cvx-kit 0.1.12 → 0.1.14

package/scripts/owned-process.mjs

@@ -0,0 +1,140 @@
+import { spawn } from 'node:child_process'
+import { setTimeout as delay } from 'node:timers/promises'
+
+export function processGroupAlive(pid) {
+	try {
+		process.kill(-pid, 0)
+		return true
+	} catch (error) {
+		if (error.code === 'ESRCH') return false
+		throw error
+	}
+}
+const owned = new Set()
+export async function cleanupOwnedProcess(pid, graceMs = 1000) {
+	if (!owned.has(pid)) throw new Error('Process group is not owned by this runner')
+	const signals = [],
+		errors = []
+	for (const signal of ['SIGINT', 'SIGTERM', 'SIGKILL']) {
+		if (!processGroupAlive(pid)) break
+		try {
+			process.kill(-pid, signal)
+			signals.push(signal)
+		} catch (error) {
+			if (error.code !== 'ESRCH') errors.push({ signal, code: error.code })
+		}
+		const deadline = performance.now() + graceMs
+		while (processGroupAlive(pid) && performance.now() < deadline) await delay(20)
+	}
+	return { pid, groupId: pid, signals, errors, alive: processGroupAlive(pid) }
+}
+
+export async function runOwnedProcess({
+	command,
+	args,
+	cwd,
+	env,
+	timeoutMs = 180000,
+	graceMs = 1000,
+	onSpawn = () => {},
+}) {
+	const started = performance.now()
+	const child = spawn(command, args, { cwd, env, detached: true, stdio: ['pipe', 'pipe', 'pipe'] })
+	let stdout = '',
+		stderr = '',
+		timedOut = false,
+		spawnError,
+		timeoutCleanup
+	child.stdout.on('data', (bytes) => {
+		stdout += bytes
+	})
+	child.stderr.on('data', (bytes) => {
+		stderr += bytes
+	})
+	const closed = new Promise((resolve) => {
+		child.once('error', (error) => {
+			spawnError = { code: error.code, message: error.message }
+			resolve({ code: null, signal: null })
+		})
+		child.once('close', (code, signal) => resolve({ code, signal }))
+	})
+	if (child.pid) {
+		owned.add(child.pid)
+		onSpawn(child.pid)
+	}
+	child.stdin.end()
+	let finishTimeout
+	const timeoutFinished = new Promise((resolve) => {
+		finishTimeout = resolve
+	})
+	const timer = setTimeout(() => {
+		timedOut = true
+		timeoutCleanup = child.pid
+			? cleanupOwnedProcess(child.pid, graceMs).catch((error) => ({
+					pid: child.pid,
+					alive: true,
+					error: { code: error.code, message: error.message },
+				}))
+			: Promise.resolve(null)
+		timeoutCleanup.then(() => finishTimeout({ code: child.exitCode, signal: child.signalCode }))
+	}, timeoutMs)
+	let exit, cleanup
+	try {
+		exit = await Promise.race([closed, timeoutFinished])
+		if (timeoutCleanup) await timeoutCleanup
+	} finally {
+		clearTimeout(timer)
+		if (child.pid) {
+			try {
+				cleanup = await cleanupOwnedProcess(child.pid, graceMs)
+			} catch (error) {
+				cleanup = {
+					pid: child.pid,
+					alive: true,
+					error: { code: error.code, message: error.message },
+				}
+			}
+		}
+	}
+	if (timedOut) {
+		child.stdout.destroy()
+		child.stderr.destroy()
+		child.unref()
+	}
+	return {
+		...exit,
+		spawnError,
+		stdout,
+		stderr,
+		timedOut,
+		pid: child.pid,
+		milliseconds: performance.now() - started,
+		timeoutCleanup: await timeoutCleanup,
+		cleanup,
+	}
+}
+
+export async function collectOwnedCleanup({ pids, ports, checkPort, failure, graceMs = 1000 }) {
+	const groups = []
+	for (const pid of pids) {
+		try {
+			groups.push(await cleanupOwnedProcess(pid, graceMs))
+		} catch (error) {
+			groups.push({ pid, alive: true, error: { code: error.code, message: error.message } })
+		}
+	}
+	const portResults = []
+	for (const port of ports) {
+		try {
+			portResults.push({ port, closed: (await checkPort(port)) === port })
+		} catch (error) {
+			portResults.push({ port, closed: false, error: { code: error.code, message: error.message } })
+		}
+	}
+	return {
+		pids: groups.map(({ pid, alive }) => ({ pid, alive })),
+		failure: failure ? { name: failure.name, message: failure.message } : null,
+		groups,
+		ports: portResults,
+	}
+}

package/scripts/owned-process.test.mjs

@@ -0,0 +1,107 @@
+// @vitest-environment node
+import assert from 'node:assert/strict'
+import { test } from 'vite-plus/test'
+import { createServer } from 'node:net'
+import { mkdtempSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import {
+	runOwnedProcess,
+	cleanupOwnedProcess,
+	processGroupAlive,
+	collectOwnedCleanup,
+} from './owned-process.mjs'
+
+const proof = mkdtempSync('/tmp/cvx-owned-process-')
+console.log('Owned cleanup evidence: ' + proof)
+
+const descendant = `process.on('SIGINT',()=>{}); process.on('SIGTERM',()=>{}); console.log('ready'); setInterval(()=>{},1000)`
+const parent = `
+ const {spawn}=require('node:child_process');
+ const child=spawn(process.execPath,['-e',${JSON.stringify(descendant)}],{stdio:['ignore','pipe','ignore']});
+ process.on('SIGINT',()=>{}); process.on('SIGTERM',()=>{});
+ child.stdout.once('data',()=>{console.log('descendant:'+child.pid); MODE});
+ setInterval(()=>{},1000);
+`
+
+test('timeout terminates the entire owned group after ignored graceful signals', async () => {
+	let pid
+	try {
+		const result = await runOwnedProcess({
+			command: process.execPath,
+			args: ['-e', parent.replace('MODE', '')],
+			timeoutMs: 1500,
+			graceMs: 150,
+			onSpawn: (value) => {
+				pid = value
+			},
+		})
+		writeFileSync(join(proof, 'timeout.json'), JSON.stringify(result, null, 2))
+		assert.match(result.stdout, /descendant:\d+/)
+		assert.equal(result.timedOut, true)
+		assert.ok(result.timeoutCleanup.signals.includes('SIGKILL'))
+		assert.equal(result.cleanup.alive, false)
+		assert.equal(processGroupAlive(pid), false)
+	} finally {
+		if (pid) await cleanupOwnedProcess(pid, 150)
+	}
+})
+
+test('failed leader preserves failure output and finally cleans its surviving descendant', async () => {
+	let pid
+	try {
+		const result = await runOwnedProcess({
+			command: process.execPath,
+			args: ['-e', parent.replace('MODE', "console.error('original failure'); process.exit(7)")],
+			timeoutMs: 1500,
+			graceMs: 150,
+			onSpawn: (value) => {
+				pid = value
+			},
+		})
+		writeFileSync(join(proof, 'failed-leader.json'), JSON.stringify(result, null, 2))
+		assert.equal(result.code, 7)
+		assert.equal(result.timedOut, false)
+		assert.match(result.stderr, /original failure/)
+		assert.equal(result.cleanup.alive, false)
+		assert.equal(processGroupAlive(pid), false)
+	} finally {
+		if (pid) await cleanupOwnedProcess(pid, 150)
+	}
+})
+
+test('cleanup rejects a group that was not created by the runner', async () => {
+	await assert.rejects(cleanupOwnedProcess(process.pid, 20), /not owned/)
+})
+
+test('port-check failure is recorded without replacing original proof failure', async () => {
+	const server = createServer()
+	await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve))
+	const port = server.address().port
+	try {
+		const result = await runOwnedProcess({
+			command: process.execPath,
+			args: ['-e', 'process.exit(7)'],
+			timeoutMs: 1000,
+		})
+		const failure = new Error('original proof failure: exit ' + result.code)
+		const evidence = await collectOwnedCleanup({
+			pids: [result.pid],
+			ports: [port],
+			failure,
+			checkPort: (requested) =>
+				new Promise((resolve, reject) => {
+					const probe = createServer()
+					probe.once('error', reject)
+					probe.listen(requested, '127.0.0.1', () => probe.close(() => resolve(requested)))
+				}),
+		})
+		writeFileSync(join(proof, 'port-failure.json'), JSON.stringify(evidence, null, 2))
+		assert.equal(evidence.failure.message, 'original proof failure: exit 7')
+		assert.equal(evidence.ports[0].closed, false)
+		assert.equal(evidence.ports[0].error.code, 'EADDRINUSE')
+		assert.equal(evidence.groups[0].alive, false)
+		assert.equal(server.listening, true, 'unrelated listener must never be killed')
+	} finally {
+		await new Promise((resolve) => server.close(resolve))
+	}
+})

package/scripts/smoke-packed-querying.mjs

@@ -0,0 +1,296 @@
+import assert from 'node:assert/strict'
+import { execFileSync } from 'node:child_process'
+import { runOwnedProcess, collectOwnedCleanup } from './owned-process.mjs'
+import { createHash } from 'node:crypto'
+import {
+	cpSync,
+	existsSync,
+	mkdtempSync,
+	readFileSync,
+	readdirSync,
+	symlinkSync,
+	writeFileSync,
+} from 'node:fs'
+import { createServer } from 'node:net'
+import { join, resolve, relative } from 'node:path'
+import {
+	localConvexEnvironment,
+	assertIsolatedConvexFixture,
+	assertLocalConvexState,
+} from './convex-smoke-env.mjs'
+
+// Run against the retained installed peer of the exact packed stress candidate.
+const packed = resolve(process.argv[2] ?? '')
+const identity = JSON.parse(readFileSync(join(packed, 'package-identity.json'), 'utf8'))
+const hash = (bytes) => createHash('sha256').update(bytes).digest('hex')
+assert.equal(hash(readFileSync(identity.tarball)), identity.sha256)
+const source = join(packed, 'installed')
+assert.equal(
+	JSON.parse(readFileSync(join(source, 'node_modules/convex/package.json'), 'utf8')).version,
+	'1.46.0',
+)
+const fixture = mkdtempSync('/tmp/cvx-relational-engine-native-')
+console.log(`U8 native retained proof: ${fixture}`)
+cpSync(join(source, 'convex'), join(fixture, 'convex'), { recursive: true })
+symlinkSync(join(source, 'node_modules'), join(fixture, 'node_modules'), 'dir')
+writeFileSync(
+	join(fixture, 'package.json'),
+	JSON.stringify({
+		private: true,
+		type: 'module',
+		dependencies: { convex: '1.46.0', 'cvx-kit': identity.version },
+	}),
+)
+cpSync(join(source, 'register.mjs'), join(fixture, 'register.mjs'))
+cpSync(
+	resolve(import.meta.dirname, '../test/fixture-packed-querying/audit-native.mjs.template'),
+	join(fixture, 'audit.mjs'),
+)
+cpSync(join(source, 'tsconfig.json'), join(fixture, 'tsconfig.json'))
+writeFileSync(join(fixture, 'package-identity.json'), JSON.stringify(identity, null, 2))
+// Native representative runs under central defaults, rather than the stress ceilings.
+writeFileSync(
+	join(fixture, 'convex/querying.ts'),
+	`import { createQueryEngine } from 'cvx-kit/querying'
+import schema from './schema'
+import { relations } from './relations'
+import { cursor } from './functions'
+export const querying = createQueryEngine({ schema, relations, cursor })
+`,
+)
+const originalRelations = readFileSync(join(fixture, 'convex/relations.ts'), 'utf8')
+writeFileSync(join(fixture, 'convex/relations.ts'), originalRelations)
+writeFileSync(join(fixture, 'convex/relationsEquivalent.ts'), originalRelations)
+writeFileSync(
+	join(fixture, 'convex/relationsChanged.ts'),
+	originalRelations.replace(
+		'aliasLabels: r.many.labels({ from: r.tasks._id.through(r.edges.task), to: r.labels._id.through(r.edges.label) })',
+		'aliasLabels: r.many.labels({ from: r.tasks._id, to: r.labels.task })',
+	),
+)
+writeFileSync(
+	join(fixture, 'convex/api/probes.ts'),
+	`import { createQueryEngine } from 'cvx-kit/querying'
+import { authQuery } from '../functions'
+import { relations as equivalent } from '../relationsEquivalent'
+import { relations as changed } from '../relationsChanged'
+import schema from '../schema'
+import { cursor } from '../functions'
+import { contract } from '../domain/tasks/contracts'
+const eq = createQueryEngine({ schema, relations: equivalent, cursor })
+const different = createQueryEngine({ schema, relations: changed, cursor })
+export const resume = authQuery({ args: contract.queries.list.input, returns: contract.queries.list.result, handler: (ctx,args) => eq(ctx).tasks.paginate(args) })
+export const reject = authQuery({ args: contract.queries.list.input, returns: contract.queries.list.result, handler: (ctx,args) => different(ctx).tasks.paginate(args) })
+`,
+)
+writeFileSync(
+	join(fixture, 'convex/seed.ts'),
+	`import { internalMutation } from './_generated/server'
+export const seed = internalMutation({ args: {}, handler: async (ctx) => {
+const tasks = []
+for(let ordinal=0;ordinal<24;ordinal++) tasks.push(await ctx.db.insert('tasks',{ordinal,tenant:'a',department:'support',status:'open',active:false,priority:0,code:'',authorized:ordinal>=5,secret:'NATIVE_PRIVATE'}))
+const labels=[]
+for(let ordinal=0;ordinal<6;ordinal++) labels.push(await ctx.db.insert('labels',{ordinal,tenant:'a',authorized:ordinal!==5,name:'native-label-'+ordinal,task:tasks[5]}))
+await ctx.db.patch(tasks[5],{reference:tasks[0],required:labels[0]})
+for(let ordinal=0;ordinal<6;ordinal++) await ctx.db.insert('edges',{ordinal,task:tasks[5],label:labels[ordinal],authorized:ordinal!==4})
+await ctx.db.insert('edges',{ordinal:6,task:tasks[5],label:labels[1],authorized:true})
+return {tasks,labels}
+} })
+`,
+)
+// Generated by the native CLI before deployment; initial binding supports the HTTP seed route.
+const serverPath = join(fixture, 'convex/_generated/server.ts')
+writeFileSync(
+	serverPath,
+	readFileSync(serverPath, 'utf8') +
+		"\nexport { httpActionGeneric as httpAction } from 'convex/server'\n",
+)
+writeFileSync(
+	join(fixture, 'convex/http.ts'),
+	`import { httpRouter } from 'convex/server'
+import { httpAction } from './_generated/server'
+import { makeFunctionReference } from 'convex/server'
+const router=httpRouter()
+router.route({path:'/seed',method:'POST',handler:httpAction(async ctx=>new Response(JSON.stringify(await ctx.runMutation(makeFunctionReference<'mutation'>('seed:seed'),{})),{headers:{'content-type':'application/json'}}))})
+export default router
+`,
+)
+// Metadata comes from actual native registered functions, not a reduced hand-written validator.
+writeFileSync(
+	join(fixture, 'metadata.mjs'),
+	`import { writeFileSync } from 'node:fs'; import * as api from './convex/api/tasks.ts';
+for(const [name, fn] of Object.entries(api)) writeFileSync('validator-'+name+'.json',JSON.stringify({args:JSON.parse(fn.exportArgs()),returns:JSON.parse(fn.exportReturns())}));
+`,
+)
+writeFileSync(
+	join(fixture, 'verify.mjs'),
+	`import assert from 'node:assert/strict';import {readFileSync,writeFileSync} from 'node:fs';import {spawnSync} from 'node:child_process';
+const key=JSON.parse(readFileSync('.convex/local/default/config.json')).adminKey;
+const who={subject:'native-reader',issuer:'https://fixture.test',tokenIdentifier:'https://fixture.test|native-reader',org_id:'a',role:'reader'};
+const url='http://127.0.0.1:'+process.argv[2];const records=[];
+async function call(path,label,args,valid=true,identity=who){
+const started=performance.now();const res=await fetch(url+'/api/query',{method:'POST',headers:{'content-type':'application/json',...(identity?{Authorization:'Convex '+key+':'+Buffer.from(JSON.stringify(identity)).toString('base64')}:{})},body:JSON.stringify({path,args,format:'json'})});const raw=await res.text();writeFileSync('http-'+records.length+'-'+label+'.json',raw);const body=JSON.parse(raw);assert.equal(res.status,200);assert.equal(body.status,valid?'success':'error',label+': '+raw);assert.ok(!raw.includes('NATIVE_PRIVATE'));records.push({path,label,args,status:body.status,milliseconds:performance.now()-started,bytes:Buffer.byteLength(raw)});writeFileSync('native-results.json',JSON.stringify(records,null,2));return body;
+}
+// Local deployment registration also consumes the backend write-rate window.
+await new Promise(resolve=>setTimeout(resolve,2000));
+const seedResponse=await fetch('http://127.0.0.1:'+process.argv[3]+'/seed',{method:'POST'});const seedRaw=await seedResponse.text();writeFileSync('seed-envelope.json',seedRaw);assert.equal(seedResponse.status,200);const ids=JSON.parse(seedRaw);
+for(const order of ['asc','desc']){let cursor=null;const actual=[];for(let page=0;page<30;page++){const body=await call('api/tasks:conditional','conditional-'+order+'-'+page,{numItems:7,cursor,order,filters:{active:false}});actual.push(...body.value.page.map(r=>r._id));if(body.value.isDone)break;assert.notEqual(body.value.continueCursor,cursor);cursor=body.value.continueCursor;}const expected=ids.tasks.slice(5);if(order==='desc')expected.reverse();assert.deepEqual(actual,expected);}
+const first=(await call('api/tasks:list','first',{numItems:1,cursor:null})).value;
+assert.match(first.continueCursor,/^pc\\./);assert.ok(!first.continueCursor.includes(ids.tasks[5]));
+await call('api/probes:resume','equivalent-registry',{numItems:7,cursor:first.continueCursor});
+await call('api/probes:reject','changed-registry',{numItems:7,cursor:first.continueCursor},false);
+for(const [label,args,identity] of [['tamper',{numItems:1,cursor:first.continueCursor+'!'},who],['filter',{numItems:1,cursor:first.continueCursor,filters:{ordinal:6}},who],['order',{numItems:1,cursor:first.continueCursor,order:'desc'},who],['tenant',{numItems:1,cursor:first.continueCursor},{...who,org_id:'b'}],['principal',{numItems:1,cursor:first.continueCursor},{...who,subject:'other',tokenIdentifier:'other'}]]){const body=await call('api/tasks:list',label,args,false,identity);assert.match(body.errorMessage,/Invalid cursor/);}
+await call('api/tasks:list','no-identity',{numItems:1,cursor:null},false,null);
+await call('api/tasks:list','unsupported-role',{numItems:1,cursor:null},false,{...who,role:'unknown'});
+const expanded=(await call('api/tasks:expanded','expanded',{numItems:7,cursor:null,filters:{ordinal:5}})).value.page[0];assert.equal(expanded.referenceTask,null);assert.equal(expanded.requiredLabel._id,ids.labels[0]);assert.equal(expanded.labels.page.length,5);assert.ok(expanded.labels.page.every(r=>r.owner._id===ids.tasks[5]));assert.deepEqual(expanded.labels.page.map(r=>r._id),expanded.aliasLabels.page.map(r=>r._id));
+const predicate=(await call('api/tasks:list','nested-predicate',{numItems:7,cursor:null,filters:{labels:{some:{ordinal:1,owner:{ordinal:5}}}}})).value;assert.deepEqual(predicate.page.map(r=>r._id),[ids.tasks[5]]);
+let cursor=null;const child=[];for(let page=0;page<10;page++){const value=(await call('api/tasks:next','child-'+page,{parent:ids.tasks[5],numItems:1,cursor})).value;child.push(...value.page.map(r=>r._id));if(value.isDone)break;cursor=value.continueCursor;}assert.deepEqual(child,[...ids.labels.slice(0,4),ids.labels[1]]);
+await call('api/tasks:next','cross-parent',{parent:ids.tasks[6],numItems:1,cursor},false);
+for(const [label,args] of [['wrong-scalar',{numItems:1,cursor:null,filters:{referenceTask:{ordinal:'wrong'}}}],['unknown-operator',{numItems:1,cursor:null,filters:{ordinal:{bad:1}}}],['bad-options',{numItems:0,cursor:null}],['unknown-field',{numItems:1,cursor:null,filters:{unknown:1}}]])await call('api/tasks:list',label,args,false);
+const wrongTable=await call('api/tasks:next','wrong-table-parent',{parent:ids.labels[0],numItems:1,cursor:null},false);assert.match(wrongTable.errorMessage,/ArgumentValidationError/);assert.ok(!wrongTable.errorMessage.includes('Invalid cursor'));
+const split=(await call('api/tasks:list','native-limit',{numItems:100,cursor:null,maximumRowsRead:8})).value;assert.match(split.splitCursor,/^pc\\./);assert.ok(['SplitRequired','SplitRecommended'].includes(split.pageStatus));
+const left=(await call('api/tasks:list','end-left',{numItems:100,cursor:null,endCursor:split.splitCursor})).value;const right=(await call('api/tasks:list','end-right',{numItems:100,cursor:split.splitCursor,endCursor:split.continueCursor})).value;assert.deepEqual([...left.page,...right.page],split.page);
+const cli=spawnSync(process.execPath,['node_modules/convex/bin/main.js','run','api/tasks:list',JSON.stringify({numItems:1,cursor:null}),'--identity',JSON.stringify(who)],{encoding:'utf8',timeout:30000});writeFileSync('cli-identity.stdout.log',cli.stdout);writeFileSync('cli-identity.stderr.log',cli.stderr);assert.equal(cli.status,0);assert.equal(JSON.parse(cli.stdout).page[0]._id,ids.tasks[5]);
+writeFileSync('NATIVE_SUCCESS',JSON.stringify({cases:records.length,cliIdentity:true}));console.log(records.length+' native HTTP envelopes passed');
+`,
+)
+const files = (dir) =>
+	readdirSync(dir, { withFileTypes: true }).flatMap((e) =>
+		e.isDirectory() ? files(join(dir, e.name)) : [join(dir, e.name)],
+	)
+const paths = files(join(fixture, 'convex')).filter((p) => !p.includes('/_generated/'))
+const hashes = () =>
+	Object.fromEntries(paths.map((p) => [relative(fixture, p), hash(readFileSync(p))]))
+const before = hashes()
+writeFileSync(join(fixture, 'source-before.json'), JSON.stringify(before, null, 2))
+execFileSync(process.execPath, ['--import', './register.mjs', 'metadata.mjs'], {
+	cwd: fixture,
+	stdio: 'pipe',
+})
+const metadata = files(fixture).filter((p) => /validator-.*\.json$/.test(p))
+writeFileSync(
+	join(fixture, 'native-validator-hashes.json'),
+	JSON.stringify(
+		metadata.map((p) => ({
+			path: relative(fixture, p),
+			bytes: readFileSync(p).length,
+			sha256: hash(readFileSync(p)),
+		})),
+		null,
+		2,
+	),
+)
+const env = localConvexEnvironment()
+assertIsolatedConvexFixture(fixture)
+async function freePort(requested = 0) {
+	const server = createServer()
+	await new Promise((done, fail) => {
+		server.once('error', fail)
+		server.listen(requested, '127.0.0.1', done)
+	})
+	const port = server.address().port
+	await new Promise((done) => server.close(done))
+	return port
+}
+const cloud = await freePort()
+let site = await freePort()
+while (site === cloud) site = await freePort()
+const commands = []
+const processes = []
+async function run(label, args) {
+	commands.push([process.execPath, 'node_modules/convex/bin/main.js', ...args])
+	writeFileSync(join(fixture, 'commands.json'), JSON.stringify(commands, null, 2))
+	const result = await runOwnedProcess({
+		command: process.execPath,
+		args: commands.at(-1).slice(1),
+		cwd: fixture,
+		env,
+		onSpawn: (pid) => processes.push(pid),
+	})
+	const { stdout, stderr, ...evidence } = result
+	writeFileSync(join(fixture, label + '.stdout.log'), stdout)
+	writeFileSync(join(fixture, label + '.stderr.log'), stderr)
+	writeFileSync(join(fixture, label + '-result.json'), JSON.stringify(evidence, null, 2))
+	assert.equal(result.code, 0, label + ' failed; retained logs')
+	assert.equal(result.timedOut, false, label + ' timed out; retained logs')
+	assert.equal(result.cleanup?.alive, false, label + ' owned group survived cleanup')
+	console.log(label + ': exit 0')
+}
+let originalFailure
+try {
+	await run('deploy', [
+		'dev',
+		'--once',
+		'--typecheck=disable',
+		'--local-cloud-port',
+		String(cloud),
+		'--local-site-port',
+		String(site),
+	])
+	assertLocalConvexState(fixture)
+	const cfg = JSON.parse(readFileSync(join(fixture, '.convex/local/default/config.json')))
+	assert.equal(cfg.ports.cloud, cloud)
+	assert.equal(cfg.ports.site, site)
+	writeFileSync(
+		join(fixture, 'local-binding.json'),
+		JSON.stringify({ ports: cfg.ports, backendVersion: cfg.backendVersion }),
+	)
+	execFileSync(join(source, 'node_modules/.bin/tsc'), ['--project', 'tsconfig.json'], {
+		cwd: fixture,
+		stdio: 'pipe',
+	})
+	writeFileSync(
+		join(fixture, 'strict-types-result.json'),
+		JSON.stringify({ exitCode: 0, strict: true, skipLibCheck: false }),
+	)
+	await run('runtime', [
+		'dev',
+		'--once',
+		'--typecheck=disable',
+		'--start',
+		`node verify.mjs ${cloud} ${site}`,
+	])
+	assert.ok(existsSync(join(fixture, 'NATIVE_SUCCESS')))
+	const rows = JSON.parse(readFileSync(join(fixture, 'native-results.json')))
+	assert.ok(rows.length >= 25)
+	assert.equal(files(fixture).filter((p) => /http-\d+-.*\.json$/.test(p)).length, rows.length)
+	const key = JSON.parse(readFileSync(join(fixture, '.convex/local/default/config.json'))).adminKey
+	for (const path of files(fixture).filter(
+		(p) => /\.(log|json)$/.test(p) && !p.includes('/.convex/'),
+	)) {
+		const bytes = readFileSync(path, 'utf8')
+		assert.ok(!bytes.includes(key))
+		assert.ok(!bytes.includes('Authorization: Convex'))
+	}
+	assert.deepEqual(hashes(), before)
+	assert.equal(hash(readFileSync(identity.tarball)), identity.sha256)
+	writeFileSync(join(fixture, 'source-after.json'), JSON.stringify(hashes(), null, 2))
+} catch (error) {
+	originalFailure = error
+	throw error
+} finally {
+	const cleanup = await collectOwnedCleanup({
+		pids: processes,
+		ports: [cloud, site],
+		checkPort: freePort,
+		failure: originalFailure,
+	})
+	writeFileSync(join(fixture, 'cleanup.json'), JSON.stringify(cleanup, null, 2))
+	// Preserve the original proof error; cleanup diagnostics remain independently recorded.
+	if (!originalFailure) {
+		assert.ok(
+			cleanup.groups.every((group) => !group.alive && !group.error && group.errors.length === 0),
+			'Owned process cleanup failed',
+		)
+		assert.ok(
+			cleanup.ports.every((port) => port.closed),
+			'Owned ports remain occupied',
+		)
+	}
+}
+writeFileSync(
+	join(fixture, 'SUCCESS'),
+	'Bounded exact packed default runtime integrated proof passed.\n',
+)
+execFileSync(process.execPath, ['audit.mjs'], { cwd: fixture, stdio: 'pipe' })
+console.log(`Native proof complete: ${fixture}`)

package/scripts/test-packed-effect.mjs

@@ -29,6 +29,7 @@ const extraTypeFixtures = [
 	join(root, 'README.md'),
 	join(root, 'src/docs/effect.md'),
 	join(root, 'src/docs/commands.md'),
+	join(root, 'src/docs/domain-contracts.md'),
 	join(root, 'src/docs/command-context.md'),
 	join(root, 'src/docs/commands-legacy.md'),
 	join(root, 'src/docs/auth.md'),
@@ -143,6 +144,8 @@ import { workflowTransition } from 'cvx-kit/workflow'
 import { selectOperation, bindOperationExecutor, createOperationTools, operationToolDialect } from 'cvx-kit/agent-tools'
 import { actionGeneric, queryGeneric, mutationGeneric, internalActionGeneric, internalQueryGeneric, internalMutationGeneric } from 'convex/server'
 import { z } from 'zod'
+import { convexTest } from 'convex-test'
+import { defineSchema, anyApi } from 'convex/server'
 const require = createRequire(import.meta.url)
 if (process.argv.includes('--without-effect')) {
  assert.throws(() => require.resolve('effect'), { code: 'MODULE_NOT_FOUND' }, 'optional peer was unexpectedly auto-installed')
@@ -186,7 +189,11 @@ const auth = createAuthFunctions({
  getAuthUser: async () => ({ id: 'actor' }), mapRole: defaultRoleMap, adminRoles: ['admin'],
 })
 const authenticated = auth.authQuery({ args: {}, returns: z.string(), handler: ctx => ctx.actor.userId + ':' + ctx.tenant })
-assert.equal(await authenticated._handler({ auth: { getUserIdentity: async () => ({ subject: 'actor', org_id: 'org', role: 'member' }) }, db: {} }, {}), 'actor:org')
+const authTest = convexTest(defineSchema({}), {
+ './_generated/server.js': async () => ({ query: queryGeneric }),
+ './auth.js': async () => ({ authenticated }),
+})
+assert.equal(await authTest.withIdentity({ subject: 'actor', org_id: 'org', role: 'member' }).query(anyApi.auth.authenticated, {}), 'actor:org')
 const table = zodTable('notes', () => ({ text: z.string() }), { commandFields: ['text'] })
 const crud = createCrudCommands({ Command, table, aggregateType: 'note', actor: () => 'actor' })
 const changes = []
@@ -374,6 +381,7 @@ try {
 				'cvx-kit': `file:${join(temporary, `cvx-kit-${manifest.version}.tgz`)}`,
 				convex: manifest.devDependencies.convex,
 				'convex-helpers': helpersVersion,
+				'convex-test': '0.0.61',
 				'@convex-dev/workflow': manifest.dependencies['@convex-dev/workflow'],
 				zod: manifest.devDependencies.zod,
 			}
@@ -405,6 +413,7 @@ try {
 				for (const filename of [
 					'effect-foundation-types.ts',
 					'domain-effect-types.ts',
+					'domain-handler-types.ts',
 					'domain-exactness-types.ts',
 					'effect-api-types.ts',
 					'effect-api-zod-types.ts',

package/scripts/test-packed-oxlint.mjs

@@ -9,7 +9,7 @@ const root = join(import.meta.dirname, '..')
 const temporary = mkdtempSync(join(tmpdir(), 'cvx-kit-oxlint-'))
 const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
 const ruleNames = Object.keys(rules)
-assert.equal(ruleNames.length, 21)
+assert.equal(ruleNames.length, 23)
 
 try {
 	run('bun', ['pm', 'pack', '--destination', temporary, '--ignore-scripts'], root)
@@ -79,6 +79,7 @@ export const value = privateHelper()
 import { makeFunctionReference as ref } from 'convex/server'
 import { z } from 'zod'
 import { createAuthFunctions } from 'cvx-kit/auth'
+import { zodTable } from 'cvx-kit/zod-table'
 import { other } from '../domain/users/commands'
 export const save = mutation({ handler: async (ctx) => {
   await ctx.db.insert('orders', { updatedAt: Date.now() })
@@ -88,6 +89,9 @@ export const constructors = createAuthFunctions({})
 export const state = z.enum(['draft'])
 export const target = ref('orders:save')
 export const value = other
+const orders = zodTable('orders', () => ({ name: z.string() }))
+export const dto = { ...orders.toPublicDto(row), _id: row._id }
+export const pagination = z.object({ numItems: z.number(), cursor: z.string().nullable() })
 `,
 		)
 		mkdirSync(join(fixture, 'convex/application'), { recursive: true })