@substrat-run/adapter-cloudflare 0.171.0 → 0.173.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/host.d.ts +5 -0
- package/dist/host.d.ts.map +1 -1
- package/dist/host.js +3 -0
- package/dist/host.js.map +1 -1
- package/dist/scope-do.d.ts.map +1 -1
- package/dist/scope-do.js +32 -8
- package/dist/scope-do.js.map +1 -1
- package/package.json +9 -9
package/dist/scope-do.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,
|
|
1
|
+
{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAuDL,KAAK,QAAQ,EAWd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EA+DL,KAAK,mBAAmB,EASxB,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAyHtB,MAAM,sBAAsB,CAAC;AAoD9B,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAwBL,kBAAkB,EAiFnB,MAAM,sBAAsB,CAAC;AA2B9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAoFD,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAgB5E;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AASnE,iDAAiD;AACjD,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvH;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IACtH,YAAY,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IAClH,UAAU,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IACvG,cAAc,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAClG,KAAK,EAAE,SAAS,CAAC;CAClB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAg0BjG;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAmBtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,gHAAgH;AAChH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA2B9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACzD;;;;GAIG;AACH,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,mBAAmB,CAAA;CAAO,GAClD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAAC,UAAU,CAAC,CAi9Q7E"}
|
package/dist/scope-do.js
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { REWIND_REFUSED } from './rewind-refusal.js';
|
|
2
2
|
import { SYSTEM_DOOR_MOVED } from './system-door.js';
|
|
3
3
|
import { DurableObject } from 'cloudflare:workers';
|
|
4
|
-
import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, principalBecomeCapabilityInput, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_DUMP_PAGE_MAX_BYTES, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, pageOf, countedPageOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
|
|
4
|
+
import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, CAPTURE_REFUSALS, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, principalBecomeCapabilityInput, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_DUMP_PAGE_MAX_BYTES, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, pageOf, countedPageOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
|
|
5
5
|
import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleErasurePlan, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_LEASE_EXPIRED_NOTE, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, topUpEntityGrantShapes, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, SCOPE_SEATED_ROLES_SQL, inUnitRoleRefusal, loadedRoleSetRefusedRole, reservedRoleSetRefusedRole, reservedGrantRefusal, reservedRoleRefusal, reservedShapeRefusal, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_BYTES_SQL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, WIRE_NONCE_DDL, WIRE_NONCE_FULL, claimWireNonceIn, isWireNonceTable, isWireNonceWrite, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, queueAttachmentTextBackfill, startAttachmentTextBackfill, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, ancestorsWithin, } from '@substrat-run/kernel';
|
|
6
6
|
import { isUpgradeRequest, readSubscription, LIVE_DECIDE_ATTEMPTS, LIVE_FANOUT_LIMIT, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, LIVE_EXPIRES_HEADER, LIVE_CLOSE, LIVE_SOCKETS_PER_PRINCIPAL, decodeLiveWithin, liveInstant, liveRefusal, liveRefusalStatus, } from './live-reads.js';
|
|
7
7
|
import { replyOf } from './do-reply.js';
|
|
@@ -482,9 +482,9 @@ const CAPTURE_IDLE_MS = SCOPE_COPY_LEASE_MS;
|
|
|
482
482
|
const CAPTURE_BATCH_ROWS = 2_000;
|
|
483
483
|
/** Rowids per `IN (…)`: a Durable Object's SQLite binds at most 100 parameters to a statement. */
|
|
484
484
|
const CAPTURE_IN_CHUNK = 90;
|
|
485
|
-
const CAPTURE_GONE =
|
|
486
|
-
const CAPTURE_SCHEMA_MOVED =
|
|
487
|
-
const CAPTURE_EXPRESSION_INDEX =
|
|
485
|
+
const CAPTURE_GONE = CAPTURE_REFUSALS.gone;
|
|
486
|
+
const CAPTURE_SCHEMA_MOVED = CAPTURE_REFUSALS.schemaMoved;
|
|
487
|
+
const CAPTURE_EXPRESSION_INDEX = CAPTURE_REFUSALS.expressionIndex;
|
|
488
488
|
/** A write the capture path takes: one whose target is a capture table or a capture trigger. */
|
|
489
489
|
const CAPTURE_STATEMENT = /^\s*(?:CREATE TABLE IF NOT EXISTS|INSERT INTO|UPDATE|DELETE FROM|DROP TABLE IF EXISTS|CREATE TRIGGER|DROP TRIGGER IF EXISTS)\s+"?_substrat_capture(?:\b|_)/;
|
|
490
490
|
const quoteIdent = (name) => `"${name.replaceAll('"', '""')}"`;
|
|
@@ -2208,6 +2208,12 @@ options = {}) {
|
|
|
2208
2208
|
* instance may be rewound storage the gate never saw. The reply carries `systemDoor.honoured`.
|
|
2209
2209
|
*/
|
|
2210
2210
|
systemDoorInstance) {
|
|
2211
|
+
// #2762: filled by `ctx.log` while the queued body runs. Only reported when asked, so the
|
|
2212
|
+
// envelope of a caller that did not ask is what it was, and only once the queued body ran:
|
|
2213
|
+
// a call refused before it (an unknown operation, an input that fails its parse) is "not
|
|
2214
|
+
// recorded", as the SQLite host has it, never a `0`.
|
|
2215
|
+
const logTally = { logLines: 0, reached: false };
|
|
2216
|
+
const withLogLines = (envelope) => invokeOptions?.onLogLines !== undefined && logTally.reached ? { ...envelope, logLines: logTally.logLines } : envelope;
|
|
2211
2217
|
if (!failureEnvelope) {
|
|
2212
2218
|
// Legacy path, byte-for-byte what it was: rewrapped so a non-plain error (a
|
|
2213
2219
|
// ZodError, whose `message` is a getter) still arrives with its message.
|
|
@@ -2221,7 +2227,7 @@ options = {}) {
|
|
|
2221
2227
|
}
|
|
2222
2228
|
}
|
|
2223
2229
|
try {
|
|
2224
|
-
return await this.#invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller, systemDoorInstance);
|
|
2230
|
+
return withLogLines(await this.#invokeOrThrow(operation, input, principal, tenantId, scopeId, connectionId, requiredEntitlement, systemModuleId, invokeOptions, impersonation, capabilitySession, verticalCaller, systemDoorInstance, undefined, logTally));
|
|
2225
2231
|
}
|
|
2226
2232
|
catch (err) {
|
|
2227
2233
|
// #1834: the pin missed — an answer, never a failure an operation could have produced.
|
|
@@ -2230,7 +2236,7 @@ options = {}) {
|
|
|
2230
2236
|
// The ONE place the error keeps its structure: flattened here, rebuilt by the
|
|
2231
2237
|
// coordinator. `toRpcError` is not applied — that exists to make a throw
|
|
2232
2238
|
// survivable, and this is not a throw.
|
|
2233
|
-
return { result: undefined, platformRequests: 0, failure: toWireFailure(err) };
|
|
2239
|
+
return withLogLines({ result: undefined, platformRequests: 0, failure: toWireFailure(err) });
|
|
2234
2240
|
}
|
|
2235
2241
|
}
|
|
2236
2242
|
/**
|
|
@@ -2250,7 +2256,9 @@ options = {}) {
|
|
|
2250
2256
|
/** #1834: the instance the system door's gate read. See `invoke` above. */
|
|
2251
2257
|
systemDoorInstance,
|
|
2252
2258
|
/** #119: set only by `runPurgeSweep` on its own invokes — never an RPC argument. */
|
|
2253
|
-
purge
|
|
2259
|
+
purge,
|
|
2260
|
+
/** #2762: where this call's `ctx.log` lines are counted — `invoke`'s, never an RPC argument. */
|
|
2261
|
+
logTally) {
|
|
2254
2262
|
await this.ensureMigrations();
|
|
2255
2263
|
const handler = this.operations.get(operation);
|
|
2256
2264
|
// `not_found`, not a bare throw (#113): every vertical hand-matched this message
|
|
@@ -2334,6 +2342,10 @@ options = {}) {
|
|
|
2334
2342
|
// stack: the bodies do not interleave, so set-and-clear here brackets exactly
|
|
2335
2343
|
// one call. Same placement as the SQLite adapter's actor task, for this reason.
|
|
2336
2344
|
this.invocationId = invokeOptions?.invocationId ?? null;
|
|
2345
|
+
// #2762: counted for the same span, for the same reason.
|
|
2346
|
+
this.logTally = logTally ?? null;
|
|
2347
|
+
if (logTally)
|
|
2348
|
+
logTally.reached = true;
|
|
2337
2349
|
try {
|
|
2338
2350
|
// #1834: before anything opens. This instance is the storage the call meets, for the
|
|
2339
2351
|
// whole call: a restore restarts the object, so it cannot move under a running body.
|
|
@@ -2593,6 +2605,7 @@ options = {}) {
|
|
|
2593
2605
|
// and stamps its events with a call they had nothing to do with. A wrong
|
|
2594
2606
|
// recorded fact, which is worse than the honest NULL this column uses.
|
|
2595
2607
|
this.invocationId = null;
|
|
2608
|
+
this.logTally = null;
|
|
2596
2609
|
}
|
|
2597
2610
|
});
|
|
2598
2611
|
}
|
|
@@ -5572,7 +5585,7 @@ options = {}) {
|
|
|
5572
5585
|
break;
|
|
5573
5586
|
}
|
|
5574
5587
|
}
|
|
5575
|
-
return { tables, next, loadStamp, revision: this.metaValue(WRITE_REVISION_KEY) };
|
|
5588
|
+
return { tables, next, loadStamp, revision: this.metaValue(WRITE_REVISION_KEY), ...(capture !== undefined ? { captured: true } : {}) };
|
|
5576
5589
|
}
|
|
5577
5590
|
/** A dumped table's columns, and whether its rows are read, and named, by rowid. */
|
|
5578
5591
|
tableShape(name, sql) {
|
|
@@ -6989,6 +7002,12 @@ options = {}) {
|
|
|
6989
7002
|
* passed into the consumer's context (`ConsumerDelivery`, #2055).
|
|
6990
7003
|
*/
|
|
6991
7004
|
invocationId = null;
|
|
7005
|
+
/**
|
|
7006
|
+
* #2762: the `ctx.log` lines written during the `invoke` now running, or null outside one —
|
|
7007
|
+
* set and cleared beside `invocationId`, so a consumer its tail runs inline counts and an
|
|
7008
|
+
* alarm-driven drain does not. Handed out through `invoke`'s tally, not read off here.
|
|
7009
|
+
*/
|
|
7010
|
+
logTally = null;
|
|
6992
7011
|
async dispatch(tenantId, scopeId,
|
|
6993
7012
|
/**
|
|
6994
7013
|
* #1525: the call this drain is running in, or null. Every round of the loop
|
|
@@ -7372,6 +7391,11 @@ options = {}) {
|
|
|
7372
7391
|
// The string-safe redaction: `redactSecrets` parses its serialization back, and a
|
|
7373
7392
|
// log's text is not JSON.
|
|
7374
7393
|
redact: (text) => redactSecretText(text, minted),
|
|
7394
|
+
// #2762: counted only inside an `invoke` (and the tail it runs inline).
|
|
7395
|
+
onLine: () => {
|
|
7396
|
+
if (this.logTally)
|
|
7397
|
+
this.logTally.logLines += 1;
|
|
7398
|
+
},
|
|
7375
7399
|
}),
|
|
7376
7400
|
// #2192: the same id the log lines carry.
|
|
7377
7401
|
get requestId() {
|