@substrat-run/adapter-cloudflare 0.175.0 → 0.177.0

package/dist/scope-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAuDL,KAAK,QAAQ,EAWd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EA+DL,KAAK,mBAAmB,EASxB,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EA4HtB,MAAM,sBAAsB,CAAC;AAoD9B,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAwBL,kBAAkB,EAiFnB,MAAM,sBAAsB,CAAC;AA2B9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAoFD,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAgB5E;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AASnE,iDAAiD;AACjD,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvH;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IACtH,YAAY,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IAClH,UAAU,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IACvG,cAAc,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAClG,KAAK,EAAE,SAAS,CAAC;CAClB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAg0BjG;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAmBtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,gHAAgH;AAChH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA2B9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACzD;;;;GAIG;AACH,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,mBAAmB,CAAA;CAAO,GAClD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAAC,UAAU,CAAC,CAu9Q7E"}
+{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAuDL,KAAK,QAAQ,EAmBd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EA+DL,KAAK,mBAAmB,EASxB,KAAK,SAAS,EA2Bd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EA8HtB,MAAM,sBAAsB,CAAC;AAoD9B,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAwBL,kBAAkB,EAiFnB,MAAM,sBAAsB,CAAC;AA2B9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAoFD,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAgB5E;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AASnE,iDAAiD;AACjD,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvH;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IACtH,YAAY,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IAClH,UAAU,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IACvG,cAAc,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAClG,KAAK,EAAE,SAAS,CAAC;CAClB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AA00BjG;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAmBtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,gHAAgH;AAChH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA2B9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACzD;;;;GAIG;AACH,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,mBAAmB,CAAA;CAAO,GAClD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAAC,UAAU,CAAC,CAyjR7E"}

package/dist/scope-do.js

@@ -1,8 +1,8 @@
 import { REWIND_REFUSED } from './rewind-refusal.js';
 import { SYSTEM_DOOR_MOVED } from './system-door.js';
 import { DurableObject } from 'cloudflare:workers';
-import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, CAPTURE_REFUSALS, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, principalBecomeCapabilityInput, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_DUMP_PAGE_MAX_BYTES, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, pageOf, countedPageOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleErasurePlan, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_LEASE_EXPIRED_NOTE, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, topUpEntityGrantShapes, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, SCOPE_SEATED_ROLES_SQL, inUnitRoleRefusal, loadedRoleSetRefusedRole, reservedRoleSetRefusedRole, reservedGrantRefusal, reservedRoleRefusal, reservedShapeRefusal, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_BYTES_SQL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, WIRE_NONCE_DDL, WIRE_NONCE_FULL, claimWireNonceIn, isWireNonceTable, isWireNonceWrite, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, queueAttachmentTextBackfill, startAttachmentTextBackfill, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, noteTransitionInto, withTransitions, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, ancestorsWithin, } from '@substrat-run/kernel';
+import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, CAPTURE_REFUSALS, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, principalBecomeCapabilityInput, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_DUMP_PAGE_MAX_BYTES, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, pageOf, countedPageOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, DUMP_OBJECTS_QUERY, dumpObjectsOf, replayDumpObjects, dumpObjectsAudit, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleErasurePlan, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_LEASE_EXPIRED_NOTE, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, topUpEntityGrantShapes, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, SCOPE_SEATED_ROLES_SQL, inUnitRoleRefusal, loadedRoleSetRefusedRole, reservedRoleSetRefusedRole, reservedGrantRefusal, reservedRoleRefusal, reservedShapeRefusal, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, OUTBOX_PRUNED_DDL, outboxSubscribersOf, pruneDrainedOutbox, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationAdmitted, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, REGISTERED_MIGRATIONS, registeredMigrationsOf, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_BYTES_SQL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, WIRE_NONCE_DDL, WIRE_NONCE_FULL, claimWireNonceIn, isWireNonceTable, isWireNonceWrite, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, queueAttachmentTextBackfill, startAttachmentTextBackfill, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, noteTransitionInto, withTransitions, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, ancestorsWithin, } from '@substrat-run/kernel';
 import { isUpgradeRequest, readSubscription, LIVE_DECIDE_ATTEMPTS, LIVE_FANOUT_LIMIT, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, LIVE_EXPIRES_HEADER, LIVE_CLOSE, LIVE_SOCKETS_PER_PRINCIPAL, decodeLiveWithin, liveInstant, liveRefusal, liveRefusalStatus, } from './live-reads.js';
 import { replyOf } from './do-reply.js';
 import { OperationQueue } from './serialization.js';
@@ -387,6 +387,7 @@ const KERNEL_DDL = `
   -- #1686: where a copied scope's data came from, and the event id its own events start above.
   -- Shared with the other adapter from @substrat-run/kernel; the column comments are there.
   ${COPY_ORIGIN_DDL}
+  ${OUTBOX_PRUNED_DDL}
   -- #119: the kernel's authorization for one archive/trash move, read by the derived update
   -- trigger. Shared with the other adapter from @substrat-run/kernel; the comments are there.
   ${ENTITY_STATE_MOVES_DDL}
@@ -442,16 +443,22 @@ const STAGE_IN_PROGRESS = 'a different staged load is in progress; retry after i
 const STAGE_MAX_AGE_MS = 6 * 3_600_000 + 3 * SCOPE_COPY_LEASE_MS;
 /**
  * A staged load's own tables (#2450): `_substrat_stage` (which load, and the next page it takes),
- * `_substrat_stage_tables` (each staged table's name, DDL and columns) and one
- * `_substrat_stage_rows_<n>` per staged table. They hold a carry's pages until the load commits
- * from them, so they are this store's, never its data: no dump carries them, and a load's drops
- * leave them to the commit that reads them.
+ * `_substrat_stage_tables` (each staged table's name, DDL and columns), `_substrat_stage_objects`
+ * (below) and one `_substrat_stage_rows_<n>` per staged table. They hold a carry's pages until the
+ * load commits from them, so they are this store's, never its data: no dump carries them, and a
+ * load's drops leave them to the commit that reads them.
  */
 const STAGE_GLOB = '_substrat_stage*';
 const STAGE_TABLES_DDL = [
     `CREATE TABLE _substrat_stage (stage_id TEXT NOT NULL, next_seq INTEGER NOT NULL)`,
     `CREATE TABLE _substrat_stage_tables (ord INTEGER PRIMARY KEY, name TEXT NOT NULL UNIQUE, ddl TEXT NOT NULL, columns TEXT NOT NULL)`,
 ];
+/**
+ * #2820: each staged table's own indexes and triggers, for a table whose pages carried them. Created
+ * by every page if missing, so a stage opened before it existed still takes pages, and commits with
+ * none: as a dump written before objects were carried.
+ */
+const STAGE_OBJECTS_DDL = `CREATE TABLE IF NOT EXISTS _substrat_stage_objects (name TEXT PRIMARY KEY, objects TEXT NOT NULL)`;
 const stageRowsTable = (ord) => `_substrat_stage_rows_${ord}`;
 /** How many staged rows a commit reads at a time. */
 const STAGE_READ_BATCH = 500;
@@ -892,6 +899,14 @@ options = {}) {
         noteDeclaredKeys(declaredListed, m.manifest);
     }
     return class ScopeDO extends DurableObject {
+        /**
+         * #2351: the migrations this class registers, read by the control plane, which evaluates the
+         * bundle in an isolate with no bindings and calls this before it stores the version. The same
+         * list `registerModule` keeps for each module (`moduleMigrations`).
+         */
+        static [REGISTERED_MIGRATIONS]() {
+            return registeredMigrationsOf(modules);
+        }
         sql;
         continuationOrder = 0;
         /** DO storage KV is private to the adapter; neither module SQL nor dumps can read it. */
@@ -944,6 +959,8 @@ options = {}) {
         purgeSchedules = new Map();
         /** #116: the operations that declared `idempotency: false` — refusals, not participants. */
         operationIdempotencyOptOut = new Set();
+        /** #2821: the operations that declared `impersonation: 'refused'` — no session may invoke them. */
+        operationImpersonationRefused = new Set();
         /** #2387: the operations held to a `ctx.check` — the pure adapter's set, from the same kernel read. */
         operationCheckHeld = new Set();
         modules = new Map();
@@ -1222,6 +1239,7 @@ options = {}) {
             // #116: same rule again for an opt-out — one on an unbound name reads as a
             // deliberate exclusion of an operation that is not there.
             const declaredOptOuts = registration.operations?.idempotencyOptOuts ?? [];
+            const impersonationRefused = registration.operations?.impersonationRefused ?? [];
             const unboundOptOuts = declaredOptOuts.filter((name) => !ownOps.has(name));
             if (unboundOptOuts.length > 0) {
                 throw new Error(`${manifest.id} declares idempotency: false for unbound operation(s): ` +
@@ -1244,6 +1262,9 @@ options = {}) {
                 if (declaredOptOuts.includes(name) && this.operations.has(name)) {
                     this.operationIdempotencyOptOut.add(name);
                 }
+                if (impersonationRefused.includes(name) && this.operations.has(name)) {
+                    this.operationImpersonationRefused.add(name);
+                }
                 const target = trashTargets.get(name);
                 if (target && this.operations.has(name))
                     this.operationTarget.set(name, target);
@@ -1807,6 +1828,20 @@ options = {}) {
                 return drained;
             });
         }
+        /**
+         * The retention prune (#1334): the kernel's `pruneDrainedOutbox`, on the queue and in one
+         * transaction, so the rows, their deliveries and the pruned-through floor go together.
+         */
+        async pruneDrainedEvents(drainedBefore, limit, executors, due = true) {
+            return this.queue.enqueue(() => this.revision.transactionSync(() => pruneDrainedOutbox(this.switchSql(), {
+                drainedBefore,
+                limit,
+                due,
+                // Executors run on the coordinator, which names them; the consumers are this DO's own.
+                subscribers: [...outboxSubscribersOf(this.modules.values(), []), ...executors],
+                exportTypes: this.crossVertical.exportTypes(),
+            })));
+        }
         /**
          * Reopen rows stamped strictly before `drainedBefore`, so the drain ships them again
          * (#1334). The kernel contract says why the instant is required; this is the mechanism.
@@ -2266,6 +2301,8 @@ options = {}) {
             // else. Naming the code once here is what lets those patterns go.
             if (!handler)
                 throw substratError('not_found', `unknown operation: ${operation}`);
+            // #2821: before the parse, the guards and the handler — and under read-only too.
+            assertImpersonationAdmitted(impersonation, operation, this.operationImpersonationRefused);
             // #304 entitlement gate, scope-local path: fail closed on the projected view exactly as
             // the coordinator fails closed against the CP. Only active once entitlements have been
             // projected (the `entitlements_enforced` marker) — before that the scope trusts upstream,
@@ -4364,11 +4401,12 @@ options = {}) {
             return await this.queue.enqueue(async () => {
                 const liveSince = this.liveHighWaterMark();
                 const now = instant.parse(new Date().toISOString());
-                let answer = { ok: true, unbound: [] };
+                let answer = { ok: true, unbound: [], revokedLinks: [] };
                 await this.revision.transaction(async () => {
                     answer = await unbindEntityHolderBounded({
                         sql: doSpineSql(this.sql),
                         now,
+                        caller: by,
                         allowed: allowedFor(this.checker, by, { tenantId, scopeId }),
                         emit: (event) => kernelEmit(this.operationContext(by, tenantId, scopeId, undefined, undefined, undefined, undefined, undefined, ENTITY_UNBIND_OPERATION, undefined, [], now), event),
                     }, entity);
@@ -5488,6 +5526,7 @@ options = {}) {
          * with the scope's identity after the K-3 check (host.ts admin.exportScope).
          */
         exportDump() {
+            const objects = this.dumpObjects();
             return this.dumpTableDefs().map(({ name, sql }) => {
                 // Raw positional rows, cells as-is (blobs kept as bytes, not nulled like a UI
                 // read) so the dump reloads faithfully. The name is from the live schema.
@@ -5495,9 +5534,13 @@ options = {}) {
                 const cursor = this.sql.exec(`SELECT * FROM "${name}" WHERE ${where}`, ...bindings);
                 const columns = cursor.columnNames;
                 const rows = Array.from(cursor.raw(), (row) => row);
-                return { name, ddl: sql, columns, rows };
+                return { name, ddl: sql, columns, rows, ...objects(name) };
             });
         }
+        /** #2820: each module table's own indexes and triggers, as a dump carries them beside the table. */
+        dumpObjects() {
+            return dumpObjectsOf(this.sql.exec(DUMP_OBJECTS_QUERY).toArray());
+        }
         /**
          * The tables a dump carries, by name. The derived search index (#827) is excluded: its shadow
          * tables cannot be replayed — this host answers "object name reserved for internal use" — and
@@ -5537,6 +5580,7 @@ options = {}) {
                 this.sql.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, ?)`, LOAD_STAMP_KEY, loadStamp);
             }
             const defs = this.dumpTableDefs();
+            const objects = this.dumpObjects();
             if (capture !== undefined) {
                 if (cursor === null)
                     this.openCapture(capture, defs);
@@ -5584,7 +5628,7 @@ options = {}) {
                     if (full || read.length < DUMP_READ_BATCH)
                         break;
                 }
-                tables.push({ name, ddl: sql, columns, rows, ...(capture !== undefined && byRowid ? { rowids } : {}) });
+                tables.push({ name, ddl: sql, columns, rows, ...objects(name), ...(capture !== undefined && byRowid ? { rowids } : {}) });
                 if (full) {
                     next = encodeDumpCursor({ table: name, after: last ?? 0 });
                     break;
@@ -5677,11 +5721,21 @@ options = {}) {
                 return key.map((c) => ({ column: c.name, collation: c.coll }));
             });
         }
-        /** What a capture's pages read the schema as (#2450): the dumped tables and their explicit indexes. */
+        /**
+         * What a capture's pages read the schema as (#2450): the dumped tables, their explicit indexes and
+         * (#2820) their triggers, which the pages carry as the tables' own objects. The capture's own
+         * triggers are not part of it: they come and go with captures.
+         */
         captureSchema(defs) {
             const names = new Set(defs.map((d) => d.name));
-            const indexes = this.sql.exec(`SELECT tbl_name, name, sql FROM sqlite_master WHERE type = 'index' AND sql IS NOT NULL ORDER BY name`).toArray().filter((i) => names.has(i.tbl_name));
-            return JSON.stringify({ tables: defs, indexes: indexes.map((i) => [i.name, i.sql]) });
+            const objects = this.sql
+                .exec(`SELECT type, tbl_name, name, sql FROM sqlite_master
+              WHERE (type = 'index' OR (type = 'trigger' AND name NOT GLOB '${CAPTURE_GLOB}')) AND sql IS NOT NULL ORDER BY name`)
+                .toArray().filter((o) => names.has(o.tbl_name));
+            const of = (type) => objects.filter((o) => o.type === type).map((o) => [o.name, o.sql]);
+            // Named only when there are some, so a capture opened before triggers were part of it still reads alike.
+            const triggers = of('trigger');
+            return JSON.stringify({ tables: defs, indexes: of('index'), ...(triggers.length ? { triggers } : {}) });
         }
         /**
          * The capture `copyId`, renewed, as its pages read the schema (#2450). Refused when it is gone.
@@ -6076,7 +6130,7 @@ options = {}) {
             });
         }
         async importDump(tables, destScopeId, opts = {}) {
-            return this.loadTables(tables.map((t) => ({ name: t.name, ddl: t.ddl, columns: t.columns, rows: () => t.rows })), destScopeId, opts);
+            return this.loadTables(tables.map((t) => ({ name: t.name, ddl: t.ddl, columns: t.columns, objects: t.objects, rows: () => t.rows })), destScopeId, opts);
         }
         /**
          * The load `importDump` runs, over tables whose rows are read lazily (#2450): from the dump's
@@ -6084,7 +6138,7 @@ options = {}) {
          * in memory at once. `stageId` names the staged load the rows come from: checked inside the
          * load's transaction, and its tables dropped in it once the rows are in.
          */
-        async loadTables(tables, destScopeId, { switchOff, sourceScopeId, exact, loadStamp, expect, resolveKept, markCopy, provisionedFor, fence, roleRepair, onRolesProjected, projection, keepPermissionFlags, } = {}, stageId) {
+        async loadTables(tables, destScopeId, { switchOff, sourceScopeId, exact, loadStamp, expect, resolveKept, markCopy, provisionedFor, fence, roleRepair, onRolesProjected, projection, keepPermissionFlags, onObjects, } = {}, stageId) {
             // The WHOLE drop-then-replay runs under deferred foreign keys, in one transaction.
             //
             // Two distinct FK hazards, and both need the deferral — the second is why it cannot
@@ -6118,7 +6172,8 @@ options = {}) {
             // amount of name checking reaches it. There is no prepare step here to compile
             // only the first statement, so the text itself has to be the one statement.
             // Pure input validation, so it runs before the first DROP: a refused dump touches nothing.
-            assertReplayableDump(replayable, { maxColumns: DO_SQL_LIMITS.columns });
+            const objects = assertReplayableDump(replayable, { maxColumns: DO_SQL_LIMITS.columns });
+            onObjects?.(objects);
             // #1869: `exact` vouches for a named source; without one it would silently fall back.
             if (exact && !sourceScopeId) {
                 throw substratError('validation_failed', 'restore refused: `exact` needs the scope the dump came from');
@@ -6306,6 +6361,10 @@ options = {}) {
                     // derived (#2090). Inside the replay's transaction: a dump whose journal owes a table a
                     // state column it does not carry rolls the whole load back. A plan whose table this dump
                     // did not carry is skipped: a restore must not invent one.
+                    // #2820: a module's own indexes and triggers went with the dropped tables, and its journal
+                    // says the migrations that made them ran. Put back from the dump, after the rows they judge
+                    // and before the kernel derives its own.
+                    replayDumpObjects(objects, (ddl) => this.sql.exec(blankSqlComments(ddl)));
                     repairDerivedObjects(doSpineSql(this.sql), (ddl) => this.runScript(ddl), this.derivedPlans(), {
                         after: 'the restored dump',
                         absentTable: 'skip',
@@ -6405,7 +6464,7 @@ options = {}) {
          * (`changed`, 412) and "this store is a kept copy" (`kept`, 409) from a failure.
          */
         async importDumpChecked(tables, destScopeId, opts) {
-            return this.checkedLoad(() => this.importDump(tables, destScopeId, opts));
+            return this.checkedLoad((onObjects) => this.importDump(tables, destScopeId, { ...opts, onObjects }));
         }
         /**
          * #2531: `importDumpChecked` with the role repair judged and projected in the load's own
@@ -6415,7 +6474,7 @@ options = {}) {
          * rather than loading with the repair silently dropped.
          */
         async importDumpJudged(tables, destScopeId, opts, roleRepair) {
-            return this.judgedLoad((onRolesProjected) => this.checkedLoad(() => this.importDump(tables, destScopeId, { ...opts, roleRepair, onRolesProjected })));
+            return this.judgedLoad((onRolesProjected) => this.checkedLoad((onObjects) => this.importDump(tables, destScopeId, { ...opts, roleRepair, onRolesProjected, onObjects })));
         }
         /**
          * #2555: a control-plane-full restore or import. `importDump`, with this store's permission flags
@@ -6429,15 +6488,16 @@ options = {}) {
         importDumpProjected(tables, destScopeId, opts, projection) {
             return replyOf(async () => {
                 try {
-                    return {
-                        switchedOff: await this.importDump(tables, destScopeId, {
-                            switchOff: opts.switchOff,
-                            sourceScopeId: opts.sourceScopeId,
-                            exact: opts.exact,
-                            keepPermissionFlags: true,
-                            ...(projection ? { projection } : {}),
-                        }),
-                    };
+                    let plan;
+                    const switchedOff = await this.importDump(tables, destScopeId, {
+                        switchOff: opts.switchOff,
+                        sourceScopeId: opts.sourceScopeId,
+                        exact: opts.exact,
+                        keepPermissionFlags: true,
+                        ...(projection ? { projection } : {}),
+                        onObjects: (judged) => (plan = judged),
+                    });
+                    return { switchedOff, ...(plan ? { moduleObjects: dumpObjectsAudit(plan) } : {}) };
                 }
                 catch (e) {
                     if (e instanceof Error && roleRefusals.has(e))
@@ -6508,19 +6568,31 @@ options = {}) {
                     if (seq > head.nextSeq) {
                         throw substratError('precondition_failed', `stage page ${seq} arrived before page ${head.nextSeq}`);
                     }
+                    // A stage opened before objects were staged takes their table now: its earlier pages
+                    // staged none, so a later page that carries them reads as the table having changed.
+                    this.sql.exec(STAGE_OBJECTS_DDL);
                     for (const t of tables) {
                         const columns = JSON.stringify(t.columns);
+                        const objects = t.objects === undefined ? null : JSON.stringify(t.objects);
                         let held = this.sql
-                            .exec(`SELECT ord, ddl, columns FROM _substrat_stage_tables WHERE name = ?`, t.name)
+                            .exec(`SELECT s.ord, s.ddl, s.columns, o.objects FROM _substrat_stage_tables s
+                   LEFT JOIN _substrat_stage_objects o ON o.name = s.name WHERE s.name = ?`, t.name)
                             .toArray()[0];
                         if (!held) {
+                            // #2820: an export carries objects for every module table or for none. A page that
+                            // disagrees with the tables already staged was read across a change of version.
+                            if (!isSpineTable(t.name) && this.stagedModuleObjects().some((has) => has !== (objects !== null))) {
+                                throw substratError('precondition_failed', `table ${t.name} changed between dump pages; nothing more was staged`);
+                            }
                             const ord = Number(this.sql.exec(`SELECT COUNT(*) AS n FROM _substrat_stage_tables`).toArray()[0].n);
                             this.sql.exec(`INSERT INTO _substrat_stage_tables (ord, name, ddl, columns) VALUES (?, ?, ?, ?)`, ord, t.name, t.ddl, columns);
+                            if (objects !== null)
+                                this.sql.exec(`INSERT INTO _substrat_stage_objects (name, objects) VALUES (?, ?)`, t.name, objects);
                             // Untyped columns: no affinity, so a cell is stored exactly as it came.
                             this.sql.exec(`CREATE TABLE "${stageRowsTable(ord)}" (${t.columns.map((_, i) => `c${i}`).join(', ')})`);
-                            held = { ord, ddl: t.ddl, columns };
+                            held = { ord, ddl: t.ddl, columns, objects };
                         }
-                        else if (held.ddl !== t.ddl || held.columns !== columns) {
+                        else if (held.ddl !== t.ddl || held.columns !== columns || held.objects !== objects) {
                             throw substratError('precondition_failed', `table ${t.name} changed between dump pages; nothing more was staged`);
                         }
                         this.stageRows(held.ord, t);
@@ -6614,21 +6686,27 @@ options = {}) {
          */
         async commitStagedDumpChecked(stageId, destScopeId, opts) {
             let count = 0;
-            const out = await this.checkedLoad(() => {
+            const out = await this.checkedLoad((onObjects) => {
                 const head = this.stageHead();
                 if (head?.stageId !== stageId)
                     throw substratError('precondition_failed', STAGE_GONE);
+                // Read only: a stage opened before objects were staged has no table for them, and loads none.
+                const withObjects = this.hasTable('_substrat_stage_objects');
                 const staged = this.sql
-                    .exec(`SELECT ord, name, ddl, columns FROM _substrat_stage_tables ORDER BY name`)
+                    .exec(withObjects
+                    ? `SELECT s.ord, s.name, s.ddl, s.columns, o.objects FROM _substrat_stage_tables s
+                   LEFT JOIN _substrat_stage_objects o ON o.name = s.name ORDER BY s.name`
+                    : `SELECT ord, name, ddl, columns, NULL AS objects FROM _substrat_stage_tables ORDER BY name`)
                     .toArray();
                 const tables = staged.map((t) => ({
                     name: t.name,
                     ddl: t.ddl,
                     columns: JSON.parse(t.columns),
+                    ...(t.objects === null ? {} : { objects: JSON.parse(t.objects) }),
                     rows: () => this.stagedRows(t.ord),
                 }));
                 count = tables.length;
-                return this.loadTables(tables, destScopeId, opts, stageId);
+                return this.loadTables(tables, destScopeId, { ...opts, onObjects }, stageId);
             });
             return out.refused === false ? { ...out, tables: count } : out;
         }
@@ -6664,6 +6742,14 @@ options = {}) {
                 after = Number(batch[batch.length - 1][0]);
             }
         }
+        /** #2820: for each module table staged so far, whether its pages carried its objects. */
+        stagedModuleObjects() {
+            return this.sql
+                .exec(`SELECT s.name, o.name IS NOT NULL AS has FROM _substrat_stage_tables s LEFT JOIN _substrat_stage_objects o ON o.name = s.name`)
+                .toArray()
+                .filter((r) => !isSpineTable(r.name))
+                .map((r) => Boolean(r.has));
+        }
         /** The staged load this store holds (#2450), or null. */
         stageHead() {
             const present = this.sql.exec(`SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '_substrat_stage'`).toArray();
@@ -6683,7 +6769,9 @@ options = {}) {
         /** A load's refusals answered as values (#1722): across the RPC a throw carries only its message. */
         async checkedLoad(run) {
             try {
-                return { refused: false, switchedOff: await run() };
+                let plan;
+                const switchedOff = await run((judged) => (plan = judged));
+                return { refused: false, switchedOff, ...(plan ? { moduleObjects: dumpObjectsAudit(plan) } : {}) };
             }
             catch (e) {
                 if (e instanceof Error && fenceRefusals.has(e))