0, 0, 0, null];
+            let boundEver;
             do {
                 const one = await pass(from);
                 toppedUp += one.toppedUp;
                 retired += one.retired;
                 retirementsLeftOpen += one.retirementsLeftOpen;
                 from = one.next;
+                boundEver = one.boundEver;
             } while (from);
-            return { toppedUp, retired, retirementsLeftOpen, next: null, done: true };
+            return { toppedUp, retired, retirementsLeftOpen, next: null, done: true, ...(boundEver ? { boundEver } : {}) };
         }
         /**
          * The dispatch capability's admission (#726 remedy B): this delivery may read the
@@ -2061,9 +2069,12 @@ export function defineScopeDO(modules, bareOps) {
                                 : undefined;
                             // #119: the host's trash refusal, before the guards and the handler — the pure
                             // adapter's, through the same kernel function.
-                            await refuseTrashedTarget({ sql: doSpineSql(this.sql), plans: this.statePlans, check: ctx.check }, operation, target, parsed, purging ? { now: new Date().toISOString(), gate: this.purgeGateFacts(systemDoor.moduleId, tenantId) } : undefined);
+                            // #2166: what the guards and the handler emit about a stamped entity, held below.
+                            const stamps = watchUpdatedStamps(doSpineSql(this.sql), this.updatedStampPlans);
+                            await refuseTrashedTarget({ sql: doSpineSql(this.sql), plans: this.statePlans, check: ctx.check, now: ctx.now() }, operation, target, parsed, purging ? { gate: this.purgeGateFacts(systemDoor.moduleId, tenantId) } : undefined);
                             await this.runGuards(operation, ctx, parsed);
                             result = await handler(ctx, parsed);
+                            stamps?.assertHeld(ctx, operation);
                             if (guardedRef && invokeOptions?.ifMatch !== undefined) {
                                 assertIfMatch(guardedRef, invokeOptions.ifMatch, seen ?? null);
                             }
@@ -2564,6 +2575,12 @@ export function defineScopeDO(modules, bareOps) {
              * principal holding that root in several tabs is one check, fanned out to each socket.
              */
             const rootChecks = new Map();
+            /**
+             * A row beneath a checked root that the key reaches only through a record whose shape
+             * protects it (#2177): decided by the subscriber's own check of the key on the row, asked
+             * once per (principal, key, row) per pass, under the same epoch rules as `rootChecks`.
+             */
+            const rowChecks = new Map();
             const ancestors = new Map();
             const openEpoch = (now) => ({
                 writes: this.revision.statementsWritten,
@@ -2577,17 +2594,26 @@ export function defineScopeDO(modules, bareOps) {
                 if (!holds(epoch, now)) {
                     epoch = openEpoch(now);
                     rootChecks.clear();
+                    rowChecks.clear();
                     ancestors.clear();
                 }
                 return epoch;
             };
-            const reaches = async (row, root, now) => {
-                let up = ancestors.get(row.id);
+            /**
+             * Is the row beneath the root? With a `key` (#2177), only along a path the key's own check
+             * would climb: it stops at a record whose shape protects the key. Memoised per (row, key),
+             * since the stop depends on it.
+             */
+            const reaches = async (row, root, now, key) => {
+                const memo = `${row.id}\n${key ?? ''}`;
+                let up = ancestors.get(memo);
                 if (!up) {
                     // A walk that cannot answer is a frame not sent — the same fail-closed rule as the check.
                     // Walked at the decision's own instant; remembered only while its epoch holds.
-                    up = ancestorsWithin(parents, { entityType: row.entity_type, entityId: row.entity_id }, now).catch(() => new Set());
-                    ancestors.set(row.id, up);
+                    up = Promise.resolve()
+                        .then(() => ancestorsWithin(parents, { entityType: row.entity_type, entityId: row.entity_id }, now, key))
+                        .catch(() => new Set());
+                    ancestors.set(memo, up);
                 }
                 return (await up).has(`${root.entityType}:${root.entityId}`);
             };
@@ -2655,7 +2681,13 @@ export function defineScopeDO(modules, bareOps) {
                         rootVerdict = undefined;
                     // Narrowing first: it is memoised across sockets, and a row outside the root
                     // is out whatever the principal holds.
-                    if (within && !(await reaches(row, within, now)))
+                    // A checked root walks with its key first (#2177). The keyed walk is the plain walk with
+                    // stops, so whatever it reaches the plain walk reaches too: a hit settles "beneath the
+                    // root" in one walk, and only a miss needs the plain walk to tell a row outside the root
+                    // from one the key reaches only through a record whose shape protects it.
+                    const key = within?.checked;
+                    const keyed = within && key !== undefined ? await reaches(row, within, now, key) : false;
+                    if (within && !keyed && !(await reaches(row, within, now)))
                         return 'skip';
                     if (within?.checked !== undefined) {
                         if (rootVerdict === undefined) {
@@ -2673,6 +2705,27 @@ export function defineScopeDO(modules, bareOps) {
                         }
                         if (!rootVerdict.allowed)
                             return 'revoked';
+                        // The root check speaks for a row the key reaches through the root. A row it reaches
+                        // only through a record whose shape protects the key (#2177) is the subscriber's own
+                        // check on the row: a holder by role or by the record's shape is nudged, a holder by a
+                        // grant above the record is not — the answer `ctx.check` gives, by asking it.
+                        if (!keyed) {
+                            const ask = () => context()
+                                .check(within.checked, { entityType: row.entity_type, entityId: row.entity_id })
+                                .then((d) => d.allowed, () => false);
+                            let allowed;
+                            if (e.remote) {
+                                allowed = ask();
+                            }
+                            else {
+                                const memo = `${subscriber.principal}\n${key}\n${row.id}`;
+                                allowed = rowChecks.get(memo);
+                                if (!allowed)
+                                    rowChecks.set(memo, (allowed = ask()));
+                            }
+                            if (!(await allowed))
+                                return 'skip';
+                        }
                     }
                     if (within?.vouched !== undefined || within?.checked !== undefined) {
                         // The root was vouched for or checked, so the walk above was the row filter —
@@ -5541,7 +5594,9 @@ export function defineScopeDO(modules, bareOps) {
                                         causedBy: event.id,
                                         invocationId: unit.invocationId,
                                     });
+                                    const stamps = watchUpdatedStamps(doSpineSql(this.sql), this.updatedStampPlans);
                                     await consumer.handler(ctx, event);
+                                    stamps?.assertHeld(ctx, `${mod.id} consuming ${event.type}`);
                                     this.sql.exec(`INSERT INTO _substrat_deliveries
                        (event_id, consumer_module, delivered_at, invocation_id)
                      VALUES (?, ?, ?, ?)`, event.id, mod.id, new Date().toISOString(), invocationId);