@substrat-run/adapter-sqlite 0.118.0 → 0.120.0

package/dist/vertical-broker.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The LOCAL peer broker (#1706) — the pure host's stand-in for the platform hop that says which
+ * vertical is calling. DEV AND TEST ONLY, and built so it cannot be anything else:
+ *
+ * - It is an in-process object, not an endpoint. Nothing reaches it over a network; code reaches
+ *   it only by importing it, and it takes the pure host (`SqliteScopeHost`, better-sqlite3) as its
+ *   input — which no Workers bundle can carry.
+ * - It is exported from its own subpath, `@substrat-run/adapter-sqlite/vertical-broker`, whose
+ *   `workerd` / `worker` / `browser` conditions resolve to nothing, so a worker build that imports
+ *   it fails to resolve rather than shipping it.
+ * - `node tools/boundary-lint.mjs` (R9) refuses the import anywhere but a test or a node harness
+ *   (`server.ts`, `seed.ts`, `dev.ts`, `scripts/`), so a `worker.ts` or module code that names it
+ *   is red before it builds.
+ *
+ * **What asserts the caller here.** The harness that wires the broker: it builds one client per
+ * calling scope with `clientFor`, and that client can only ever speak as that scope. In a dev
+ * process the harness IS the whole trust domain — the same stance as `@substrat-run/dev-issuer`'s
+ * `/dev/token`. What the broker keeps identical to production is everything else: the caller must
+ * be a live, primary instance of its vertical in the tenant, the target is resolved by the
+ * kernel's one rule (`resolveVerticalInstance`: same tenant, primary, active, exactly one), and the
+ * call goes through the target's peer door (`getVerticalScope`), whose admission and checks are
+ * the ones a hosted call meets. On the hosted path the router plays this part, from facts the
+ * calling deployment cannot influence.
+ *
+ * **What it deliberately cannot do.** Name a tenant (the target is searched in the caller's own
+ * tenant only), name a principal (there is no parameter for one: a peer acts as itself), or reach
+ * a preview (never resolved as a target, and refused as a caller).
+ */
+import { type PlatformActorId, type ScopeId, type TenantId } from '@substrat-run/contracts';
+import { type InvokeOptions } from '@substrat-run/kernel';
+import type { SqliteScopeHost } from './index.js';
+/** The platform actor the broker reads the directory as — the platform, on the pure host. */
+export declare const LOCAL_BROKER_ACTOR: PlatformActorId;
+/** A calling scope, as the harness that owns it names it. */
+export interface LocalVerticalCallerRef {
+    /** The calling vertical's registry slug — a key of the broker's host map. */
+    vertical: string;
+    tenantId: TenantId;
+    scopeId: ScopeId;
+}
+/** What a calling harness holds: calls out as ONE scope of ONE vertical, and nothing else. */
+export interface LocalVerticalClient {
+    /**
+     * Invoke `operation` on the instance of vertical `target` in the caller's tenant, as the
+     * caller. Throws `forbidden` when the caller is not a live primary instance or the target's
+     * door refuses it, `not_found` when the target is not installed in the tenant, `conflict`
+     * when the tenant runs more than one instance of it.
+     */
+    invoke<O = unknown>(target: string, operation: string, input?: unknown, options?: InvokeOptions): Promise<O>;
+}
+export interface LocalVerticalBroker {
+    /** A client that speaks as `from` — the harness's own scope, and only that. */
+    clientFor(from: LocalVerticalCallerRef): LocalVerticalClient;
+}
+/**
+ * Stand two (or more) verticals side by side on the pure host, each on its own `SqliteScopeHost`
+ * — one vertical's code per host, as one script per vertical in production — keyed by registry
+ * slug. Each host holds its own directory, so the tenant a test or dev harness provisions must be
+ * created on every host that serves one of its instances.
+ */
+export declare function createLocalVerticalBroker(hosts: Readonly<Record<string, SqliteScopeHost>>): LocalVerticalBroker;
+//# sourceMappingURL=vertical-broker.d.ts.map

package/dist/vertical-broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vertical-broker.d.ts","sourceRoot":"","sources":["../src/vertical-broker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,6FAA6F;AAC7F,eAAO,MAAM,kBAAkB,EAAE,eAAqE,CAAC;AAEvG,6DAA6D;AAC7D,MAAM,WAAW,sBAAsB;IACrC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,8FAA8F;AAC9F,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9G;AAED,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,SAAS,CAAC,IAAI,EAAE,sBAAsB,GAAG,mBAAmB,CAAC;CAC9D;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,GAAG,mBAAmB,CA8D/G"}

package/dist/vertical-broker.js

@@ -0,0 +1,87 @@
+/**
+ * The LOCAL peer broker (#1706) — the pure host's stand-in for the platform hop that says which
+ * vertical is calling. DEV AND TEST ONLY, and built so it cannot be anything else:
+ *
+ * - It is an in-process object, not an endpoint. Nothing reaches it over a network; code reaches
+ *   it only by importing it, and it takes the pure host (`SqliteScopeHost`, better-sqlite3) as its
+ *   input — which no Workers bundle can carry.
+ * - It is exported from its own subpath, `@substrat-run/adapter-sqlite/vertical-broker`, whose
+ *   `workerd` / `worker` / `browser` conditions resolve to nothing, so a worker build that imports
+ *   it fails to resolve rather than shipping it.
+ * - `node tools/boundary-lint.mjs` (R9) refuses the import anywhere but a test or a node harness
+ *   (`server.ts`, `seed.ts`, `dev.ts`, `scripts/`), so a `worker.ts` or module code that names it
+ *   is red before it builds.
+ *
+ * **What asserts the caller here.** The harness that wires the broker: it builds one client per
+ * calling scope with `clientFor`, and that client can only ever speak as that scope. In a dev
+ * process the harness IS the whole trust domain — the same stance as `@substrat-run/dev-issuer`'s
+ * `/dev/token`. What the broker keeps identical to production is everything else: the caller must
+ * be a live, primary instance of its vertical in the tenant, the target is resolved by the
+ * kernel's one rule (`resolveVerticalInstance`: same tenant, primary, active, exactly one), and the
+ * call goes through the target's peer door (`getVerticalScope`), whose admission and checks are
+ * the ones a hosted call meets. On the hosted path the router plays this part, from facts the
+ * calling deployment cannot influence.
+ *
+ * **What it deliberately cannot do.** Name a tenant (the target is searched in the caller's own
+ * tenant only), name a principal (there is no parameter for one: a peer acts as itself), or reach
+ * a preview (never resolved as a target, and refused as a caller).
+ */
+import { platformActorId, scopeId as scopeIdOf, substratError, tenantId as tenantIdOf, verticalSlug, } from '@substrat-run/contracts';
+import { isPrimaryScope } from '@substrat-run/kernel';
+/** The platform actor the broker reads the directory as — the platform, on the pure host. */
+export const LOCAL_BROKER_ACTOR = platformActorId.parse('01JZ00000000000000PEERBRKR');
+/**
+ * Stand two (or more) verticals side by side on the pure host, each on its own `SqliteScopeHost`
+ * — one vertical's code per host, as one script per vertical in production — keyed by registry
+ * slug. Each host holds its own directory, so the tenant a test or dev harness provisions must be
+ * created on every host that serves one of its instances.
+ */
+export function createLocalVerticalBroker(hosts) {
+    const hostOf = (vertical) => Object.prototype.hasOwnProperty.call(hosts, vertical) ? hosts[vertical] : undefined;
+    return {
+        clientFor(from) {
+            const caller = {
+                vertical: verticalSlug.parse(from.vertical),
+                tenantId: tenantIdOf.parse(from.tenantId),
+                scopeId: scopeIdOf.parse(from.scopeId),
+            };
+            return {
+                async invoke(target, operation, input, options) {
+                    // 1. The caller, re-read from ITS host's directory on every call: a live, primary
+                    //    instance of the vertical it says it is, in the tenant it says. Suspended,
+                    //    archived, forked, preview — all refused here, before any target is looked up.
+                    //    This is the router's per-call gate; nothing downstream re-checks it.
+                    const callerHost = hostOf(caller.vertical);
+                    const record = await callerHost?.admin.getScopeRecord(LOCAL_BROKER_ACTOR, caller.tenantId, caller.scopeId);
+                    if (!record || record.vertical !== caller.vertical) {
+                        throw substratError('forbidden', `scope ${caller.scopeId} is not an instance of '${caller.vertical}' in this tenant — a peer ` +
+                            'call is made by a live instance of the calling vertical');
+                    }
+                    const tenant = await callerHost.admin.getTenant(LOCAL_BROKER_ACTOR, caller.tenantId);
+                    if (tenant?.status !== 'active' || record.status !== 'active' || !isPrimaryScope(record)) {
+                        throw substratError('forbidden', `scope ${caller.scopeId} of '${caller.vertical}' may not call other verticals: it is ` +
+                            (tenant?.status !== 'active' ? `in a ${tenant?.status ?? 'missing'} tenant` : record.status !== 'active' ? `${record.status}` : 'a preview or a fork') +
+                            ' — only a live primary instance acts as its vertical');
+                    }
+                    // 2. The target, by slug, in the CALLER's tenant only — the kernel's one rule.
+                    const target_ = verticalSlug.parse(target);
+                    const targetHost = hostOf(target_);
+                    const resolution = targetHost
+                        ? await targetHost.admin.resolveVerticalInstance(caller.tenantId, target_)
+                        : { outcome: 'not-installed', tenantId: caller.tenantId, vertical: target_ };
+                    if (resolution.outcome === 'not-installed') {
+                        throw substratError('not_found', `vertical '${target_}' is not installed in this tenant`);
+                    }
+                    if (resolution.outcome === 'ambiguous') {
+                        throw substratError('conflict', `this tenant runs ${resolution.count} instances of '${target_}' — a call cannot pick one; ` +
+                            'bind the instance first');
+                    }
+                    // 3. The target's peer door, as the caller — admission and every check happen there.
+                    const stub = await targetHost.getVerticalScope({ vertical: caller.vertical, scope: caller.scopeId }, resolution.instance.tenantId, resolution.instance.scopeId);
+                    return stub.invoke(operation, input, options);
+                },
+            };
+        },
+    };
+}
+//# sourceMappingURL=vertical-broker.js.map

package/dist/vertical-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vertical-broker.js","sourceRoot":"","sources":["../src/vertical-broker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EACL,eAAe,EACf,OAAO,IAAI,SAAS,EACpB,aAAa,EACb,QAAQ,IAAI,UAAU,EACtB,YAAY,GAIb,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAsB,MAAM,sBAAsB,CAAC;AAG1E,6FAA6F;AAC7F,MAAM,CAAC,MAAM,kBAAkB,GAAoB,eAAe,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;AA0BvG;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAgD;IACxF,MAAM,MAAM,GAAG,CAAC,QAAgB,EAA+B,EAAE,CAC/D,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtF,OAAO;QACL,SAAS,CAAC,IAAI;YACZ,MAAM,MAAM,GAAG;gBACb,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC3C,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACzC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;aACvC,CAAC;YACF,OAAO;gBACL,KAAK,CAAC,MAAM,CAAI,MAAc,EAAE,SAAiB,EAAE,KAAe,EAAE,OAAuB;oBACzF,kFAAkF;oBAClF,+EAA+E;oBAC/E,mFAAmF;oBACnF,0EAA0E;oBAC1E,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;oBAC3C,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,KAAK,CAAC,cAAc,CAAC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;oBAC3G,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;wBACnD,MAAM,aAAa,CACjB,WAAW,EACX,SAAS,MAAM,CAAC,OAAO,2BAA2B,MAAM,CAAC,QAAQ,4BAA4B;4BAC3F,yDAAyD,CAC5D,CAAC;oBACJ,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,UAAW,CAAC,KAAK,CAAC,SAAS,CAAC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;oBACtF,IAAI,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;wBACzF,MAAM,aAAa,CACjB,WAAW,EACX,SAAS,MAAM,CAAC,OAAO,QAAQ,MAAM,CAAC,QAAQ,wCAAwC;4BACpF,CAAC,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,MAAM,IAAI,SAAS,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC;4BACtJ,sDAAsD,CACzD,CAAC;oBACJ,CAAC;oBACD,+EAA+E;oBAC/E,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;oBACnC,MAAM,UAAU,GAAG,UAAU;wBAC3B,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;wBAC1E,CAAC,CAAE,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAY,CAAC;oBAC1F,IAAI,UAAU,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;wBAC3C,MAAM,aAAa,CAAC,WAAW,EAAE,aAAa,OAAO,mCAAmC,CAAC,CAAC;oBAC5F,CAAC;oBACD,IAAI,UAAU,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;wBACvC,MAAM,aAAa,CACjB,UAAU,EACV,oBAAoB,UAAU,CAAC,KAAK,kBAAkB,OAAO,8BAA8B;4BACzF,yBAAyB,CAC5B,CAAC;oBACJ,CAAC;oBACD,qFAAqF;oBACrF,MAAM,IAAI,GAAG,MAAM,UAAW,CAAC,gBAAgB,CAC7C,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EACpD,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAC5B,UAAU,CAAC,QAAQ,CAAC,OAAO,CAC5B,CAAC;oBACF,OAAO,IAAI,CAAC,MAAM,CAAa,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC5D,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/adapter-sqlite",
-  "version": "0.118.0",
+  "version": "0.120.0",
   "description": "Pure-SQLite scope host — real kernel semantics with no Cloudflare dependency (D-14): local dev, CI, self-host/escrow",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -16,6 +16,13 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./vertical-broker": {
+      "workerd": null,
+      "worker": null,
+      "browser": null,
+      "types": "./dist/vertical-broker.d.ts",
+      "default": "./dist/vertical-broker.js"
     }
   },
   "files": [
@@ -23,14 +30,14 @@
   ],
   "dependencies": {
     "better-sqlite3": "^13.0.3",
-    "@substrat-run/contracts": "^0.118.0",
-    "@substrat-run/kernel": "^0.118.0"
+    "@substrat-run/contracts": "^0.120.0",
+    "@substrat-run/kernel": "^0.120.0"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^9.6.0",
     "typescript": "^7.0.0",
     "vitest": "^3.2.7",
-    "@substrat-run/contract-tests": "^0.118.0"
+    "@substrat-run/contract-tests": "^0.120.0"
   },
   "publishConfig": {
     "access": "public"