@substrat-run/adapter-cloudflare 0.147.0 → 0.149.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/control-plane-do.d.ts +131 -10
- package/dist/control-plane-do.d.ts.map +1 -1
- package/dist/control-plane-do.js +165 -35
- package/dist/control-plane-do.js.map +1 -1
- package/dist/host.d.ts +75 -16
- package/dist/host.d.ts.map +1 -1
- package/dist/host.js +395 -61
- package/dist/host.js.map +1 -1
- package/dist/route-resolver.js +2 -2
- package/dist/route-resolver.js.map +1 -1
- package/dist/scope-do.d.ts +7 -0
- package/dist/scope-do.d.ts.map +1 -1
- package/dist/scope-do.js +180 -11
- package/dist/scope-do.js.map +1 -1
- package/package.json +9 -9
package/dist/route-resolver.js
CHANGED
|
@@ -10,8 +10,8 @@ function scopeStoresOf(json) {
|
|
|
10
10
|
if (typeof entry !== 'object' || entry === null)
|
|
11
11
|
return [];
|
|
12
12
|
const binding = Reflect.get(entry, 'binding');
|
|
13
|
-
const
|
|
14
|
-
return typeof binding === 'string' && typeof
|
|
13
|
+
const driver = Reflect.get(entry, 'driver');
|
|
14
|
+
return typeof binding === 'string' && typeof driver === 'string' ? [{ binding, driver }] : [];
|
|
15
15
|
});
|
|
16
16
|
}
|
|
17
17
|
catch {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"route-resolver.js","sourceRoot":"","sources":["../src/route-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,WAAW,EACX,qBAAqB,GAGtB,MAAM,yBAAyB,CAAC;AAiDjC,SAAS,aAAa,CAAC,IAA+B;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAC;YAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC9C,MAAM,
|
|
1
|
+
{"version":3,"file":"route-resolver.js","sourceRoot":"","sources":["../src/route-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,WAAW,EACX,qBAAqB,GAGtB,MAAM,yBAAyB,CAAC;AAiDjC,SAAS,aAAa,CAAC,IAA+B;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAC;YAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC5C,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;yDACyD;AACzD,MAAM,UAAU,aAAa,CAAC,GAA6B;IACzD,gGAAgG;IAChG,gFAAgF;IAChF,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,mFAAmF;IACnF,iFAAiF;IACjF,+EAA+E;IAC/E,IAAI,aAAa,GAAoB,IAAI,CAAC;IAC1C,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAY,CAAC;YACxD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;IACH,CAAC;IACD,qFAAqF;IACrF,iFAAiF;IACjF,IAAI,KAAK,GAAoB,IAAI,CAAC;IAClC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAY,CAAC;YACrD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC,KAAK,CAAC;QACvB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;QACzC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,aAAa;QACb,KAAK;QACL,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACjD,uFAAuF;QACvF,yCAAyC;QACzC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,eAAe;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;AAEtF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoC;IACtE,OAAO,KAAK,EAAE,QAAgB,EAAE,EAAE;QAChC,oEAAoE;QACpE,EAAE;QACF,+EAA+E;QAC/E,kFAAkF;QAClF,8EAA8E;QAC9E,gFAAgF;QAChF,gFAAgF;QAChF,EAAE;QACF,kFAAkF;QAClF,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CACzB,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,CACZ,CAAC;QAC/B,OAAO,aAAa,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC;AACJ,CAAC;AAyDD,MAAM,QAAQ,GAAG,CAAC,GAA8B,EAAmB,EAAE;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAoC;IAEpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAC9B,IAAI,MAAM,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;YACxC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC;aACxD,CAAC;QACJ,CAAC;QACD,sFAAsF;QACtF,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,CAA8B,CAAC;QACnG,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9F,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,SAAS,MAAM,CAAC,OAAO,2BAA2B,MAAM,CAAC,QAAQ,kBAAkB;aAC7F,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;YACvC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnG,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACpC,OAAO;gBACL,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,WAAW;gBACjB,OAAO,EACL,IAAI,MAAM,CAAC,QAAQ,yCAAyC,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,YAAY,GAAG;oBAChG,2DAA2D;aAC9D,CAAC;QACJ,CAAC;QACD,0FAA0F;QAC1F,mFAAmF;QACnF,IAAI,GAAG,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO;gBACL,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,UAAU;gBAChB,OAAO,EACL,oBAAoB,GAAG,CAAC,KAAK,kBAAkB,MAAM,8BAA8B;oBACnF,yBAAyB;aAC5B,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;YACxC,OAAO;gBACL,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,0BAA0B,MAAM,2DAA2D;aACrG,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,KAAK,eAAe,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACnD,OAAO;gBACL,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,aAAa,MAAM,mCAAmC;aAChE,CAAC;QACJ,CAAC;QACD,8FAA8F;QAC9F,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,QAAQ,2BAA2B,EAAE,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,aAAa,MAAM,0CAA0C;aACvE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS;YAC9B,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ;YAC5B,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM;YACvC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI;YAC/C,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc;YACxC,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC;YACjD,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC;YACtC,KAAK,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC;SACxB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
|
package/dist/scope-do.d.ts
CHANGED
|
@@ -32,6 +32,13 @@ export interface ScopeDoEnv {
|
|
|
32
32
|
* worker, stamps NULL.
|
|
33
33
|
*/
|
|
34
34
|
SUBSTRAT_VERSION_ID?: string;
|
|
35
|
+
/**
|
|
36
|
+
* The migration set digest of the version this script serves (#2349), injected at upload
|
|
37
|
+
* beside `SUBSTRAT_VERSION_ID` for a version whose migrations the control plane stores. A pass
|
|
38
|
+
* with migrations pending applies none unless its registered set matches. Optional: an unheld
|
|
39
|
+
* version, a script uploaded before the binding, or a test worker compares nothing.
|
|
40
|
+
*/
|
|
41
|
+
SUBSTRAT_MIGRATIONS_DIGEST?: string;
|
|
35
42
|
}
|
|
36
43
|
/** #2016: how a tenant reads against a scope's record (`ScopeDO.tenantVerdict`). */
|
|
37
44
|
export type TenantVerdict = 'recorded' | 'inferred' | 'foreign' | 'unknown';
|
package/dist/scope-do.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA8DnD,OAAO,EA2DL,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EA2GtB,MAAM,sBAAsB,CAAC;AAoD9B,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAwBL,kBAAkB,EA4EnB,MAAM,sBAAsB,CAAC;AA0B9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAoFD,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAqkB5E;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAmBtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,gHAAgH;AAChH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA2B9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GACxD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAAC,UAAU,CAAC,CAywO7E"}
|
package/dist/scope-do.js
CHANGED
|
@@ -2,13 +2,13 @@ import { REWIND_REFUSED } from './rewind-refusal.js';
|
|
|
2
2
|
import { SYSTEM_DOOR_MOVED } from './system-door.js';
|
|
3
3
|
import { DurableObject } from 'cloudflare:workers';
|
|
4
4
|
import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, principalBecomeCapabilityInput, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, pageOf, countedPageOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
|
|
5
|
-
import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleErasurePlan, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_LEASE_EXPIRED_NOTE, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, topUpEntityGrantShapes, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSteps, planMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, queueAttachmentTextBackfill, startAttachmentTextBackfill, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, ancestorsWithin, } from '@substrat-run/kernel';
|
|
5
|
+
import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleErasurePlan, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_LEASE_EXPIRED_NOTE, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, topUpEntityGrantShapes, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_CONDEMNED_DDL, condemnOrphanAttachments, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, queueAttachmentTextBackfill, startAttachmentTextBackfill, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, ancestorsWithin, } from '@substrat-run/kernel';
|
|
6
6
|
import { isUpgradeRequest, readSubscription, LIVE_DECIDE_ATTEMPTS, LIVE_FANOUT_LIMIT, LIVE_MODE_HEADER, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, LIVE_EXPIRES_HEADER, LIVE_CLOSE, LIVE_SOCKETS_PER_PRINCIPAL, decodeLiveWithin, liveInstant, } from './live-reads.js';
|
|
7
7
|
import { replyOf } from './do-reply.js';
|
|
8
8
|
import { OperationQueue } from './serialization.js';
|
|
9
9
|
import { assertNoWorkerdStorage, doScopedSql, doBuiltColumnsOf, doRedactionSql, doSpineSql } from './sql.js';
|
|
10
|
-
import { actorOf, admitPeer, collectPeers, switchPeer, peerSubjectRef, subjectGrantState, assertNoSecret, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, splitSqlStatements, executableSqlStatements, blankSqlComments, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, assertNoCallerPurge, isUnreachableParent, PURGE_BATCH, heldPurgePass, lifecycleRefusal, purgeHeldBy, purgeDueOf, purgeOnlyKeysOf, runPurgePass, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readOperationSeries, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
|
|
11
|
-
import { COPY_RESTORE_FENCE_LAPSED, copyRestoreFenceLapsed } from '@substrat-run/kernel';
|
|
10
|
+
import { actorOf, admitPeer, boundToPeerDeclarations, collectPeers, switchPeer, peerSubjectRef, subjectGrantState, assertNoSecret, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, splitSqlStatements, executableSqlStatements, blankSqlComments, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, assertNoCallerPurge, isUnreachableParent, PURGE_BATCH, heldPurgePass, lifecycleRefusal, purgeHeldBy, purgeDueOf, purgeOnlyKeysOf, runPurgePass, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability, guardSecrets, mintBecomeCapability, redactSecrets, redactSecretText, moduleLog, asyncInvocationId, asyncLinePass, resolveCapabilitySession, revokeCapabilityAsPlatform, readCapabilityPage, domainEventOf, facetEvents, readDeadLetters, readLifecycleFlow, readOperationSeries, readHistory, readInvocation, readUndrainedOutbox, walkEventCause, walkEventEffects, } from '@substrat-run/kernel';
|
|
11
|
+
import { COPY_RESTORE_FENCE_LAPSED, copyRestoreFenceLapsed, orphanSweepVersionRefusal } from '@substrat-run/kernel';
|
|
12
12
|
import { createDoTupleChecker, createLocalControlPlaneReader, scopeTupleReader } from './checker.js';
|
|
13
13
|
import { settlePlatformRequestIn } from '@substrat-run/kernel';
|
|
14
14
|
import { CARRIED_AWAY_KEY, COPY_MARK_CLEARED_KEY, KEPT_COPY_REFUSAL, KEPT_DIVERGENT_KEY, LOAD_STAMP_KEY, STORE_LOCAL_META_KEYS, WRITE_REVISION_KEY, carriedAwayDump, isCopyMarkInsert, isWriteStatement, assertSpineTablesBuilt, capabilitiesForLoad, clearCopyMarker, dumpRowsInsert, isSpineTable, markCopyOrigin, repointScopeGrants, settleCopiedWork, emittedHere, IS_COPY_SQL, isCopyLoad, isLifecycleWrite, readLifecycle, settleLifecycleAfterLoad, writeLifecycle, spineColumnAdditions } from '@substrat-run/kernel';
|
|
@@ -352,6 +352,9 @@ const KERNEL_DDL = `
|
|
|
352
352
|
-- #1575: attachment text and its FTS5 index, shared from @substrat-run/kernel. After
|
|
353
353
|
-- _substrat_attachments, whose delete trigger it adds.
|
|
354
354
|
${ATTACHMENT_TEXT_DDL}
|
|
355
|
+
-- #2314: the orphan sweep's tombstones, shared from @substrat-run/kernel. An id here
|
|
356
|
+
-- never takes an attachment row again: the insert path refuses it.
|
|
357
|
+
${ATTACHMENT_CONDEMNED_DDL}
|
|
355
358
|
-- #901: an entity's version is the ULID of the last event about it (a state move
|
|
356
359
|
-- excepted, #2191), so the newest id per (entity_type, entity_id) is the read. The id
|
|
357
360
|
-- column sits last so SQLite walks the matched range backwards instead of aggregating.
|
|
@@ -365,6 +368,9 @@ const KERNEL_DDL = `
|
|
|
365
368
|
-- an exchange trades that secret for. Shared with the pure adapter from
|
|
366
369
|
-- @substrat-run/kernel so the two cannot part company; the column comments are there.
|
|
367
370
|
${CAPABILITY_DDL}
|
|
371
|
+
-- Upload links: a short-lived, single-use URL that lets a caller with no session upload ONE
|
|
372
|
+
-- file to ONE entity. Shared with the pure adapter from @substrat-run/kernel.
|
|
373
|
+
${UPLOAD_LINK_DDL}
|
|
368
374
|
-- #1686: where a copied scope's data came from, and the event id its own events start above.
|
|
369
375
|
-- Shared with the other adapter from @substrat-run/kernel; the column comments are there.
|
|
370
376
|
${COPY_ORIGIN_DDL}
|
|
@@ -752,6 +758,8 @@ export function defineScopeDO(modules, bareOps) {
|
|
|
752
758
|
erasurePlans = [];
|
|
753
759
|
/** entityType → the declared attachment gate (#473): read key + write key (default: read). */
|
|
754
760
|
attachmentTargets = new Map();
|
|
761
|
+
/** entityType → the `uploadLinks` policy its `attachmentTargets` entry declares; absent = no links. */
|
|
762
|
+
uploadLinkPolicies = new Map();
|
|
755
763
|
/**
|
|
756
764
|
* entityType → the declared live-read gate (#938): the key a subscriber must hold
|
|
757
765
|
* ON THAT ENTITY before a change to it is announced. Absent = announced to nobody;
|
|
@@ -839,7 +847,9 @@ export function defineScopeDO(modules, bareOps) {
|
|
|
839
847
|
if (highest)
|
|
840
848
|
this.mintEventId.seedFrom(highest);
|
|
841
849
|
const controlPlane = this.controlPlaneReader();
|
|
842
|
-
|
|
850
|
+
// #2263: a peer holds only what this code's declaration names, whatever the tuples say. The
|
|
851
|
+
// union is this class's code-time module set, so a promote (new code) is a new union.
|
|
852
|
+
this.checker = boundToPeerDeclarations(createDoTupleChecker({ scopeSql: this.sql, controlPlane }), () => this.peers);
|
|
843
853
|
}
|
|
844
854
|
// -- module registration (port of SqliteScopeHost.registerModule) ---------
|
|
845
855
|
registerModule(registration) {
|
|
@@ -923,6 +933,13 @@ export function defineScopeDO(modules, bareOps) {
|
|
|
923
933
|
`(${existing.read}/${existing.write}) vs (${gate.read}/${gate.write})`);
|
|
924
934
|
}
|
|
925
935
|
this.attachmentTargets.set(target.entityType, gate);
|
|
936
|
+
if (target.uploadLinks) {
|
|
937
|
+
const known = this.uploadLinkPolicies.get(target.entityType);
|
|
938
|
+
if (known && JSON.stringify(known) !== JSON.stringify(target.uploadLinks)) {
|
|
939
|
+
throw new Error(`conflicting uploadLinks policies for attachment target '${target.entityType}'`);
|
|
940
|
+
}
|
|
941
|
+
this.uploadLinkPolicies.set(target.entityType, target.uploadLinks);
|
|
942
|
+
}
|
|
926
943
|
}
|
|
927
944
|
// Live-read targets (#938): entityType → the read key a subscriber must pass ON
|
|
928
945
|
// THAT ENTITY before a change to it is announced. Validated exactly like the
|
|
@@ -2833,6 +2850,96 @@ export function defineScopeDO(modules, bareOps) {
|
|
|
2833
2850
|
attachmentList(...args) {
|
|
2834
2851
|
return thrownForRpc(() => this.listAttachments(...args));
|
|
2835
2852
|
}
|
|
2853
|
+
/**
|
|
2854
|
+
* Redeem an upload link: the attachment write of `attachmentAdd`, with the link spent in the
|
|
2855
|
+
* same transaction. Its OWN verb, never a trailing argument on `attachmentAdd`: a DO that
|
|
2856
|
+
* predates it fails the call (no such RPC method) instead of ignoring the secret and
|
|
2857
|
+
* writing an attachment a link never paid for. The write is checked as `record.createdBy`,
|
|
2858
|
+
* which the kernel holds to the link's minter inside the transaction.
|
|
2859
|
+
*/
|
|
2860
|
+
attachmentRedeemUploadLinkReply(record, secret, tenantId, scopeId, idempotencyKey) {
|
|
2861
|
+
return replyOf(() => this.addAttachment(record, record.createdBy, tenantId, scopeId, undefined, {
|
|
2862
|
+
secret,
|
|
2863
|
+
idempotencyKey,
|
|
2864
|
+
}));
|
|
2865
|
+
}
|
|
2866
|
+
/**
|
|
2867
|
+
* #2314: the scope side of one orphan-sweep pass over `ids`. With `condemn`, the ids no row
|
|
2868
|
+
* names are tombstoned in one transaction, which the attachment insert refuses from then on,
|
|
2869
|
+
* and only they may be deleted; without it (a dry run), they are only read.
|
|
2870
|
+
*
|
|
2871
|
+
* Only the copy that holds the scope's rows may judge them, so this refuses, before anything
|
|
2872
|
+
* is migrated: a reaped store, a scope whose delivered lifecycle is not active, a scope not
|
|
2873
|
+
* provisioned here for `tenantId`, a store that holds nothing (an object this namespace never
|
|
2874
|
+
* held, woken by this call), a copy a carry wiped or kept, and a fork or snapshot. Each of
|
|
2875
|
+
* those would read every object as an orphan. Any doubt refuses.
|
|
2876
|
+
*/
|
|
2877
|
+
orphanAttachmentsReply(ids, now, tenantId, condemn,
|
|
2878
|
+
// Whether the coordinator's directory named this scope a primary of `tenantId`. Only that
|
|
2879
|
+
// stands in for a missing receipt: a scope provisioned on a host with a directory holds none.
|
|
2880
|
+
vouched = false,
|
|
2881
|
+
// The version the platform routed this pass to, judged against the version this script is
|
|
2882
|
+
// deployed as: this object shares the script's env, so it reads the binding the upload sets.
|
|
2883
|
+
expectedVersionId) {
|
|
2884
|
+
return replyOf(async () => {
|
|
2885
|
+
const misrouted = orphanSweepVersionRefusal(this.env.SUBSTRAT_VERSION_ID ?? null, expectedVersionId, condemn);
|
|
2886
|
+
if (misrouted)
|
|
2887
|
+
throw misrouted;
|
|
2888
|
+
await this.refuseOrphanJudgement(tenantId, vouched);
|
|
2889
|
+
// The verdict alone (no ids, the host's first call) changes nothing: no migration, no repair.
|
|
2890
|
+
if (ids.length === 0)
|
|
2891
|
+
return [];
|
|
2892
|
+
await this.ensureMigrations();
|
|
2893
|
+
return this.queue.enqueue(async () => {
|
|
2894
|
+
await this.refuseOrphanJudgement(tenantId, vouched);
|
|
2895
|
+
if (!condemn)
|
|
2896
|
+
return rowlessAttachmentIds(doSpineSql(this.sql), ids);
|
|
2897
|
+
return this.revision.transaction(async () => condemnOrphanAttachments(doSpineSql(this.sql), ids, now));
|
|
2898
|
+
});
|
|
2899
|
+
});
|
|
2900
|
+
}
|
|
2901
|
+
/**
|
|
2902
|
+
* #2314: what the orphan sweep's fence needs from this storage, read without migrating: the
|
|
2903
|
+
* tenant its provision receipt names (or null), and whether it holds any attachment row.
|
|
2904
|
+
*/
|
|
2905
|
+
async sweepFenceFacts() {
|
|
2906
|
+
return {
|
|
2907
|
+
tenant: this.provisionedFor(),
|
|
2908
|
+
holdsAttachments: this.hasTable('_substrat_attachments') &&
|
|
2909
|
+
this.sql.exec('SELECT 1 FROM _substrat_attachments LIMIT 1').toArray().length > 0,
|
|
2910
|
+
};
|
|
2911
|
+
}
|
|
2912
|
+
/** #2314: why this copy may not judge which attachment bytes are orphans, as a refusal. */
|
|
2913
|
+
async refuseOrphanJudgement(tenantId, vouched) {
|
|
2914
|
+
// First, and before any table is read: a reaped store holds none.
|
|
2915
|
+
if (await this.isReaped()) {
|
|
2916
|
+
throw substratError('conflict', 'refused: this scope copy may not judge orphan attachments, because its storage was reaped');
|
|
2917
|
+
}
|
|
2918
|
+
const { verdict } = this.tenantVerdict(tenantId);
|
|
2919
|
+
const lifecycle = readLifecycle(this.switchSql());
|
|
2920
|
+
const why = lifecycle && (lifecycle.scope !== 'active' || lifecycle.tenant !== 'active')
|
|
2921
|
+
? `its lifecycle is not active (scope ${lifecycle.scope}, tenant ${lifecycle.tenant})`
|
|
2922
|
+
: verdict === 'foreign' || (verdict !== 'recorded' && !vouched)
|
|
2923
|
+
? `it holds no provision receipt for tenant ${tenantId} (${verdict})`
|
|
2924
|
+
: verdict === 'unknown' && !this.holdsData()
|
|
2925
|
+
? 'it holds nothing: this namespace does not hold the scope'
|
|
2926
|
+
: this.carriedAwayCopy
|
|
2927
|
+
? 'it is a copy a carry wiped'
|
|
2928
|
+
: this.hasTable('_substrat_meta') && this.metaValue(KEPT_DIVERGENT_KEY)
|
|
2929
|
+
? 'it is a kept copy'
|
|
2930
|
+
: this.hasTable('_substrat_copy_origin') && this.isCopy()
|
|
2931
|
+
? 'it is a fork or a snapshot'
|
|
2932
|
+
: null;
|
|
2933
|
+
if (why)
|
|
2934
|
+
throw substratError('conflict', `refused: this scope copy may not judge orphan attachments, because ${why}`);
|
|
2935
|
+
}
|
|
2936
|
+
/** Look an upload link up without spending it — what the route judges a body against. */
|
|
2937
|
+
uploadLinkInspectReply(secret, _tenantId, _scopeId, target, idempotencyKey) {
|
|
2938
|
+
return replyOf(async () => {
|
|
2939
|
+
await this.ensureMigrations();
|
|
2940
|
+
return await this.queue.enqueue(() => inspectUploadLink({ sql: doSpineSql(this.sql), now: instant.parse(new Date().toISOString()) }, secret, target, idempotencyKey));
|
|
2941
|
+
});
|
|
2942
|
+
}
|
|
2836
2943
|
attachmentListReply(...args) {
|
|
2837
2944
|
return replyOf(() => this.listAttachments(...args));
|
|
2838
2945
|
}
|
|
@@ -2858,7 +2965,10 @@ export function defineScopeDO(modules, bareOps) {
|
|
|
2858
2965
|
async addAttachment(record, principal, tenantId, scopeId,
|
|
2859
2966
|
// #476: when set, the gate is checked as this CONNECTION (not `principal`, which is
|
|
2860
2967
|
// then only the ctx.principal placeholder the connector door passes).
|
|
2861
|
-
connectionId
|
|
2968
|
+
connectionId,
|
|
2969
|
+
// An upload-link redemption: the link is spent in this same transaction, recording the
|
|
2970
|
+
// hash of the request's idempotency key (#2315).
|
|
2971
|
+
uploadLink) {
|
|
2862
2972
|
await this.ensureMigrations();
|
|
2863
2973
|
const parsed = attachmentRecord.parse(record);
|
|
2864
2974
|
const gate = this.attachmentGate(parsed.entity.entityType);
|
|
@@ -2871,6 +2981,8 @@ export function defineScopeDO(modules, bareOps) {
|
|
|
2871
2981
|
await this.revision.transaction(async () => {
|
|
2872
2982
|
const ctx = this.operationContext(principal, tenantId, scopeId, undefined, connectionId, undefined, undefined, undefined, 'attachments.upload');
|
|
2873
2983
|
assertAllowed(await ctx.check(gate.write, parsed.entity));
|
|
2984
|
+
// #2314: an id the orphan sweep condemned takes no row, in this same transaction.
|
|
2985
|
+
refuseCondemnedAttachment(doSpineSql(this.sql), parsed.id);
|
|
2874
2986
|
this.sql.exec(`INSERT INTO _substrat_attachments
|
|
2875
2987
|
(id, entity_type, entity_id, filename, content_type, size, sha256,
|
|
2876
2988
|
visibility, created_by, created_at)
|
|
@@ -2885,6 +2997,13 @@ export function defineScopeDO(modules, bareOps) {
|
|
|
2885
2997
|
// #1575: queue its text extraction in the same transaction — a `pending` row
|
|
2886
2998
|
// and a job run. Nothing is extracted here, so nothing here can fail the upload.
|
|
2887
2999
|
enqueueAttachmentText(doSpineSql(this.sql), parsed.id, ulid(), new Date().toISOString());
|
|
3000
|
+
if (uploadLink !== undefined) {
|
|
3001
|
+
await redeemUploadLinkInTransaction({
|
|
3002
|
+
sql: doSpineSql(this.sql),
|
|
3003
|
+
now: instant.parse(new Date().toISOString()),
|
|
3004
|
+
emit: (event) => kernelEmit(ctx, event),
|
|
3005
|
+
}, uploadLink.secret, parsed, uploadLink.idempotencyKey);
|
|
3006
|
+
}
|
|
2888
3007
|
});
|
|
2889
3008
|
}
|
|
2890
3009
|
catch (err) {
|
|
@@ -2895,7 +3014,16 @@ export function defineScopeDO(modules, bareOps) {
|
|
|
2895
3014
|
}
|
|
2896
3015
|
// #1525: null. An attachment RPC carries no invocation, exactly as its denial
|
|
2897
3016
|
// records none — so the deliveries it drains name no call rather than a wrong one.
|
|
2898
|
-
|
|
3017
|
+
// The row has COMMITTED, so a failed drain must not reach the caller as a refusal:
|
|
3018
|
+
// the host deletes the bytes on a refusal, which would leave this row without them
|
|
3019
|
+
// (and a redeemed link spent). An undelivered event stays in the outbox with no
|
|
3020
|
+
// delivery row, so the next drain in this scope delivers it.
|
|
3021
|
+
try {
|
|
3022
|
+
await this.settleCommitted(tenantId, scopeId, liveSince, null);
|
|
3023
|
+
}
|
|
3024
|
+
catch (err) {
|
|
3025
|
+
console.error('substrat: consumer drain failed after an attachment committed', err);
|
|
3026
|
+
}
|
|
2899
3027
|
return parsed;
|
|
2900
3028
|
});
|
|
2901
3029
|
}
|
|
@@ -3595,7 +3723,7 @@ export function defineScopeDO(modules, bareOps) {
|
|
|
3595
3723
|
* unqueued read as the line above: nothing here decides a write.
|
|
3596
3724
|
*/
|
|
3597
3725
|
async peerGrantsStatus() {
|
|
3598
|
-
return peerGrantsStatus(this.switchSql(), new Date().toISOString());
|
|
3726
|
+
return peerGrantsStatus(this.switchSql(), new Date().toISOString(), this.peers);
|
|
3599
3727
|
}
|
|
3600
3728
|
/**
|
|
3601
3729
|
* The exchange (#1672) — a capability's secret traded for a session, or for the
|
|
@@ -3752,7 +3880,14 @@ export function defineScopeDO(modules, bareOps) {
|
|
|
3752
3880
|
* the scope that received the call, whatever this says. A wrong one fails closed, since the
|
|
3753
3881
|
* module's grant is seated on this scope's node and not on the one named.
|
|
3754
3882
|
*/
|
|
3755
|
-
scopeId, systemDoorInstance
|
|
3883
|
+
scopeId, systemDoorInstance,
|
|
3884
|
+
/**
|
|
3885
|
+
* #2192: the schedule run this pass belongs to. Every purge in it runs under that id, so its
|
|
3886
|
+
* events, denials and deliveries join the run's own line. LAST and optional for the
|
|
3887
|
+
* positional-RPC reason `recordExecutorAttempt` gives; a coordinator without it gets a fresh
|
|
3888
|
+
* id per purge, as before.
|
|
3889
|
+
*/
|
|
3890
|
+
runInvocationId) {
|
|
3756
3891
|
await this.ensureMigrations();
|
|
3757
3892
|
const schedule = this.purgeSchedules.get(operation);
|
|
3758
3893
|
if (!schedule)
|
|
@@ -3773,7 +3908,7 @@ export function defineScopeDO(modules, bareOps) {
|
|
|
3773
3908
|
return heldPurgePass(held);
|
|
3774
3909
|
const due = purgeDueOf(doSpineSql(this.sql), this.statePlans, this.operationTarget, operation, schedule.entityType, new Date().toISOString(), PURGE_BATCH);
|
|
3775
3910
|
return runPurgePass(operation, due, async (entityId) => {
|
|
3776
|
-
await this.#invokeOrThrow(operation, { [due.idFrom]: entityId }, schedule.moduleId, tenantId, scopeId, undefined, undefined, schedule.moduleId, { invocationId: ulid() }, undefined, undefined, undefined, systemDoorInstance, true);
|
|
3911
|
+
await this.#invokeOrThrow(operation, { [due.idFrom]: entityId }, schedule.moduleId, tenantId, scopeId, undefined, undefined, schedule.moduleId, { invocationId: runInvocationId ?? ulid() }, undefined, undefined, undefined, systemDoorInstance, true);
|
|
3777
3912
|
}, (write) => write(doSpineSql(this.sql)));
|
|
3778
3913
|
}
|
|
3779
3914
|
/**
|
|
@@ -4182,6 +4317,15 @@ export function defineScopeDO(modules, bareOps) {
|
|
|
4182
4317
|
await this.queue.enqueue(async () => this.repairDerived());
|
|
4183
4318
|
return false;
|
|
4184
4319
|
}
|
|
4320
|
+
// #2349: before the bookmark and before any SQL, the registered set is held to the one
|
|
4321
|
+
// stored for the version this script serves. Only here, so a scope with nothing pending
|
|
4322
|
+
// never computes it.
|
|
4323
|
+
const unstored = await migrationSetDivergence(this.modules.values(), this.env.SUBSTRAT_MIGRATIONS_DIGEST);
|
|
4324
|
+
if (unstored) {
|
|
4325
|
+
const key = `${pending[0].moduleId}@${pending[0].migration.version}`;
|
|
4326
|
+
this.lastFailure = { version: key, error: unstored };
|
|
4327
|
+
throw migrationFailedError(key, unstored);
|
|
4328
|
+
}
|
|
4185
4329
|
this.migrationRuns += 1;
|
|
4186
4330
|
await this.queue.enqueue(async () => {
|
|
4187
4331
|
// #286: bookmark the instant before an UPGRADE migrates live data — the
|
|
@@ -4236,9 +4380,10 @@ export function defineScopeDO(modules, bareOps) {
|
|
|
4236
4380
|
let steps;
|
|
4237
4381
|
this.revisionSuspended = true;
|
|
4238
4382
|
try {
|
|
4239
|
-
|
|
4383
|
+
// #115: an authored one is also held to the data-loss fence, inside this transaction.
|
|
4384
|
+
steps = runMigrationStatements(doSpineSql(this.sql), migration, (stmt) => {
|
|
4240
4385
|
this.sql.exec(stmt);
|
|
4241
|
-
});
|
|
4386
|
+
}, { key, authored });
|
|
4242
4387
|
// #2090: the state columns this migration must have left, and after the last of
|
|
4243
4388
|
// the pass, the triggers and indexes a create-copy-rename rebuild dropped.
|
|
4244
4389
|
const last = i === pending.length - 1;
|
|
@@ -4887,6 +5032,9 @@ export function defineScopeDO(modules, bareOps) {
|
|
|
4887
5032
|
// #2009: the copy classification on a scope DO built before it (NULL reads as a copy;
|
|
4888
5033
|
// see `COPY_ORIGIN_DDL`).
|
|
4889
5034
|
'ALTER TABLE _substrat_copy_origin ADD COLUMN is_copy INTEGER',
|
|
5035
|
+
// #2315: the hash of the key a redemption carried, on a scope DO built before it. NULL = the
|
|
5036
|
+
// spending request carried none, the honest reading of every link already spent.
|
|
5037
|
+
'ALTER TABLE _substrat_upload_links ADD COLUMN redeemed_key_hash TEXT',
|
|
4890
5038
|
]) {
|
|
4891
5039
|
try {
|
|
4892
5040
|
this.sql.exec(alter);
|
|
@@ -5005,6 +5153,9 @@ export function defineScopeDO(modules, bareOps) {
|
|
|
5005
5153
|
// #2016: this store's own tenant receipt, read before the drops take it. A load never
|
|
5006
5154
|
// changes which tenant the scope belongs to: the platform's word for it (`provisionedFor`)
|
|
5007
5155
|
// must agree with the receipt held, and is refused before the first drop if it does not.
|
|
5156
|
+
// #2314: a row for an id the orphan sweep condemned here is refused, as the insert refuses it.
|
|
5157
|
+
// Judged on `replayable`, the very tables whose rows the replay below inserts.
|
|
5158
|
+
refuseCondemnedInDump(doSpineSql(this.sql), replayable);
|
|
5008
5159
|
const receiptBefore = this.provisionedFor();
|
|
5009
5160
|
if (provisionedFor !== undefined && receiptBefore !== null && receiptBefore !== provisionedFor) {
|
|
5010
5161
|
const refused = substratError('conflict', tenantReceiptRefusal(receiptBefore, provisionedFor));
|
|
@@ -6046,6 +6197,24 @@ export function defineScopeDO(modules, bareOps) {
|
|
|
6046
6197
|
assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
|
|
6047
6198
|
minted,
|
|
6048
6199
|
}),
|
|
6200
|
+
// Upload links: mint / revoke / list, written once in the kernel — the same four things
|
|
6201
|
+
// `capabilities` is handed, and the same consumer-is-system-actor rule.
|
|
6202
|
+
attachments: createAttachmentVerbs({
|
|
6203
|
+
sql: doSpineSql(sql),
|
|
6204
|
+
subject: systemActor ? { kind: 'system', id: systemActor.system } : subject,
|
|
6205
|
+
now: at,
|
|
6206
|
+
check: runCheck,
|
|
6207
|
+
emit: (event) => writeEvent(event, 'kernel'),
|
|
6208
|
+
assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
|
|
6209
|
+
minted,
|
|
6210
|
+
targetOf: (entityType) => {
|
|
6211
|
+
const gate = this.attachmentTargets.get(entityType);
|
|
6212
|
+
if (!gate)
|
|
6213
|
+
return undefined;
|
|
6214
|
+
const uploadLinks = this.uploadLinkPolicies.get(entityType);
|
|
6215
|
+
return uploadLinks ? { write: gate.write, uploadLinks } : { write: gate.write };
|
|
6216
|
+
},
|
|
6217
|
+
}),
|
|
6049
6218
|
// K-16 / #1864: link and relink, written once in the kernel over the raw spine seam.
|
|
6050
6219
|
...createEntityEdgeVerbs({
|
|
6051
6220
|
sql: doSpineSql(sql),
|