@substrat-run/kernel 0.148.0 → 0.149.0

package/dist/migration-digest.js

@@ -202,6 +202,98 @@ export async function planMigrations(modules, applied) {
     }
     return { pending };
 }
+/**
+ * The platform binding that carries the migration set digest of the version a script serves
+ * (#2349). The uploader injects it beside `SUBSTRAT_VERSION_ID`, and only for a version whose
+ * migrations the control plane stores: an unheld version gets no binding.
+ */
+export const MIGRATIONS_DIGEST_BINDING = 'SUBSTRAT_MIGRATIONS_DIGEST';
+/** How many times this isolate computed a set digest. Read by tests through `@substrat-run/kernel/testing`. */
+let setDigestComputations = 0;
+export const migrationSetDigestComputations = () => setDigestComputations;
+/** How many registered migrations a set divergence names before it says how many more there are. */
+const DIVERGENCE_LISTED = 20;
+/**
+ * Whether a migration version is one the kernel derives from a declaration (`search/…`,
+ * `state/…`, `list/…`, see `moduleMigrations`) rather than one a module authored. Every derived
+ * generator names its versions under one of these prefixes, which `migration-set-digest.test.ts`
+ * holds against `moduleMigrations` for a module declaring all three.
+ */
+export function isDerivedMigrationVersion(version) {
+    return /^(search|state|list)\//.test(version);
+}
+async function setDigestOf(entries) {
+    setDigestComputations++;
+    // Modules by id, each module's migrations in the order it applies them: the order the CLI
+    // stores modules in is the permission entry's, and the order a host registers them is its
+    // own, so only the order inside a module is part of the set.
+    const sorted = entries
+        .map((e, i) => ({ e, i }))
+        .sort((a, b) => (a.e.moduleId < b.e.moduleId ? -1 : a.e.moduleId > b.e.moduleId ? 1 : a.i - b.i))
+        .map(({ e }) => [e.moduleId, e.version, e.sqlDigest]);
+    return migrationDigest(JSON.stringify(sorted));
+}
+/**
+ * The digest of a set of AUTHORED migrations (#2349): SHA-256 over each migration's module,
+ * version and the SHA-256 of its exact SQL, modules ordered by id. Only the SQL is covered, not
+ * what a migration declares it may lose, nor the store classes. The control plane computes it
+ * from a version's stored migrations at upload; a scope host computes it from its registered
+ * steps (`migrationSetDivergence`).
+ *
+ * Kernel-derived migrations are left out on both sides. Their SQL is the kernel's spelling of a
+ * declaration (#2066 holds an applied one to its version, not its digest), and whether a stored
+ * set carries them at all depends on the CLI that pushed it (one that could not resolve the
+ * vertical's kernel stores the authored set alone). Both sides decide by version name
+ * (`isDerivedMigrationVersion`), since a stored set is only names and SQL, so a stored set from
+ * any CLI compares as its authored part. The cost: an AUTHORED migration versioned under one of
+ * those prefixes is left out on both sides too, and never compared here. That cannot refuse a
+ * correct deployment; the journal still records its digest, and #2066 holds it once applied.
+ *
+ * Not through `cachedDigest`: the control plane hashes every version it serves, and that cache
+ * would keep each one's SQL for the life of the isolate.
+ */
+export async function migrationSetDigest(migrations) {
+    return setDigestOf(await Promise.all(migrations
+        .filter((m) => !isDerivedMigrationVersion(m.version))
+        .map(async (m) => ({ moduleId: m.moduleId, version: m.version, sqlDigest: await migrationDigest(m.sql) }))));
+}
+/**
+ * An integrity check at apply time (#2349): why a scope host must not apply its pending
+ * migrations, or null when it may. `stored` is the set digest the uploader injected for the
+ * version this script serves (`MIGRATIONS_DIGEST_BINDING`); the registered side is every
+ * AUTHORED step the host's modules register. A kernel-derived step is never compared, so a
+ * difference in derived steps alone cannot refuse (see `migrationSetDigest`).
+ *
+ * Called only when a pass has migrations pending, so a scope with nothing to apply never
+ * computes it. Without a stored digest (a version whose migrations the control plane does not
+ * hold, a script uploaded before the binding, local dev) nothing is compared.
+ *
+ * This runs inside the deployed adapter, so it guards against accidental divergence — a build
+ * whose worker registers other migrations than the push declared — not as an isolation boundary.
+ */
+export async function migrationSetDivergence(modules, stored) {
+    if (!stored)
+        return null;
+    const entries = [];
+    for (const mod of modules) {
+        for (const step of await mod.steps) {
+            if (!step.authored || isDerivedMigrationVersion(step.migration.version))
+                continue;
+            entries.push({ moduleId: mod.id, version: step.migration.version, sqlDigest: step.digest });
+        }
+    }
+    const registered = await setDigestOf(entries);
+    if (registered === stored)
+        return null;
+    const keys = entries.map((e) => `${e.moduleId}@${e.version}`);
+    const listed = keys.length === 0
+        ? 'none'
+        : keys.slice(0, DIVERGENCE_LISTED).join(', ') +
+            (keys.length > DIVERGENCE_LISTED ? ` and ${keys.length - DIVERGENCE_LISTED} more` : '');
+    return (`the authored migrations this deployment registers are not the ones stored for the version it serves ` +
+        `(registered set sha256 ${registered}, stored ${stored}); registered: ${listed}. Nothing was applied. ` +
+        `Push the version again from the build that is deployed, so the stored migrations are the ones it runs (#2349)`);
+}
 /** The error a scope fails closed with when `module@version` cannot be applied or trusted. */
 export function migrationFailedError(key, cause) {
     return new Error(`migration failed for ${key} — scope fails closed: ${cause}`);

package/dist/migration-digest.js.map

@@ -1 +1 @@
-{"version":3,"file":"migration-digest.js","sourceRoot":"","sources":["../src/migration-digest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAqB,MAAM,iBAAiB,CAAC;AAKtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,gFAAgF,CAAC;AAE7H;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;;;;;;;;;CAWzC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,GAAW,EAAE,IAAY;IACnD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;YAAE,SAAS;QAC1G,MAAM,aAAa,CACjB,WAAW,EACX,GAAG,IAAI,wCAAwC,KAAK,CAAC,IAAI,+DAA+D,EACxH,EAAE,MAAM,EAAE,aAAa,EAAE,CAC1B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IAC7D,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;CACnG,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,IAAwD;IACtG,MAAM,IAAI,GAAG,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAAE,OAAO;IAC1F,IAAI,CAAC;QACH,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,aAAa,CAAC,WAAW,EAAE,GAAG,IAAI,qCAAsC,GAAa,CAAC,OAAO,CAAC,OAAO,CAAC,6CAA6C,EAAE,EAAE,CAAC,EAAE,EAAE;YAChK,MAAM,EAAE,aAAa;SACtB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAA4E;IACpH,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,sBAAsB;YAAE,SAAS;QAC9D,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,CAAC;QACxE,IAAI,QAAQ,KAAK,OAAO;YAAE,SAAS;QACnC,MAAM,aAAa,CACjB,mBAAmB,EACnB,oDAAoD,QAAQ,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC,CAAC,oDAAoD,KAAK;YACpL,iHAAiH,CACpH,CAAC;IACJ,CAAC;AACH,CAAC;AAUD;;;;GAIG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;AACpD,MAAM,YAAY,GAAG,CAAC,GAAW,EAAmB,EAAE;IACpD,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,YAAoD;IACjF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,OAAO,OAAO,CAAC,GAAG,CAChB,gBAAgB,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACvD,SAAS;QACT,MAAM,EAAE,MAAM,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC;QACzC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;KAC1C,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAYD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA6F,EAC7F,OAA2C;IAE3C,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAClD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChF,IAAI,KAAK;gBAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,KAAa;IAC7D,OAAO,IAAI,KAAK,CAAC,wBAAwB,GAAG,0BAA0B,KAAK,EAAE,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAmC,EACnC,UAAkB,EAClB,QAAiB;IAEjB,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,uBAAuB;QAAE,OAAO,IAAI,CAAC;IACxH,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,wFAAwF;QACxF,0DAA0D;QAC1D,OAAO,CACL,yFAAyF;YACzF,6CAA6C,UAAU,sCAAsC;YAC7F,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,CACL,uEAAuE,QAAQ,IAAI;QACnF,qBAAqB,UAAU,6DAA6D;QAC5F,qGAAqG,CACtG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"migration-digest.js","sourceRoot":"","sources":["../src/migration-digest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAqB,MAAM,iBAAiB,CAAC;AAKtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,gFAAgF,CAAC;AAE7H;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;;;;;;;;;CAWzC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,GAAW,EAAE,IAAY;IACnD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;YAAE,SAAS;QAC1G,MAAM,aAAa,CACjB,WAAW,EACX,GAAG,IAAI,wCAAwC,KAAK,CAAC,IAAI,+DAA+D,EACxH,EAAE,MAAM,EAAE,aAAa,EAAE,CAC1B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IAC7D,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;CACnG,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,IAAwD;IACtG,MAAM,IAAI,GAAG,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAAE,OAAO;IAC1F,IAAI,CAAC;QACH,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,aAAa,CAAC,WAAW,EAAE,GAAG,IAAI,qCAAsC,GAAa,CAAC,OAAO,CAAC,OAAO,CAAC,6CAA6C,EAAE,EAAE,CAAC,EAAE,EAAE;YAChK,MAAM,EAAE,aAAa;SACtB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAA4E;IACpH,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,sBAAsB;YAAE,SAAS;QAC9D,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,CAAC;QACxE,IAAI,QAAQ,KAAK,OAAO;YAAE,SAAS;QACnC,MAAM,aAAa,CACjB,mBAAmB,EACnB,oDAAoD,QAAQ,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC,CAAC,oDAAoD,KAAK;YACpL,iHAAiH,CACpH,CAAC;IACJ,CAAC;AACH,CAAC;AAUD;;;;GAIG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;AACpD,MAAM,YAAY,GAAG,CAAC,GAAW,EAAmB,EAAE;IACpD,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,YAAoD;IACjF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,OAAO,OAAO,CAAC,GAAG,CAChB,gBAAgB,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACvD,SAAS;QACT,MAAM,EAAE,MAAM,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC;QACzC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;KAC1C,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAYD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA6F,EAC7F,OAA2C;IAE3C,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAClD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChF,IAAI,KAAK;gBAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,4BAA4B,CAAC;AAEtE,+GAA+G;AAC/G,IAAI,qBAAqB,GAAG,CAAC,CAAC;AAC9B,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAW,EAAE,CAAC,qBAAqB,CAAC;AAElF,oGAAoG;AACpG,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAmE;IAC5F,qBAAqB,EAAE,CAAC;IACxB,0FAA0F;IAC1F,0FAA0F;IAC1F,6DAA6D;IAC7D,MAAM,MAAM,GAAG,OAAO;SACnB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;SACzB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAChG,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACxD,OAAO,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAyE;IAEzE,OAAO,WAAW,CAChB,MAAM,OAAO,CAAC,GAAG,CACf,UAAU;SACP,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;SACpD,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAC7G,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA6F,EAC7F,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,OAAO,GAA+D,EAAE,CAAC;IAC/E,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAAE,SAAS;YAClF,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9D,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,KAAK,CAAC;QACf,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3C,CAAC,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,MAAM,GAAG,iBAAiB,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9F,OAAO,CACL,sGAAsG;QACtG,0BAA0B,UAAU,YAAY,MAAM,kBAAkB,MAAM,yBAAyB;QACvG,+GAA+G,CAChH,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,KAAa;IAC7D,OAAO,IAAI,KAAK,CAAC,wBAAwB,GAAG,0BAA0B,KAAK,EAAE,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAmC,EACnC,UAAkB,EAClB,QAAiB;IAEjB,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,uBAAuB;QAAE,OAAO,IAAI,CAAC;IACxH,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,wFAAwF;QACxF,0DAA0D;QAC1D,OAAO,CACL,yFAAyF;YACzF,6CAA6C,UAAU,sCAAsC;YAC7F,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,CACL,uEAAuE,QAAQ,IAAI;QACnF,qBAAqB,UAAU,6DAA6D;QAC5F,qGAAqG,CACtG,CAAC;AACJ,CAAC"}

package/dist/migration-fence.d.ts

@@ -0,0 +1,14 @@
+import type { ScopedSql, SqlMigration } from './scope-host.js';
+/**
+ * The tables the fence measures, as SQLite names them: the scope's own, without the spine,
+ * SQLite's and workerd's internals, virtual tables (an index over data held elsewhere, or a
+ * module's own store the fence cannot count without its content table) and their shadow tables.
+ * Exported so a replay outside a host (`lint:migration-fence`) populates exactly what is measured.
+ */
+export declare function fencedTables(sql: ScopedSql): string[];
+/**
+ * Wrap one authored migration's execution in the fence. `run` executes every statement of it; it
+ * runs inside the caller's transaction, so a throw from here rolls all of it back.
+ */
+export declare function fenceMigration(sql: ScopedSql, migration: SqlMigration, key: string, run: () => void): void;
+//# sourceMappingURL=migration-fence.d.ts.map

package/dist/migration-fence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-fence.d.ts","sourceRoot":"","sources":["../src/migration-fence.ts"],"names":[],"mappings":"AAoEA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AA4E/D;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,EAAE,CAerD;AA8TD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,IAAI,GAAG,IAAI,CA4E1G"}

package/dist/migration-fence.js

@@ -0,0 +1,515 @@
+/**
+ * The data-loss fence: an authored migration may not lose data a scope holds unless it says so (#115).
+ *
+ * The planner (`@substrat-run/model-emit`) refuses every destructive diff when it writes a
+ * migration, but nothing judged what an AUTHORED migration does to the rows already there: a
+ * hand-written `DROP TABLE`, a `DROP COLUMN`, a `DELETE`, or a create-copy-rename rebuild that
+ * forgot a column ran unchecked against a scope full of data. This is the check, and it reads
+ * what the SQL DID rather than what its text says, so there is no SQL grammar to get wrong.
+ *
+ * **Measured, not parsed.** Parsing decides only whether to measure: a migration made only of
+ * provably additive statements (`CREATE …`, `ALTER TABLE … ADD …`) cannot lose anything and is not
+ * measured. Any other statement (any DML, `DROP`, `ALTER … RENAME`/`DROP COLUMN`, `PRAGMA`, `WITH`,
+ * a shape nobody listed) measures EVERY module table, not just the ones it names, so a trigger or a
+ * foreign-key cascade that reaches another table is seen too. Measured, per table: the rows, and
+ * per column the values in each storage class (`typeof`). Once before the first statement and
+ * once after the last, inside the migration's transaction, so the intermediate states of a rebuild
+ * do not matter and a refusal rolls the whole migration back. Every measuring query stays inside a
+ * Durable Object's own limits (`DO_SQL_LIMITS`), or the fence would close a scope for a reason of
+ * its own.
+ *
+ * **Production data is rows that exist.** A table with no rows may be dropped or rebuilt freely,
+ * whatever else is true of the scope; the same migration is refused in a scope where it would
+ * lose something. There is no phase flag to forget to flip.
+ *
+ * **What counts as a loss**, for a table that held rows: it is gone (under the name `ALTER TABLE …
+ * RENAME TO` last gave it, or under its original name, so a rebuild back into place keeps it —
+ * each table after the migration is claimed by one table before it, a rename first, and a `DROP
+ * TABLE` releases the name it removed); it has fewer
+ * rows; one of its columns that held values is gone (`RENAME COLUMN` is followed) or holds fewer
+ * of them in some storage class — which is how a retype shows, `'1.50'` turning into `1`. Counts
+ * cannot tell a faithful widening (`5` → `5.0`) from a rewrite (`5` → `0.05`), so any change of
+ * storage class is reported, and one made on purpose is declared with `discards`. `NOT NULL`
+ * without a default needs no rule: SQLite refuses it itself.
+ *
+ * **What it does not see**, because it counts — the residual classes, each named in the property
+ * test (`migration-fence.property.test.ts`) that holds the rest to ground truth:
+ * - in-place replacement: values rewritten at the same count and class (`UPDATE`), rows replaced
+ *   by as many other rows (`DELETE` + `INSERT`), or a column dropped, re-added and refilled;
+ * - a dropped table whose name is continued by a table the migration created, filled from
+ *   somewhere else, holding at least as many rows, even renamed away again (`DROP TABLE a; CREATE
+ *   TABLE a AS SELECT * FROM b`, or `…; CREATE TABLE n AS SELECT * FROM b; ALTER TABLE n RENAME TO
+ *   a; ALTER TABLE a RENAME TO d`): counts cannot tell it from the create-copy-drop-rename
+ *   rebuild, or a rename after it, which the fence must accept;
+ * - which source a move's target gained from: a target is credited with everything it gained.
+ * And one refusal by design: data copied under another table's name is refused until `moves`
+ * declares it.
+ *
+ * **Declared losses pass.** `SqlMigration.moves` names data that went elsewhere, and is verified:
+ * the target must GAIN at least what its sources held, per class — and for a table moved whole,
+ * every source column that held values must arrive in a target column of the same name, unless
+ * that column is moved or discarded by name itself. `SqlMigration.discards` names data
+ * deliberately given up, with the reason a reviewer reads. A declaration naming a table or column
+ * the scope does not hold before the migration (a move's target excepted, which the migration may
+ * create) is an authoring error and refuses the migration too.
+ *
+ * **TEMP objects are refused.** A Durable Object refuses them outright, so a migration making one
+ * could never run on the hosted adapter, and a TEMP table shadows the scope's own tables for every
+ * unqualified statement after it. An authored migration that makes one is refused before it runs,
+ * on both adapters, and every measuring read names `main` so nothing else can answer for a table.
+ *
+ * **ATTACH and DETACH are refused** for the same first reason (#2321): a Durable Object refuses
+ * them, so the migration could never run hosted. And an attached database is a FILE, which the
+ * fence does not measure and a replay outside a host (`substrat push`) would otherwise create on
+ * the machine running it. Refused before anything runs, on both adapters.
+ *
+ * Kernel-derived DDL is exempt: its tables are indexes, rebuilt from the data this protects.
+ */
+import { blankReason, namesSpineTable, substratError, tokenizeSql } from '@substrat-run/contracts';
+import { DO_SQL_LIMITS } from './sql-limits.js';
+import { executableSqlStatements } from './sql-statements.js';
+/** The storage classes a value can have; NULL is not a value. */
+const CLASSES = ['integer', 'real', 'text', 'blob'];
+/**
+ * Columns measured per query: each one is a result column per storage class, and a Durable
+ * Object refuses a result set wider than `DO_SQL_LIMITS.columns`.
+ */
+const COLUMNS_PER_SCAN = Math.floor(DO_SQL_LIMITS.columns / CLASSES.length);
+/** SQLite folds ASCII letters only: `"ä"` and `"Ä"` are two tables, and must stay two keys. */
+const lower = (s) => s.replace(/[A-Z]+/g, (m) => m.toLowerCase());
+const quote = (name) => `"${name.replace(/"/g, '""')}"`;
+const total = (c) => CLASSES.reduce((n, k) => n + c[k], 0);
+const NONE = { integer: 0, real: 0, text: 0, blob: 0 };
+/** The words of one statement, keywords lowercased; quoted names are kept apart from keywords. */
+function words(statement) {
+    return tokenizeSql(statement).map((t) => ({ text: t.quoted ? t.text : lower(t.text), quoted: t.quoted, parts: t.parts }));
+}
+/**
+ * The schema a name token names, and the name in it, as SQLite reads them: `main.n` and
+ * `"main"."n"` are `main` and `n`; `"main.n"` is ONE identifier, a name with a dot in it and no
+ * schema. The one reading of a qualifier, for the `temp` check and for following `main` names.
+ */
+function schemaAndName(w) {
+    const parts = w.parts ?? [w.text];
+    return parts.length === 2 ? { schema: lower(parts[0]), name: parts[1] } : { name: parts.join('.') };
+}
+/** A table name as the main schema holds it, or a name no main table has if another schema is named. */
+function mainName(w) {
+    const { schema, name } = schemaAndName(w);
+    return schema === undefined || schema === 'main' ? lower(name) : `\u0000${schema}.${lower(name)}`;
+}
+/** A statement that can only define something: it fires nothing and removes nothing. */
+function additive(statement) {
+    const w = words(statement);
+    const kw = (i) => (w[i] && !w[i].quoted ? w[i].text : undefined);
+    if (kw(0) === 'create')
+        return true;
+    // `ALTER TABLE <name> ADD [COLUMN] …` — the name is one token, dotted or not.
+    return kw(0) === 'alter' && kw(1) === 'table' && kw(3) === 'add';
+}
+/**
+ * The tables a virtual-table module keeps behind each virtual table, by suffix. Only these exact
+ * names are left out: a real table that merely starts with a virtual table's name is measured. A
+ * module not listed here has its shadow tables measured too, which can refuse a migration that
+ * only reshaped an index — the conservative answer.
+ */
+const SHADOW_SUFFIXES = {
+    fts5: ['data', 'idx', 'content', 'docsize', 'config'],
+    fts4: ['content', 'segments', 'segdir', 'docsize', 'stat'],
+    fts3: ['content', 'segments', 'segdir', 'docsize', 'stat'],
+    rtree: ['node', 'parent', 'rowid'],
+};
+/**
+ * The tables the fence measures, as SQLite names them: the scope's own, without the spine,
+ * SQLite's and workerd's internals, virtual tables (an index over data held elsewhere, or a
+ * module's own store the fence cannot count without its content table) and their shadow tables.
+ * Exported so a replay outside a host (`lint:migration-fence`) populates exactly what is measured.
+ */
+export function fencedTables(sql) {
+    const rows = sql.query("SELECT name, sql FROM main.sqlite_master WHERE type = 'table'");
+    const own = rows.filter((r) => {
+        const n = lower(r.name);
+        return !namesSpineTable(n) && !n.startsWith('sqlite_') && !n.startsWith('_cf_');
+    });
+    const skip = new Set();
+    for (const r of own) {
+        const m = /^\s*create\s+virtual\s+table\s+.*?\busing\s+(\w+)/is.exec(r.sql ?? '');
+        if (!m)
+            continue;
+        const name = lower(r.name);
+        skip.add(name);
+        for (const suffix of SHADOW_SUFFIXES[lower(m[1])] ?? [])
+            skip.add(`${name}_${suffix}`);
+    }
+    return own.map((r) => r.name).filter((name) => !skip.has(lower(name)));
+}
+function measure(sql) {
+    const out = new Map();
+    for (const table of fencedTables(sql)) {
+        // Qualified: a TEMP object of the same name would otherwise answer for the scope's table.
+        const names = sql.query("SELECT name FROM pragma_table_info(?, 'main')", [table]).map((c) => c.name);
+        const rows = Number(sql.query(`SELECT COUNT(*) AS n FROM main.${quote(table)}`)[0].n);
+        const columns = new Map();
+        for (let at = 0; at < names.length && rows > 0; at += COLUMNS_PER_SCAN) {
+            const chunk = names.slice(at, at + COLUMNS_PER_SCAN);
+            const select = chunk.flatMap((c, i) => CLASSES.map((k) => `COALESCE(SUM(typeof(${quote(c)}) = '${k}'), 0) AS c${i}_${k}`));
+            const r = sql.query(`SELECT ${select.join(', ')} FROM main.${quote(table)}`)[0];
+            chunk.forEach((c, i) => {
+                columns.set(lower(c), Object.fromEntries(CLASSES.map((k) => [k, Number(r[`c${i}_${k}`])])));
+            });
+        }
+        if (rows === 0)
+            for (const c of names)
+                columns.set(lower(c), NONE);
+        out.set(lower(table), { rows, columns });
+    }
+    return out;
+}
+function targetOf(spec) {
+    const parts = spec.trim().split('.');
+    if (parts.length > 2 || parts.some((p) => p === ''))
+        return undefined;
+    return parts.length === 1 ? { table: lower(parts[0]) } : { table: lower(parts[0]), column: lower(parts[1]) };
+}
+const show = (t) => (t.column ? `${t.table}.${t.column}` : t.table);
+/** What a column a `DROP COLUMN` removed maps to: a name no column after the migration has. */
+const DROPPED = '\u0000dropped';
+/**
+ * Statement by statement, which original table holds each name right now. A name is held by at
+ * most one table — SQLite refuses a rename onto a name that exists — so a `DROP TABLE` releases it
+ * and a later rename onto it is that table's alone, whatever order the scope created them in.
+ *
+ * A table this migration made, renamed onto a dropped table's ORIGINAL name, continues the dropped
+ * one: that is the create-copy-drop-rename rebuild, which the counts then judge, and its later
+ * renames, of the table or its columns, are followed. A bare `CREATE TABLE` at that name is not a
+ * continuation: renames after it are not followed, which can only refuse.
+ */
+function followRenames(statements, before) {
+    const tables = new Map([...before.keys()].map((t) => [t, [t]]));
+    const columns = new Map([...before].map(([t, c]) => [t, new Map([...c.columns.keys()].map((k) => [k, k]))]));
+    const holder = new Map([...before.keys()].map((t) => [t, t]));
+    const dropped = new Set();
+    const rebuilt = new Set();
+    const rebuiltAt = (name) => {
+        if (!dropped.has(name) || holder.has(name))
+            return;
+        dropped.delete(name);
+        rebuilt.add(name);
+        holder.set(name, name);
+        tables.get(name).push(name);
+    };
+    for (const statement of statements) {
+        const w = words(statement);
+        const kw = (i) => (w[i] && !w[i].quoted ? w[i].text : undefined);
+        if (kw(0) === 'drop' && kw(1) === 'table') {
+            const at = kw(2) === 'if' && kw(3) === 'exists' ? 4 : 2;
+            if (!w[at])
+                continue;
+            const name = mainName(w[at]);
+            const original = holder.get(name);
+            if (original === undefined)
+                continue;
+            holder.delete(name);
+            dropped.add(original);
+            continue;
+        }
+        if (kw(0) !== 'alter' || kw(1) !== 'table' || !w[2])
+            continue;
+        const table = mainName(w[2]);
+        const original = holder.get(table);
+        if (!original) {
+            // A table this migration made, renamed onto a dropped table's original name: the rebuild.
+            if (kw(3) === 'rename' && kw(4) === 'to' && w[5])
+                rebuiltAt(mainName(w[5]));
+            continue;
+        }
+        const renamed = columns.get(original);
+        if (kw(3) === 'drop') {
+            // DROP [COLUMN] c: the column is gone, and its name is free for a later rename.
+            const k = kw(4) === 'column' ? 5 : 4;
+            if (!w[k])
+                continue;
+            const name = lower(w[k].text);
+            for (const [orig, current] of renamed)
+                if (current === name)
+                    renamed.set(orig, DROPPED);
+            continue;
+        }
+        if (kw(3) !== 'rename')
+            continue;
+        if (kw(4) === 'to' && w[5]) {
+            holder.delete(table);
+            holder.set(mainName(w[5]), original);
+            tables.get(original).push(mainName(w[5]));
+        }
+        else {
+            // RENAME [COLUMN] a TO b
+            const k = kw(4) === 'column' ? 5 : 4;
+            if (!w[k] || kw(k + 1) !== 'to' || !w[k + 2])
+                continue;
+            const from = lower(w[k].text);
+            const to = lower(w[k + 2].text);
+            for (const [orig, current] of renamed)
+                if (current === from)
+                    renamed.set(orig, to);
+        }
+    }
+    return { tables, columns, dropped, rebuilt };
+}
+/**
+ * Which table after the migration each table before it became, one to one. A table renamed onto a
+ * name that exists afterwards, and not dropped since, claims it first; every other table falls
+ * back to its original name, then (unless it was dropped) to an earlier name it carried — never
+ * to a name another table already claimed. So
+ * `DROP TABLE b; ALTER TABLE a RENAME TO b` leaves `b` to `a`, and the `b` that was dropped is
+ * gone. Undefined: the table is gone.
+ */
+function endsOf(before, after, renames) {
+    const ends = new Map();
+    const claimed = new Set();
+    for (const [table, names] of renames.tables) {
+        const last = names[names.length - 1];
+        // `holder` gave each name to one table at a time, so two undropped tables cannot end on one.
+        if (names.length > 1 && !renames.dropped.has(table) && after.has(last)) {
+            // A rebuilt table may carry a column under its original name, so it is not followed strictly.
+            ends.set(table, { end: last, followed: !renames.rebuilt.has(table) });
+            claimed.add(last);
+        }
+    }
+    for (const [table, names] of renames.tables) {
+        if (ends.has(table) || !before.has(table))
+            continue;
+        // A dropped table may come back only under its original name — a rebuild back into place. A
+        // name it carried before the drop now belongs to whatever was created there afterwards.
+        const candidates = renames.dropped.has(table) ? [table] : [table, ...[...names].reverse()];
+        const end = candidates.find((n) => after.has(n) && !claimed.has(n));
+        if (end !== undefined)
+            claimed.add(end);
+        // Followed strictly only when the table never moved: a table rebuilt back into place (moved
+        // aside, or dropped and recreated) may carry a column under its original name.
+        const followed = names.length === 1 && !renames.dropped.has(table);
+        ends.set(table, end === undefined ? undefined : { end, followed });
+    }
+    return ends;
+}
+/**
+ * Compare the two measures: every table that held rows, and every column that held values, must
+ * still hold at least as much — following renames — unless it is moved or discarded.
+ */
+function lossesOf(before, after, renames) {
+    const losses = [];
+    const ends = endsOf(before, after, renames);
+    for (const [table, b] of before) {
+        if (b.rows === 0)
+            continue;
+        const resolved = ends.get(table);
+        if (resolved === undefined) {
+            losses.push({ target: { table }, what: `table ${table} held ${b.rows} row(s) and is gone` });
+            continue;
+        }
+        const a = after.get(resolved.end);
+        if (a.rows < b.rows)
+            losses.push({ target: { table }, what: `table ${table} held ${b.rows} row(s), now ${a.rows}` });
+        const renamed = renames.columns.get(table);
+        for (const [column, held] of b.columns) {
+            if (total(held) === 0)
+                continue;
+            // Followed through its renames; on a table rebuilt back into place, the rename the old table
+            // took before it moved aside still names the column, and its original name is the fallback.
+            const mapped = renamed.get(column);
+            // A column a `DROP COLUMN` removed is gone, whatever later takes its name.
+            const kept = mapped === DROPPED ? undefined : (a.columns.get(mapped) ?? (resolved.followed ? undefined : a.columns.get(column)));
+            // A kernel-derived column (`_substrat_archived_at`, …) leaving is the kernel's own check's to
+            // refuse, right after this one in the same transaction (#2090), with the remedy that fits:
+            // no declaration can excuse it. Its VALUES are still held here.
+            if (kept === undefined && namesSpineTable(column))
+                continue;
+            const target = { table, column };
+            if (kept === undefined) {
+                losses.push({ target, what: `column ${table}.${column} held ${total(held)} value(s) and is gone` });
+                continue;
+            }
+            const short = CLASSES.filter((k) => kept[k] < held[k]);
+            if (short.length > 0) {
+                losses.push({
+                    target,
+                    what: `column ${table}.${column} held ${total(held)} value(s), now ${total(kept)}` +
+                        (total(kept) >= total(held) ? ` (${short.map((k) => `${k} ${held[k]} → ${kept[k]}`).join(', ')}: retyped)` : ''),
+                });
+            }
+        }
+    }
+    return losses;
+}
+const declarationError = (key, message, reason = 'migration_declaration') => substratError('validation_failed', `migration ${key}: ${message} (#115)`, { reason });
+/**
+ * A statement that makes a TEMP object: `CREATE TEMP|TEMPORARY …`, or one named into the `temp`
+ * schema (`CREATE TABLE temp.x`, `"temp"."x"`), however the name is spelled.
+ */
+function createsTemp(statement) {
+    const w = words(statement);
+    const kw = (i) => (w[i] && !w[i].quoted ? w[i].text : undefined);
+    if (kw(0) !== 'create')
+        return false;
+    if (kw(1) === 'temp' || kw(1) === 'temporary')
+        return true;
+    let at = 1;
+    if (kw(at) === 'unique' || kw(at) === 'virtual')
+        at += 1;
+    if (!['table', 'view', 'index', 'trigger'].includes(kw(at) ?? ''))
+        return false;
+    at += 1;
+    if (kw(at) === 'if' && kw(at + 1) === 'not' && kw(at + 2) === 'exists')
+        at += 3;
+    // `"temp.x"` is one identifier, a main table whose name holds a dot; `temp.x` is the schema.
+    return w[at] !== undefined && schemaAndName(w[at]).schema === 'temp';
+}
+/** A statement that attaches or detaches a database: `ATTACH [DATABASE] …`, `DETACH [DATABASE] …`. */
+function attaches(statement) {
+    const w = words(statement);
+    return w[0] !== undefined && !w[0].quoted && (w[0].text === 'attach' || w[0].text === 'detach');
+}
+/**
+ * What a declaration counts: a column's values per class, or a table's rows — carried in one
+ * class slot so a move compares tables and columns with the same loop.
+ */
+function countOf(m, t) {
+    const table = m.get(t.table);
+    if (!table)
+        return undefined;
+    if (!t.column)
+        return { ...NONE, integer: table.rows };
+    return table.columns.get(t.column);
+}
+const covers = (declared, lost) => declared.table === lost.table && (declared.column === undefined || declared.column === lost.column);
+/** Each class `got` falls short of `need`, as `<class> <need> → <got>`. */
+const shortfall = (need, got) => CLASSES.filter((k) => got[k] < need[k]).map((k) => `${k} ${need[k]} → ${got[k]}`);
+const plus = (a, b) => Object.fromEntries(CLASSES.map((k) => [k, a[k] + b[k]]));
+const gain = (before, after) => Object.fromEntries(CLASSES.map((k) => [k, (after?.[k] ?? 0) - (before?.[k] ?? 0)]));
+/**
+ * Verify the declared moves: each target gained, per class, what its sources held; and a table
+ * moved whole brought every column that held values into a target column of the same name, unless
+ * that column is declared by name itself.
+ */
+function moveFailures(before, after, moves, discards) {
+    const failures = [];
+    const byTarget = new Map();
+    for (const m of moves) {
+        const entry = byTarget.get(show(m.target)) ?? { target: m.target, sources: [] };
+        entry.sources.push(m.source);
+        byTarget.set(show(m.target), entry);
+    }
+    for (const { target, sources } of byTarget.values()) {
+        if (!countOf(after, target)) {
+            failures.push(`moves names ${show(target)} as a target, which does not exist after the migration`);
+            continue;
+        }
+        const need = sources.reduce((n, s) => plus(n, countOf(before, s)), NONE);
+        const gained = gain(countOf(before, target), countOf(after, target));
+        const short = shortfall(need, gained);
+        if (short.length > 0) {
+            const from = `moves into ${show(target)} from ${sources.map(show).join(', ')}`;
+            failures.push(target.column
+                ? `${from}: the sources' values did not all arrive (${short.join(', ')})`
+                : `${from}: the sources held ${need.integer} row(s), the target gained ${gained.integer}`);
+        }
+        if (target.column)
+            continue;
+        // A table moved whole: its columns arrive by name, unless declared by name.
+        const byColumn = new Map();
+        for (const source of sources) {
+            for (const [column, held] of before.get(source.table).columns) {
+                const named = { table: source.table, column };
+                if (total(held) === 0 || namesSpineTable(column))
+                    continue;
+                if (moves.some((m) => m.source.column === column && m.source.table === source.table))
+                    continue;
+                if (discards.some((d) => covers(d, named)))
+                    continue;
+                const entry = byColumn.get(column) ?? { need: NONE, from: [] };
+                byColumn.set(column, { need: plus(entry.need, held), from: [...entry.from, show(named)] });
+            }
+        }
+        for (const [column, { need: held, from }] of byColumn) {
+            const into = { table: target.table, column };
+            const now = countOf(after, into);
+            const missing = now === undefined ? [] : shortfall(held, gain(countOf(before, into), now));
+            if (now === undefined || missing.length > 0) {
+                failures.push(`moves ${from.join(', ')} into ${target.table}, but ${now === undefined ? `${show(into)} does not exist` : `${show(into)} did not gain them (${missing.join(', ')})`} — ` +
+                    `move the column by name (moves: { '${from[0]}': '<table.column>' }) or discard it`);
+            }
+        }
+    }
+    return failures;
+}
+/**
+ * Wrap one authored migration's execution in the fence. `run` executes every statement of it; it
+ * runs inside the caller's transaction, so a throw from here rolls all of it back.
+ */
+export function fenceMigration(sql, migration, key, run) {
+    const statements = executableSqlStatements(migration.sql);
+    const temp = statements.find(createsTemp);
+    if (temp !== undefined) {
+        throw declarationError(key, `it creates a TEMP object (\`${temp.slice(0, 80)}\`). A Durable Object refuses TEMP objects, so this migration ` +
+            'cannot run on the hosted adapter, and a TEMP table shadows the scope\'s own tables for every unqualified statement ' +
+            'after it. Use a regular table and DROP it before the migration ends', 'migration_temp');
+    }
+    const attach = statements.find(attaches);
+    if (attach !== undefined) {
+        throw declarationError(key, `it attaches or detaches a database (\`${attach.slice(0, 80)}\`). A Durable Object refuses ATTACH and DETACH, so this ` +
+            'migration cannot run on the hosted adapter, and an attached database is a file outside the scope the fence protects. ' +
+            "Keep the migration inside the scope's own database", 'migration_attach');
+    }
+    const moves = Object.entries(migration.moves ?? {});
+    const discards = Object.entries(migration.discards ?? {});
+    // The push boundary refuses a `__proto__` declaration key, which a record parsed from JSON would
+    // silently drop (#2322); refusing it here too means the author hears it at lint time, not when
+    // the push leaves the migrations off.
+    for (const [what, record] of [['moves', migration.moves], ['discards', migration.discards]]) {
+        if (record && Object.hasOwn(record, '__proto__'))
+            throw declarationError(key, `${what} names __proto__, which a declaration cannot carry`);
+    }
+    if (moves.length === 0 && discards.length === 0 && statements.every(additive)) {
+        run();
+        return;
+    }
+    const before = measure(sql);
+    // Every declaration is read before anything runs, so a malformed one changes nothing.
+    const parsedMoves = moves.map(([from, to]) => {
+        const source = targetOf(from);
+        const target = targetOf(to);
+        if (!source || !target)
+            throw declarationError(key, `moves: { '${from}': '${to}' } is not 'table' → 'table' or 'table.column' → 'table.column'`);
+        if (!source.column !== !target.column)
+            throw declarationError(key, `moves: { '${from}': '${to}' } moves a table to a column or a column to a table`);
+        if (!countOf(before, source))
+            throw declarationError(key, `moves names ${show(source)}, which this scope does not hold before the migration`);
+        return { source, target };
+    });
+    const parsedDiscards = discards.map(([spec, why]) => {
+        const target = targetOf(spec);
+        if (!target)
+            throw declarationError(key, `discards: { '${spec}': … } is not 'table' or 'table.column'`);
+        // The push boundary's own rule (`blankReason`): a reason of only whitespace or invisible
+        // characters says nothing a reviewer can read, so neither side accepts it (#2322).
+        if (typeof why !== 'string' || blankReason(why))
+            throw declarationError(key, `discards: { '${spec}': … } gives no reason; the reason is what a reviewer reads`);
+        if (!countOf(before, target))
+            throw declarationError(key, `discards names ${show(target)}, which this scope does not hold before the migration`);
+        return target;
+    });
+    run();
+    const after = measure(sql);
+    const failures = moveFailures(before, after, parsedMoves, parsedDiscards);
+    const unexcused = lossesOf(before, after, followRenames(statements, before)).filter((l) => !parsedDiscards.some((d) => covers(d, l.target)) && !parsedMoves.some((m) => covers(m.source, l.target)));
+    if (failures.length === 0 && unexcused.length === 0)
+        return;
+    const lines = [...failures, ...unexcused.map((l) => l.what)];
+    const remedy = unexcused.length === 0
+        ? ''
+        : ` If this is intended, declare it on the migration — discards: { ${unexcused
+            .map((l) => `'${show(l.target)}': '<why this data may go>'`)
+            .join(', ')} } — or, where the data moved, moves: { '<source>': '<where it went>' }.`;
+    throw substratError('forbidden', `migration ${key} would lose data this scope holds, so it was not applied (#115): ${lines.join('; ')}.${remedy}`, { reason: 'data_loss' });
+}
+//# sourceMappingURL=migration-fence.js.map