cvx-kit 0.1.13 → 0.1.14

package/scripts/owned-process.test.mjs

@@ -0,0 +1,107 @@
+// @vitest-environment node
+import assert from 'node:assert/strict'
+import { test } from 'vite-plus/test'
+import { createServer } from 'node:net'
+import { mkdtempSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import {
+	runOwnedProcess,
+	cleanupOwnedProcess,
+	processGroupAlive,
+	collectOwnedCleanup,
+} from './owned-process.mjs'
+
+const proof = mkdtempSync('/tmp/cvx-owned-process-')
+console.log('Owned cleanup evidence: ' + proof)
+
+const descendant = `process.on('SIGINT',()=>{}); process.on('SIGTERM',()=>{}); console.log('ready'); setInterval(()=>{},1000)`
+const parent = `
+ const {spawn}=require('node:child_process');
+ const child=spawn(process.execPath,['-e',${JSON.stringify(descendant)}],{stdio:['ignore','pipe','ignore']});
+ process.on('SIGINT',()=>{}); process.on('SIGTERM',()=>{});
+ child.stdout.once('data',()=>{console.log('descendant:'+child.pid); MODE});
+ setInterval(()=>{},1000);
+`
+
+test('timeout terminates the entire owned group after ignored graceful signals', async () => {
+	let pid
+	try {
+		const result = await runOwnedProcess({
+			command: process.execPath,
+			args: ['-e', parent.replace('MODE', '')],
+			timeoutMs: 1500,
+			graceMs: 150,
+			onSpawn: (value) => {
+				pid = value
+			},
+		})
+		writeFileSync(join(proof, 'timeout.json'), JSON.stringify(result, null, 2))
+		assert.match(result.stdout, /descendant:\d+/)
+		assert.equal(result.timedOut, true)
+		assert.ok(result.timeoutCleanup.signals.includes('SIGKILL'))
+		assert.equal(result.cleanup.alive, false)
+		assert.equal(processGroupAlive(pid), false)
+	} finally {
+		if (pid) await cleanupOwnedProcess(pid, 150)
+	}
+})
+
+test('failed leader preserves failure output and finally cleans its surviving descendant', async () => {
+	let pid
+	try {
+		const result = await runOwnedProcess({
+			command: process.execPath,
+			args: ['-e', parent.replace('MODE', "console.error('original failure'); process.exit(7)")],
+			timeoutMs: 1500,
+			graceMs: 150,
+			onSpawn: (value) => {
+				pid = value
+			},
+		})
+		writeFileSync(join(proof, 'failed-leader.json'), JSON.stringify(result, null, 2))
+		assert.equal(result.code, 7)
+		assert.equal(result.timedOut, false)
+		assert.match(result.stderr, /original failure/)
+		assert.equal(result.cleanup.alive, false)
+		assert.equal(processGroupAlive(pid), false)
+	} finally {
+		if (pid) await cleanupOwnedProcess(pid, 150)
+	}
+})
+
+test('cleanup rejects a group that was not created by the runner', async () => {
+	await assert.rejects(cleanupOwnedProcess(process.pid, 20), /not owned/)
+})
+
+test('port-check failure is recorded without replacing original proof failure', async () => {
+	const server = createServer()
+	await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve))
+	const port = server.address().port
+	try {
+		const result = await runOwnedProcess({
+			command: process.execPath,
+			args: ['-e', 'process.exit(7)'],
+			timeoutMs: 1000,
+		})
+		const failure = new Error('original proof failure: exit ' + result.code)
+		const evidence = await collectOwnedCleanup({
+			pids: [result.pid],
+			ports: [port],
+			failure,
+			checkPort: (requested) =>
+				new Promise((resolve, reject) => {
+					const probe = createServer()
+					probe.once('error', reject)
+					probe.listen(requested, '127.0.0.1', () => probe.close(() => resolve(requested)))
+				}),
+		})
+		writeFileSync(join(proof, 'port-failure.json'), JSON.stringify(evidence, null, 2))
+		assert.equal(evidence.failure.message, 'original proof failure: exit 7')
+		assert.equal(evidence.ports[0].closed, false)
+		assert.equal(evidence.ports[0].error.code, 'EADDRINUSE')
+		assert.equal(evidence.groups[0].alive, false)
+		assert.equal(server.listening, true, 'unrelated listener must never be killed')
+	} finally {
+		await new Promise((resolve) => server.close(resolve))
+	}
+})

package/scripts/smoke-packed-querying.mjs

@@ -0,0 +1,296 @@
+import assert from 'node:assert/strict'
+import { execFileSync } from 'node:child_process'
+import { runOwnedProcess, collectOwnedCleanup } from './owned-process.mjs'
+import { createHash } from 'node:crypto'
+import {
+	cpSync,
+	existsSync,
+	mkdtempSync,
+	readFileSync,
+	readdirSync,
+	symlinkSync,
+	writeFileSync,
+} from 'node:fs'
+import { createServer } from 'node:net'
+import { join, resolve, relative } from 'node:path'
+import {
+	localConvexEnvironment,
+	assertIsolatedConvexFixture,
+	assertLocalConvexState,
+} from './convex-smoke-env.mjs'
+
+// Run against the retained installed peer of the exact packed stress candidate.
+const packed = resolve(process.argv[2] ?? '')
+const identity = JSON.parse(readFileSync(join(packed, 'package-identity.json'), 'utf8'))
+const hash = (bytes) => createHash('sha256').update(bytes).digest('hex')
+assert.equal(hash(readFileSync(identity.tarball)), identity.sha256)
+const source = join(packed, 'installed')
+assert.equal(
+	JSON.parse(readFileSync(join(source, 'node_modules/convex/package.json'), 'utf8')).version,
+	'1.46.0',
+)
+const fixture = mkdtempSync('/tmp/cvx-relational-engine-native-')
+console.log(`U8 native retained proof: ${fixture}`)
+cpSync(join(source, 'convex'), join(fixture, 'convex'), { recursive: true })
+symlinkSync(join(source, 'node_modules'), join(fixture, 'node_modules'), 'dir')
+writeFileSync(
+	join(fixture, 'package.json'),
+	JSON.stringify({
+		private: true,
+		type: 'module',
+		dependencies: { convex: '1.46.0', 'cvx-kit': identity.version },
+	}),
+)
+cpSync(join(source, 'register.mjs'), join(fixture, 'register.mjs'))
+cpSync(
+	resolve(import.meta.dirname, '../test/fixture-packed-querying/audit-native.mjs.template'),
+	join(fixture, 'audit.mjs'),
+)
+cpSync(join(source, 'tsconfig.json'), join(fixture, 'tsconfig.json'))
+writeFileSync(join(fixture, 'package-identity.json'), JSON.stringify(identity, null, 2))
+// Native representative runs under central defaults, rather than the stress ceilings.
+writeFileSync(
+	join(fixture, 'convex/querying.ts'),
+	`import { createQueryEngine } from 'cvx-kit/querying'
+import schema from './schema'
+import { relations } from './relations'
+import { cursor } from './functions'
+export const querying = createQueryEngine({ schema, relations, cursor })
+`,
+)
+const originalRelations = readFileSync(join(fixture, 'convex/relations.ts'), 'utf8')
+writeFileSync(join(fixture, 'convex/relations.ts'), originalRelations)
+writeFileSync(join(fixture, 'convex/relationsEquivalent.ts'), originalRelations)
+writeFileSync(
+	join(fixture, 'convex/relationsChanged.ts'),
+	originalRelations.replace(
+		'aliasLabels: r.many.labels({ from: r.tasks._id.through(r.edges.task), to: r.labels._id.through(r.edges.label) })',
+		'aliasLabels: r.many.labels({ from: r.tasks._id, to: r.labels.task })',
+	),
+)
+writeFileSync(
+	join(fixture, 'convex/api/probes.ts'),
+	`import { createQueryEngine } from 'cvx-kit/querying'
+import { authQuery } from '../functions'
+import { relations as equivalent } from '../relationsEquivalent'
+import { relations as changed } from '../relationsChanged'
+import schema from '../schema'
+import { cursor } from '../functions'
+import { contract } from '../domain/tasks/contracts'
+const eq = createQueryEngine({ schema, relations: equivalent, cursor })
+const different = createQueryEngine({ schema, relations: changed, cursor })
+export const resume = authQuery({ args: contract.queries.list.input, returns: contract.queries.list.result, handler: (ctx,args) => eq(ctx).tasks.paginate(args) })
+export const reject = authQuery({ args: contract.queries.list.input, returns: contract.queries.list.result, handler: (ctx,args) => different(ctx).tasks.paginate(args) })
+`,
+)
+writeFileSync(
+	join(fixture, 'convex/seed.ts'),
+	`import { internalMutation } from './_generated/server'
+export const seed = internalMutation({ args: {}, handler: async (ctx) => {
+const tasks = []
+for(let ordinal=0;ordinal<24;ordinal++) tasks.push(await ctx.db.insert('tasks',{ordinal,tenant:'a',department:'support',status:'open',active:false,priority:0,code:'',authorized:ordinal>=5,secret:'NATIVE_PRIVATE'}))
+const labels=[]
+for(let ordinal=0;ordinal<6;ordinal++) labels.push(await ctx.db.insert('labels',{ordinal,tenant:'a',authorized:ordinal!==5,name:'native-label-'+ordinal,task:tasks[5]}))
+await ctx.db.patch(tasks[5],{reference:tasks[0],required:labels[0]})
+for(let ordinal=0;ordinal<6;ordinal++) await ctx.db.insert('edges',{ordinal,task:tasks[5],label:labels[ordinal],authorized:ordinal!==4})
+await ctx.db.insert('edges',{ordinal:6,task:tasks[5],label:labels[1],authorized:true})
+return {tasks,labels}
+} })
+`,
+)
+// Generated by the native CLI before deployment; initial binding supports the HTTP seed route.
+const serverPath = join(fixture, 'convex/_generated/server.ts')
+writeFileSync(
+	serverPath,
+	readFileSync(serverPath, 'utf8') +
+		"\nexport { httpActionGeneric as httpAction } from 'convex/server'\n",
+)
+writeFileSync(
+	join(fixture, 'convex/http.ts'),
+	`import { httpRouter } from 'convex/server'
+import { httpAction } from './_generated/server'
+import { makeFunctionReference } from 'convex/server'
+const router=httpRouter()
+router.route({path:'/seed',method:'POST',handler:httpAction(async ctx=>new Response(JSON.stringify(await ctx.runMutation(makeFunctionReference<'mutation'>('seed:seed'),{})),{headers:{'content-type':'application/json'}}))})
+export default router
+`,
+)
+// Metadata comes from actual native registered functions, not a reduced hand-written validator.
+writeFileSync(
+	join(fixture, 'metadata.mjs'),
+	`import { writeFileSync } from 'node:fs'; import * as api from './convex/api/tasks.ts';
+for(const [name, fn] of Object.entries(api)) writeFileSync('validator-'+name+'.json',JSON.stringify({args:JSON.parse(fn.exportArgs()),returns:JSON.parse(fn.exportReturns())}));
+`,
+)
+writeFileSync(
+	join(fixture, 'verify.mjs'),
+	`import assert from 'node:assert/strict';import {readFileSync,writeFileSync} from 'node:fs';import {spawnSync} from 'node:child_process';
+const key=JSON.parse(readFileSync('.convex/local/default/config.json')).adminKey;
+const who={subject:'native-reader',issuer:'https://fixture.test',tokenIdentifier:'https://fixture.test|native-reader',org_id:'a',role:'reader'};
+const url='http://127.0.0.1:'+process.argv[2];const records=[];
+async function call(path,label,args,valid=true,identity=who){
+const started=performance.now();const res=await fetch(url+'/api/query',{method:'POST',headers:{'content-type':'application/json',...(identity?{Authorization:'Convex '+key+':'+Buffer.from(JSON.stringify(identity)).toString('base64')}:{})},body:JSON.stringify({path,args,format:'json'})});const raw=await res.text();writeFileSync('http-'+records.length+'-'+label+'.json',raw);const body=JSON.parse(raw);assert.equal(res.status,200);assert.equal(body.status,valid?'success':'error',label+': '+raw);assert.ok(!raw.includes('NATIVE_PRIVATE'));records.push({path,label,args,status:body.status,milliseconds:performance.now()-started,bytes:Buffer.byteLength(raw)});writeFileSync('native-results.json',JSON.stringify(records,null,2));return body;
+}
+// Local deployment registration also consumes the backend write-rate window.
+await new Promise(resolve=>setTimeout(resolve,2000));
+const seedResponse=await fetch('http://127.0.0.1:'+process.argv[3]+'/seed',{method:'POST'});const seedRaw=await seedResponse.text();writeFileSync('seed-envelope.json',seedRaw);assert.equal(seedResponse.status,200);const ids=JSON.parse(seedRaw);
+for(const order of ['asc','desc']){let cursor=null;const actual=[];for(let page=0;page<30;page++){const body=await call('api/tasks:conditional','conditional-'+order+'-'+page,{numItems:7,cursor,order,filters:{active:false}});actual.push(...body.value.page.map(r=>r._id));if(body.value.isDone)break;assert.notEqual(body.value.continueCursor,cursor);cursor=body.value.continueCursor;}const expected=ids.tasks.slice(5);if(order==='desc')expected.reverse();assert.deepEqual(actual,expected);}
+const first=(await call('api/tasks:list','first',{numItems:1,cursor:null})).value;
+assert.match(first.continueCursor,/^pc\\./);assert.ok(!first.continueCursor.includes(ids.tasks[5]));
+await call('api/probes:resume','equivalent-registry',{numItems:7,cursor:first.continueCursor});
+await call('api/probes:reject','changed-registry',{numItems:7,cursor:first.continueCursor},false);
+for(const [label,args,identity] of [['tamper',{numItems:1,cursor:first.continueCursor+'!'},who],['filter',{numItems:1,cursor:first.continueCursor,filters:{ordinal:6}},who],['order',{numItems:1,cursor:first.continueCursor,order:'desc'},who],['tenant',{numItems:1,cursor:first.continueCursor},{...who,org_id:'b'}],['principal',{numItems:1,cursor:first.continueCursor},{...who,subject:'other',tokenIdentifier:'other'}]]){const body=await call('api/tasks:list',label,args,false,identity);assert.match(body.errorMessage,/Invalid cursor/);}
+await call('api/tasks:list','no-identity',{numItems:1,cursor:null},false,null);
+await call('api/tasks:list','unsupported-role',{numItems:1,cursor:null},false,{...who,role:'unknown'});
+const expanded=(await call('api/tasks:expanded','expanded',{numItems:7,cursor:null,filters:{ordinal:5}})).value.page[0];assert.equal(expanded.referenceTask,null);assert.equal(expanded.requiredLabel._id,ids.labels[0]);assert.equal(expanded.labels.page.length,5);assert.ok(expanded.labels.page.every(r=>r.owner._id===ids.tasks[5]));assert.deepEqual(expanded.labels.page.map(r=>r._id),expanded.aliasLabels.page.map(r=>r._id));
+const predicate=(await call('api/tasks:list','nested-predicate',{numItems:7,cursor:null,filters:{labels:{some:{ordinal:1,owner:{ordinal:5}}}}})).value;assert.deepEqual(predicate.page.map(r=>r._id),[ids.tasks[5]]);
+let cursor=null;const child=[];for(let page=0;page<10;page++){const value=(await call('api/tasks:next','child-'+page,{parent:ids.tasks[5],numItems:1,cursor})).value;child.push(...value.page.map(r=>r._id));if(value.isDone)break;cursor=value.continueCursor;}assert.deepEqual(child,[...ids.labels.slice(0,4),ids.labels[1]]);
+await call('api/tasks:next','cross-parent',{parent:ids.tasks[6],numItems:1,cursor},false);
+for(const [label,args] of [['wrong-scalar',{numItems:1,cursor:null,filters:{referenceTask:{ordinal:'wrong'}}}],['unknown-operator',{numItems:1,cursor:null,filters:{ordinal:{bad:1}}}],['bad-options',{numItems:0,cursor:null}],['unknown-field',{numItems:1,cursor:null,filters:{unknown:1}}]])await call('api/tasks:list',label,args,false);
+const wrongTable=await call('api/tasks:next','wrong-table-parent',{parent:ids.labels[0],numItems:1,cursor:null},false);assert.match(wrongTable.errorMessage,/ArgumentValidationError/);assert.ok(!wrongTable.errorMessage.includes('Invalid cursor'));
+const split=(await call('api/tasks:list','native-limit',{numItems:100,cursor:null,maximumRowsRead:8})).value;assert.match(split.splitCursor,/^pc\\./);assert.ok(['SplitRequired','SplitRecommended'].includes(split.pageStatus));
+const left=(await call('api/tasks:list','end-left',{numItems:100,cursor:null,endCursor:split.splitCursor})).value;const right=(await call('api/tasks:list','end-right',{numItems:100,cursor:split.splitCursor,endCursor:split.continueCursor})).value;assert.deepEqual([...left.page,...right.page],split.page);
+const cli=spawnSync(process.execPath,['node_modules/convex/bin/main.js','run','api/tasks:list',JSON.stringify({numItems:1,cursor:null}),'--identity',JSON.stringify(who)],{encoding:'utf8',timeout:30000});writeFileSync('cli-identity.stdout.log',cli.stdout);writeFileSync('cli-identity.stderr.log',cli.stderr);assert.equal(cli.status,0);assert.equal(JSON.parse(cli.stdout).page[0]._id,ids.tasks[5]);
+writeFileSync('NATIVE_SUCCESS',JSON.stringify({cases:records.length,cliIdentity:true}));console.log(records.length+' native HTTP envelopes passed');
+`,
+)
+const files = (dir) =>
+	readdirSync(dir, { withFileTypes: true }).flatMap((e) =>
+		e.isDirectory() ? files(join(dir, e.name)) : [join(dir, e.name)],
+	)
+const paths = files(join(fixture, 'convex')).filter((p) => !p.includes('/_generated/'))
+const hashes = () =>
+	Object.fromEntries(paths.map((p) => [relative(fixture, p), hash(readFileSync(p))]))
+const before = hashes()
+writeFileSync(join(fixture, 'source-before.json'), JSON.stringify(before, null, 2))
+execFileSync(process.execPath, ['--import', './register.mjs', 'metadata.mjs'], {
+	cwd: fixture,
+	stdio: 'pipe',
+})
+const metadata = files(fixture).filter((p) => /validator-.*\.json$/.test(p))
+writeFileSync(
+	join(fixture, 'native-validator-hashes.json'),
+	JSON.stringify(
+		metadata.map((p) => ({
+			path: relative(fixture, p),
+			bytes: readFileSync(p).length,
+			sha256: hash(readFileSync(p)),
+		})),
+		null,
+		2,
+	),
+)
+const env = localConvexEnvironment()
+assertIsolatedConvexFixture(fixture)
+async function freePort(requested = 0) {
+	const server = createServer()
+	await new Promise((done, fail) => {
+		server.once('error', fail)
+		server.listen(requested, '127.0.0.1', done)
+	})
+	const port = server.address().port
+	await new Promise((done) => server.close(done))
+	return port
+}
+const cloud = await freePort()
+let site = await freePort()
+while (site === cloud) site = await freePort()
+const commands = []
+const processes = []
+async function run(label, args) {
+	commands.push([process.execPath, 'node_modules/convex/bin/main.js', ...args])
+	writeFileSync(join(fixture, 'commands.json'), JSON.stringify(commands, null, 2))
+	const result = await runOwnedProcess({
+		command: process.execPath,
+		args: commands.at(-1).slice(1),
+		cwd: fixture,
+		env,
+		onSpawn: (pid) => processes.push(pid),
+	})
+	const { stdout, stderr, ...evidence } = result
+	writeFileSync(join(fixture, label + '.stdout.log'), stdout)
+	writeFileSync(join(fixture, label + '.stderr.log'), stderr)
+	writeFileSync(join(fixture, label + '-result.json'), JSON.stringify(evidence, null, 2))
+	assert.equal(result.code, 0, label + ' failed; retained logs')
+	assert.equal(result.timedOut, false, label + ' timed out; retained logs')
+	assert.equal(result.cleanup?.alive, false, label + ' owned group survived cleanup')
+	console.log(label + ': exit 0')
+}
+let originalFailure
+try {
+	await run('deploy', [
+		'dev',
+		'--once',
+		'--typecheck=disable',
+		'--local-cloud-port',
+		String(cloud),
+		'--local-site-port',
+		String(site),
+	])
+	assertLocalConvexState(fixture)
+	const cfg = JSON.parse(readFileSync(join(fixture, '.convex/local/default/config.json')))
+	assert.equal(cfg.ports.cloud, cloud)
+	assert.equal(cfg.ports.site, site)
+	writeFileSync(
+		join(fixture, 'local-binding.json'),
+		JSON.stringify({ ports: cfg.ports, backendVersion: cfg.backendVersion }),
+	)
+	execFileSync(join(source, 'node_modules/.bin/tsc'), ['--project', 'tsconfig.json'], {
+		cwd: fixture,
+		stdio: 'pipe',
+	})
+	writeFileSync(
+		join(fixture, 'strict-types-result.json'),
+		JSON.stringify({ exitCode: 0, strict: true, skipLibCheck: false }),
+	)
+	await run('runtime', [
+		'dev',
+		'--once',
+		'--typecheck=disable',
+		'--start',
+		`node verify.mjs ${cloud} ${site}`,
+	])
+	assert.ok(existsSync(join(fixture, 'NATIVE_SUCCESS')))
+	const rows = JSON.parse(readFileSync(join(fixture, 'native-results.json')))
+	assert.ok(rows.length >= 25)
+	assert.equal(files(fixture).filter((p) => /http-\d+-.*\.json$/.test(p)).length, rows.length)
+	const key = JSON.parse(readFileSync(join(fixture, '.convex/local/default/config.json'))).adminKey
+	for (const path of files(fixture).filter(
+		(p) => /\.(log|json)$/.test(p) && !p.includes('/.convex/'),
+	)) {
+		const bytes = readFileSync(path, 'utf8')
+		assert.ok(!bytes.includes(key))
+		assert.ok(!bytes.includes('Authorization: Convex'))
+	}
+	assert.deepEqual(hashes(), before)
+	assert.equal(hash(readFileSync(identity.tarball)), identity.sha256)
+	writeFileSync(join(fixture, 'source-after.json'), JSON.stringify(hashes(), null, 2))
+} catch (error) {
+	originalFailure = error
+	throw error
+} finally {
+	const cleanup = await collectOwnedCleanup({
+		pids: processes,
+		ports: [cloud, site],
+		checkPort: freePort,
+		failure: originalFailure,
+	})
+	writeFileSync(join(fixture, 'cleanup.json'), JSON.stringify(cleanup, null, 2))
+	// Preserve the original proof error; cleanup diagnostics remain independently recorded.
+	if (!originalFailure) {
+		assert.ok(
+			cleanup.groups.every((group) => !group.alive && !group.error && group.errors.length === 0),
+			'Owned process cleanup failed',
+		)
+		assert.ok(
+			cleanup.ports.every((port) => port.closed),
+			'Owned ports remain occupied',
+		)
+	}
+}
+writeFileSync(
+	join(fixture, 'SUCCESS'),
+	'Bounded exact packed default runtime integrated proof passed.\n',
+)
+execFileSync(process.execPath, ['audit.mjs'], { cwd: fixture, stdio: 'pipe' })
+console.log(`Native proof complete: ${fixture}`)

package/scripts/test-packed-effect.mjs

@@ -144,6 +144,8 @@ import { workflowTransition } from 'cvx-kit/workflow'
 import { selectOperation, bindOperationExecutor, createOperationTools, operationToolDialect } from 'cvx-kit/agent-tools'
 import { actionGeneric, queryGeneric, mutationGeneric, internalActionGeneric, internalQueryGeneric, internalMutationGeneric } from 'convex/server'
 import { z } from 'zod'
+import { convexTest } from 'convex-test'
+import { defineSchema, anyApi } from 'convex/server'
 const require = createRequire(import.meta.url)
 if (process.argv.includes('--without-effect')) {
  assert.throws(() => require.resolve('effect'), { code: 'MODULE_NOT_FOUND' }, 'optional peer was unexpectedly auto-installed')
@@ -187,7 +189,11 @@ const auth = createAuthFunctions({
  getAuthUser: async () => ({ id: 'actor' }), mapRole: defaultRoleMap, adminRoles: ['admin'],
 })
 const authenticated = auth.authQuery({ args: {}, returns: z.string(), handler: ctx => ctx.actor.userId + ':' + ctx.tenant })
-assert.equal(await authenticated._handler({ auth: { getUserIdentity: async () => ({ subject: 'actor', org_id: 'org', role: 'member' }) }, db: {} }, {}), 'actor:org')
+const authTest = convexTest(defineSchema({}), {
+ './_generated/server.js': async () => ({ query: queryGeneric }),
+ './auth.js': async () => ({ authenticated }),
+})
+assert.equal(await authTest.withIdentity({ subject: 'actor', org_id: 'org', role: 'member' }).query(anyApi.auth.authenticated, {}), 'actor:org')
 const table = zodTable('notes', () => ({ text: z.string() }), { commandFields: ['text'] })
 const crud = createCrudCommands({ Command, table, aggregateType: 'note', actor: () => 'actor' })
 const changes = []
@@ -375,6 +381,7 @@ try {
 				'cvx-kit': `file:${join(temporary, `cvx-kit-${manifest.version}.tgz`)}`,
 				convex: manifest.devDependencies.convex,
 				'convex-helpers': helpersVersion,
+				'convex-test': '0.0.61',
 				'@convex-dev/workflow': manifest.dependencies['@convex-dev/workflow'],
 				zod: manifest.devDependencies.zod,
 			}

package/scripts/test-packed-oxlint.mjs

@@ -9,7 +9,7 @@ const root = join(import.meta.dirname, '..')
 const temporary = mkdtempSync(join(tmpdir(), 'cvx-kit-oxlint-'))
 const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
 const ruleNames = Object.keys(rules)
-assert.equal(ruleNames.length, 21)
+assert.equal(ruleNames.length, 23)
 
 try {
 	run('bun', ['pm', 'pack', '--destination', temporary, '--ignore-scripts'], root)
@@ -79,6 +79,7 @@ export const value = privateHelper()
 import { makeFunctionReference as ref } from 'convex/server'
 import { z } from 'zod'
 import { createAuthFunctions } from 'cvx-kit/auth'
+import { zodTable } from 'cvx-kit/zod-table'
 import { other } from '../domain/users/commands'
 export const save = mutation({ handler: async (ctx) => {
   await ctx.db.insert('orders', { updatedAt: Date.now() })
@@ -88,6 +89,9 @@ export const constructors = createAuthFunctions({})
 export const state = z.enum(['draft'])
 export const target = ref('orders:save')
 export const value = other
+const orders = zodTable('orders', () => ({ name: z.string() }))
+export const dto = { ...orders.toPublicDto(row), _id: row._id }
+export const pagination = z.object({ numItems: z.number(), cursor: z.string().nullable() })
 `,
 		)
 		mkdirSync(join(fixture, 'convex/application'), { recursive: true })

package/scripts/test-packed-querying.mjs

@@ -0,0 +1,185 @@
+import assert from 'node:assert/strict'
+import { execFileSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import { cpSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, writeFileSync } from 'node:fs'
+import { join, resolve, relative } from 'node:path'
+
+const root = resolve(import.meta.dirname, '..')
+const manifest = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
+const proof = mkdtempSync('/tmp/cvx-kit-querying-')
+console.log(`U8 retained proof: ${proof}`)
+const hash = (bytes) => createHash('sha256').update(bytes).digest('hex')
+function files(directory) {
+	return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+		const path = join(directory, entry.name)
+		return entry.isDirectory() ? files(path) : [path]
+	})
+}
+function run(command, args, cwd, label) {
+	const started = performance.now()
+	try {
+		const output = execFileSync(command, args, {
+			cwd,
+			encoding: 'utf8',
+			stdio: 'pipe',
+			timeout: 1200000,
+			maxBuffer: 32 * 1024 * 1024,
+		})
+		writeFileSync(join(proof, `${label}.log`), output)
+		console.log(`${label}: exit 0 (${((performance.now() - started) / 1000).toFixed(2)}s)`)
+		return output
+	} catch (error) {
+		// Install output may contain credentials from caller's package-manager setup.
+		if (label.endsWith('install'))
+			writeFileSync(join(proof, `${label}.log`), `Install failed: exit ${error.status}\n`)
+		else writeFileSync(join(proof, `${label}.log`), `${error.stdout ?? ''}\n${error.stderr ?? ''}`)
+		throw new Error(`${label} failed; evidence retained at ${proof}`, { cause: error.status })
+	}
+}
+const sourcePaths = [
+	'README.md',
+	'package.json',
+	'vite.config.ts',
+	...files(join(root, 'src'))
+		.filter((p) => p.endsWith('.ts'))
+		.map((p) => relative(root, p)),
+	...files(join(root, 'test/fixture-packed-querying')).map((p) => relative(root, p)),
+	'scripts/test-packed-querying.mjs',
+	'scripts/smoke-packed-querying.mjs',
+	'scripts/owned-process.mjs',
+	'scripts/owned-process.test.mjs',
+	'scripts/test-packed-oxlint.mjs',
+]
+const sourceHashes = () =>
+	Object.fromEntries(sourcePaths.map((p) => [p, hash(readFileSync(join(root, p)))]))
+const before = sourceHashes()
+writeFileSync(join(proof, 'source-before.json'), JSON.stringify(before, null, 2))
+run('bun', ['pm', 'pack', '--ignore-scripts', '--destination', proof], root, 'pack')
+const tarball = join(proof, `${manifest.name}-${manifest.version}.tgz`)
+writeFileSync(
+	join(proof, 'package-identity.json'),
+	JSON.stringify(
+		{
+			name: manifest.name,
+			version: manifest.version,
+			tarball,
+			sha256: hash(readFileSync(tarball)),
+			head: execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' }).trim(),
+			files: run('tar', ['-tzf', tarball], root, 'tar-manifest').trim().split('\n'),
+		},
+		null,
+		2,
+	),
+)
+for (const [label, helpers, zod] of [
+	['installed', '0.1.128', '4.6.5'],
+	['minimum', '0.1.127', '4.5.4'],
+]) {
+	const fixture = join(proof, label)
+	mkdirSync(fixture)
+	writeFileSync(
+		join(fixture, 'package.json'),
+		JSON.stringify({
+			private: true,
+			type: 'module',
+			dependencies: {
+				'cvx-kit': `file:${tarball}`,
+				convex: '1.46.0',
+				'convex-helpers': helpers,
+				zod,
+				typescript: '7.0.2',
+				'convex-test': '0.0.61',
+				'@types/node': manifest.devDependencies['@types/node'],
+				oxlint: manifest.devDependencies.oxlint,
+			},
+		}),
+	)
+	const templates = join(root, 'test/fixture-packed-querying')
+	for (const source of files(templates)) {
+		const destination = join(fixture, relative(templates, source).replace(/\.template$/, ''))
+		mkdirSync(resolve(destination, '..'), { recursive: true })
+		cpSync(source, destination)
+	}
+	mkdirSync(join(fixture, 'convex/_generated'), { recursive: true })
+	writeFileSync(
+		join(fixture, 'convex/_generated/dataModel.ts'),
+		`import type {DataModelFromSchemaDefinition} from 'convex/server'; import schema from '../schema'; export type DataModel = DataModelFromSchemaDefinition<typeof schema>\n`,
+	)
+	writeFileSync(
+		join(fixture, 'convex/_generated/server.ts'),
+		`import {queryGeneric, mutationGeneric, actionGeneric, internalQueryGeneric, internalMutationGeneric, internalActionGeneric, type GenericQueryCtx} from 'convex/server'; import type {DataModel} from './dataModel'; export const query = queryGeneric; export const mutation = mutationGeneric; export const action = actionGeneric; export const internalQuery = internalQueryGeneric; export const internalMutation = internalMutationGeneric; export const internalAction = internalActionGeneric; export type QueryCtx = GenericQueryCtx<DataModel>\n`,
+	)
+	writeFileSync(
+		join(fixture, 'tsconfig.json'),
+		JSON.stringify({
+			compilerOptions: {
+				strict: true,
+				types: ['node'],
+				skipLibCheck: false,
+				noEmit: true,
+				target: 'ES2025',
+				module: 'ESNext',
+				moduleResolution: 'bundler',
+				allowImportingTsExtensions: true,
+			},
+			include: ['convex/**/*.ts', 'types.ts', 'runtime.ts', 'focused.ts'],
+		}),
+	)
+	run('bun', ['install', '--ignore-scripts'], fixture, `${label}-install`)
+	const versions = Object.fromEntries(
+		['cvx-kit', 'convex', 'convex-helpers', 'zod', 'typescript', 'convex-test'].map((name) => [
+			name,
+			JSON.parse(readFileSync(join(fixture, 'node_modules', name, 'package.json'), 'utf8')).version,
+		]),
+	)
+	writeFileSync(join(fixture, 'versions.json'), JSON.stringify(versions, null, 2))
+	run(
+		join(fixture, 'node_modules/.bin/tsc'),
+		['--project', 'tsconfig.json'],
+		fixture,
+		`${label}-types`,
+	)
+	const consumerRules = JSON.parse(
+		run(
+			'node',
+			[
+				'--input-type=module',
+				'-e',
+				"import plugin from 'cvx-kit/oxlint'; console.log(JSON.stringify(Object.keys(plugin.rules)))",
+			],
+			fixture,
+			`${label}-consumer-rules`,
+		),
+	)
+	assert.equal(consumerRules.length, 23, 'Run every exported packaged consumer rule')
+	writeFileSync(
+		join(fixture, '.oxlintrc.json'),
+		JSON.stringify({
+			jsPlugins: [{ name: 'cvx', specifier: 'cvx-kit/oxlint' }],
+			rules: Object.fromEntries(consumerRules.map((r) => [`cvx/${r}`, 'error'])),
+		}),
+	)
+	run(
+		join(fixture, 'node_modules/.bin/oxlint'),
+		['--config', '.oxlintrc.json', 'convex'],
+		fixture,
+		`${label}-consumer-lint`,
+	)
+	const tests = files(join(fixture, 'convex'))
+		.filter((p) => p.endsWith('.test.ts'))
+		.map((p) => relative(fixture, p))
+	assert.equal(tests.length, 3)
+	run(
+		'node',
+		['--import', './register.mjs', '--test', ...tests],
+		fixture,
+		`${label}-colocated-tests`,
+	)
+	run('node', ['--import', './register.mjs', 'runtime.ts'], fixture, `${label}-runtime`)
+	run('node', ['--import', './register.mjs', 'focused.ts'], fixture, `${label}-focused`)
+}
+const after = sourceHashes()
+writeFileSync(join(proof, 'source-after.json'), JSON.stringify(after, null, 2))
+assert.deepEqual(after, before, 'source must stay fixed during packed verification')
+writeFileSync(join(proof, 'SUCCESS'), 'Both strict packed peers and full runtime stress passed.\n')
+console.log(`Packed querying complete. Evidence retained at ${proof}`)